Add Inky-based, WIDM-styled email templates (#212)

Adds twig/inky-extra and twig/cssinliner-extra to build the password
reset and email confirmation emails from a shared responsive layout,
styled after the quiz's green/black look, with Dutch copy in the
show's dramatic tone.

.env.test

@@ -1,3 +1,5 @@
 # define your env variables for the test env here
 KERNEL_CLASS='Tvdt\Kernel'
 APP_SECRET='$ecretf0rt3st'
+MAILER_DSN=null://null
+MAILER_SENDER=test@example.org

.githooks/pre-commit

@@ -12,7 +12,12 @@ while IFS= read -r file; do
     [[ -n "$file" ]] && STAGED_TWIG+=("$file")
 done < <(git diff --cached --name-only --diff-filter=ACMR | grep -E '\.twig$' || true)
 
-if [[ ${#STAGED_PHP[@]} -eq 0 && ${#STAGED_TWIG[@]} -eq 0 ]]; then
+STAGED_TS=()
+while IFS= read -r file; do
+    [[ -n "$file" ]] && STAGED_TS+=("$file")
+done < <(git diff --cached --name-only --diff-filter=ACMR | grep -E '\.ts$' || true)
+
+if [[ ${#STAGED_PHP[@]} -eq 0 && ${#STAGED_TWIG[@]} -eq 0 && ${#STAGED_TS[@]} -eq 0 ]]; then
     exit 0
 fi
 
@@ -46,3 +51,18 @@ if [[ ${#STAGED_TWIG[@]} -gt 0 ]]; then
     "${DOCKER_CMD[@]}" vendor/bin/twig-cs-fixer fix "${STAGED_TWIG[@]}"
     git add "${STAGED_TWIG[@]}"
 fi
+
+if [[ ${#STAGED_TS[@]} -gt 0 ]]; then
+    echo "TypeScript (${#STAGED_TS[@]} file(s)): Deno fmt → lint → check"
+
+    echo "  → Deno fmt"
+    "${DOCKER_CMD[@]}" deno fmt "${STAGED_TS[@]}"
+    git add "${STAGED_TS[@]}"
+
+    echo "  → Deno lint"
+    "${DOCKER_CMD[@]}" deno lint --fix "${STAGED_TS[@]}"
+    git add "${STAGED_TS[@]}"
+
+    echo "  → Deno check"
+    "${DOCKER_CMD[@]}" deno check "${STAGED_TS[@]}"
+fi

.github/workflows/ci.yml

@@ -70,6 +70,8 @@ jobs:
           set: |
             *.cache-from=type=gha,scope=${{github.ref}}-devbuild
       - name: Start services
+        env:
+          HTTP_PORT: "80"
         run: docker compose up php database --wait --no-build
       - name: Warm up dev cache
         run: docker compose exec -T php bin/console cache:warmup --env=dev
@@ -93,6 +95,31 @@ jobs:
         id: rector
         continue-on-error: true
         run: docker compose exec -T php vendor/bin/rector process --dry-run --no-progress-bar --output-format=github
+      - name: Translations
+        id: translations
+        continue-on-error: true
+        run: |
+          docker compose exec -T php bin/console translation:extract --force --format=xliff --sort=asc nl
+          if ! git diff --exit-code -- translations; then
+            echo "::error::Translations are out of date. Run 'just translations' and commit the changes."
+            exit 1
+          fi
+      - name: TypeScript Formatting
+        id: ts_fmt
+        continue-on-error: true
+        run: docker compose exec -T php deno fmt --check assets/
+      - name: TypeScript Lint
+        id: ts_lint
+        continue-on-error: true
+        run: docker compose exec -T php deno lint assets/
+      - name: TypeScript Type Check
+        id: ts_check
+        continue-on-error: true
+        run: docker compose exec -T php deno check assets/
+      - name: TypeScript Tests
+        id: ts_test
+        continue-on-error: true
+        run: docker compose exec -T php deno test assets/
       - name: Check HTTP reachability
         run: curl -v --fail-with-body http://localhost
       - name: Assert all checks passed
@@ -111,6 +138,11 @@ jobs:
           check "Twig Coding Style" "${{ steps.twig_cs.outcome }}"
           check "PHPStan"          "${{ steps.phpstan.outcome }}"
           check "Rector"           "${{ steps.rector.outcome }}"
+          check "Translations"     "${{ steps.translations.outcome }}"
+          check "TypeScript Formatting" "${{ steps.ts_fmt.outcome }}"
+          check "TypeScript Lint"       "${{ steps.ts_lint.outcome }}"
+          check "TypeScript Type Check" "${{ steps.ts_check.outcome }}"
+          check "TypeScript Tests"      "${{ steps.ts_test.outcome }}"
           exit $failed
 
   tests:
@@ -123,6 +155,7 @@ jobs:
       checks: write
       pull-requests: write
       contents: read
+      code-quality: write
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
@@ -143,6 +176,8 @@ jobs:
         run: docker compose up php database --wait --no-build
       - name: Build SCSS
         run: docker compose exec -T php bin/console sass:build
+      - name: Build TypeScript
+        run: docker compose exec -T php bin/console typescript:build
       - name: Create test database
         run: docker compose exec -T php bin/console -e test doctrine:database:create
       - name: Run migrations
@@ -150,13 +185,26 @@ jobs:
       - name: Load fixtures
         run: docker compose exec -T php bin/console -e test doctrine:fixtures:load --no-interaction --group=test
       - name: Run PHPUnit
-        run: docker compose exec -T php vendor/bin/phpunit --log-junit var/phpunit/junit.xml
+        # Reports are written outside var/ since var/ is a Docker volume (see the Dockerfile's
+        # VOLUME /app/var/) and isn't bind-mounted to the runner, unlike the rest of the project.
+        run: docker compose exec -T -e MAILER_DSN=null://null php vendor/bin/phpunit --log-junit reports/junit.xml --coverage-cobertura reports/coverage/cobertura.xml
       - name: Publish PHPUnit test results
         if: always()
         uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16 # v6
         with:
-          report_paths: var/phpunit/junit.xml
+          report_paths: reports/junit.xml
           check_name: PHPUnit
+      - name: Upload code coverage
+        # Requires "Code Quality" to be enabled for this repository under
+        # Settings > Code security > Code quality; fail-on-error is false so CI
+        # doesn't go red before that one-time, manual repository setting is turned on.
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/upload-code-coverage@82c7aee3fb2ad768e00b00a0a8d749c5815085b6 # v1
+        with:
+          file: reports/coverage/cobertura.xml
+          language: PHP
+          label: phpunit
+          fail-on-error: false
       - name: Doctrine Schema Validator
         run: docker compose exec -T php bin/console -e test doctrine:schema:validate
 
@@ -166,7 +214,7 @@ jobs:
     timeout-minutes: 20
     if: startsWith(github.ref, 'refs/tags/')
     permissions:
-      actions: read
+      actions: write
     steps:
       - name: Wait for and verify successful CI run on this commit
         env:
@@ -174,6 +222,8 @@ jobs:
         run: |
           max_attempts=30
           attempt=0
+          triggered=false
+
           while [[ $attempt -lt $max_attempts ]]; do
             attempt=$((attempt + 1))
 
@@ -191,12 +241,32 @@ jobs:
               --jq "[.workflow_runs[] | select(.id != ${{ github.run_id }}) | select(.status == \"in_progress\" or .status == \"queued\" or .status == \"waiting\" or .status == \"requested\" or .status == \"pending\")] | length")
 
             if [[ "$in_progress_count" -gt 0 ]]; then
-              echo "CI still in progress (attempt $attempt/$max_attempts), waiting 30s..."
+              echo "CI in progress (attempt $attempt/$max_attempts), waiting 30s..."
               sleep 30
-            else
+              continue
-              echo "::error::No prior successful CI run found for ${{ github.sha }}. Only tag commits that have passed CI on main."
+            fi
+
+            if [[ "$triggered" == "false" ]]; then
+              echo "No prior CI run found for ${{ github.sha }}. Triggering CI on ${{ github.ref }}..."
+              gh workflow run ci.yml --repo "${{ github.repository }}" --ref "${{ github.ref }}"
+              triggered=true
+              echo "Triggered. Waiting 20s for run to register..."
+              sleep 20
+              continue
+            fi
+
+            failed_conclusion=$(gh api \
+              "repos/${{ github.repository }}/actions/workflows/ci.yml/runs?head_sha=${{ github.sha }}&per_page=10" \
+              --jq "[.workflow_runs[] | select(.id != ${{ github.run_id }}) | select(.status == \"completed\") | select(.conclusion != \"success\")] | first | .conclusion // empty" \
+              --raw-output)
+
+            if [[ -n "$failed_conclusion" ]]; then
+              echo "::error::Triggered CI run on main failed with conclusion: $failed_conclusion. Fix the issue before re-tagging."
               exit 1
             fi
+
+            echo "Waiting for triggered run to register (attempt $attempt/$max_attempts)..."
+            sleep 20
           done
 
           echo "::error::Timed out waiting for CI run to complete for ${{ github.sha }}."
@@ -234,6 +304,7 @@ jobs:
         id: meta
         run: |
           REPO_LOWER=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
+          echo "build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
           if [[ "${{ github.ref }}" == refs/tags/* ]]; then
             TAG="${GITHUB_REF#refs/tags/}"
             SENTRY_VERSION="${TAG#v}"
@@ -260,9 +331,12 @@ jobs:
             compose.yaml
             compose.build.yaml
           set: |
+            *.cache-from=type=gha,scope=${{github.ref}}-devbuild
+            *.cache-from=type=gha,scope=refs/heads/main-devbuild
             *.cache-from=type=gha,scope=${{github.ref}}
             *.cache-from=type=gha,scope=refs/heads/main
             *.cache-to=type=gha,scope=${{github.ref}},mode=max
+            *.args.BUILD_TIME=${{ steps.meta.outputs.build_time }}
             *.tags=${{ steps.meta.outputs.full_name }}
 
       - name: Create Sentry release

.gitignore

@@ -1,4 +1,5 @@
 /frankenphp/data
+/reports/
 
 ### Generated by gibo (https://github.com/simonwhitaker/gibo)
 ### https://raw.github.com/github/gitignore/6eeebe6f49678aacd8311ce079842c971b3ebe96/Symfony.gitignore

.idea/TijdVoorDeTest.iml

@@ -4,7 +4,6 @@
     <content url="file://$MODULE_DIR$">
       <sourceFolder url="file://$MODULE_DIR$/src" isTestSource="false" packagePrefix="Tvdt\" />
       <sourceFolder url="file://$MODULE_DIR$/tests" isTestSource="true" packagePrefix="Tvdt\Tests\" />
-      <sourceFolder url="file://$MODULE_DIR$/vendor/maennchen/zipstream-php/test" isTestSource="true" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/clue/ndjson-react" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/composer" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/collections" />
@@ -171,6 +170,17 @@
       <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/polyfill-deepclone" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/file-filter" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/object-mapper" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/symfonycasts/reset-password-bundle" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/dflydev/dot-access-data" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/league/commonmark" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/league/config" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/lorenzo/pinky" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/nette/schema" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/nette/utils" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/tijsverkoyen/css-to-inline-styles" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/twig/cssinliner-extra" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/twig/inky-extra" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/twig/markdown-extra" />
     </content>
     <orderEntry type="inheritedJdk" />
     <orderEntry type="sourceFolder" forTests="false" />

.idea/php.xml

@@ -205,6 +205,17 @@
       <path value="$PROJECT_DIR$/vendor/thecodingmachine/safe" />
       <path value="$PROJECT_DIR$/vendor/martin-georgiev/postgresql-for-doctrine" />
       <path value="$PROJECT_DIR$/vendor/symfony/object-mapper" />
+      <path value="$PROJECT_DIR$/vendor/symfonycasts/reset-password-bundle" />
+      <path value="$PROJECT_DIR$/vendor/lorenzo/pinky" />
+      <path value="$PROJECT_DIR$/vendor/tijsverkoyen/css-to-inline-styles" />
+      <path value="$PROJECT_DIR$/vendor/twig/inky-extra" />
+      <path value="$PROJECT_DIR$/vendor/twig/markdown-extra" />
+      <path value="$PROJECT_DIR$/vendor/twig/cssinliner-extra" />
+      <path value="$PROJECT_DIR$/vendor/league/commonmark" />
+      <path value="$PROJECT_DIR$/vendor/league/config" />
+      <path value="$PROJECT_DIR$/vendor/nette/utils" />
+      <path value="$PROJECT_DIR$/vendor/nette/schema" />
+      <path value="$PROJECT_DIR$/vendor/dflydev/dot-access-data" />
     </include_path>
   </component>
   <component name="PhpInterpreters">
@@ -402,6 +413,7 @@
   <component name="PhpUnit">
     <phpunit_settings>
       <phpunit_by_interpreter interpreter_id="96512cb2-7b9e-4e1d-bfa2-bf7f3be424c8" bootstrap_file_path="./tests/bootstrap.php" configuration_file_path="./phpunit.dist.xml" custom_loader_path="/app/vendor/autoload.php" phpunit_phar_path="" use_bootstrap_file="true" use_configuration_file="true" />
+      <PhpUnitSettings custom_loader_path="$PROJECT_DIR$/vendor/autoload.php" />
     </phpunit_settings>
   </component>
   <component name="Psalm">

CLAUDE.md

@@ -4,7 +4,11 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project Overview
 
-**Tijd voor de test** is a PHP/Symfony 8.1 application for managing quizzes in the style of **Wie is de Mol?** (WIDM) — a Dutch TV show where contestants try to identify a saboteur ("de Mol") among them. At the end of each episode, participants take a quiz about the Mol's identity and actions; the candidate with the least correct answers is eliminated. This app replicates that quiz format with:
+**Tijd voor de test** is a PHP/Symfony 8.1 application for managing quizzes in the style of **Wie is de Mol?** (WIDM) —
+a Dutch TV show where contestants try to identify a saboteur ("de Mol") among them. At the end of each episode,
+participants take a quiz about the Mol's identity and actions; the candidate with the least correct answers is
+eliminated. This app replicates that quiz format with:
+
 - Test creation with variable question counts
 - Season management with active test controls
 - Candidate answer tracking with automatic timing
@@ -12,13 +16,14 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - Backoffice management for quiz administration and statistics
 
 Tech Stack:
+
 - **Framework**: Symfony 8.1
 - **PHP**: 8.5+
 - **Database**: PostgreSQL 16
 - **ORM**: Doctrine
 - **Server**: FrankenPHP with Caddy
 - **Container**: Docker Compose
-- **Frontend**: Twig templates with SASS (via asset mapper)
+- **Frontend**: Twig templates with SASS and TypeScript (via asset mapper)
 - **Testing**: PHPUnit 13 with DAMA Doctrine test bundle
 
 ## Build & Development Commands
@@ -35,6 +40,24 @@ just shell        # Interactive shell inside the PHP container
 just shell-run    # Shell in a fresh one-off container
 ```
 
+### Working in git worktrees
+
+`just up` auto-runs `just init` first, which generates a gitignored `.env.local` per checkout with a unique
+`COMPOSE_PROJECT_NAME`, `IMAGES_PREFIX`, and free `HTTP_PORT`/`HTTPS_PORT`/`POSTGRES_PORT`/`MAILPIT_PORT`/
+`SPOTLIGHT_PORT`. This means every worktree gets its own containers, network, volumes, and image tag — running
+`just up` in two worktrees at the same time does **not** make them share a database, image, or port, even if the
+worktree directories have the same basename.
+
+- Run `just ports` to see the ports assigned to the *current* checkout — the app for that worktree is at
+  `https://localhost:<HTTPS_PORT>`, not a fixed port. Never assume port 8080/8443/5432/etc. when working inside a
+  worktree; always check `.env.local` or `just ports` first.
+- `.env.local` is generated once and reused; it's safe to run `just init`/`just up` repeatedly. Delete `.env.local`
+  and re-run `just init` to force new ports (e.g. if the assigned ones are now taken by something else).
+- Each worktree's Postgres data, uploaded files, and Caddy state live in per-worktree Docker volumes — nothing is
+  shared with the main checkout or other worktrees. Migrations/fixtures must be (re-)run per worktree.
+- `just down`/`just clean` in one worktree only ever affects that worktree's own containers/volumes — safe to run
+  without impacting other worktrees.
+
 ### Database
 
 ```bash
@@ -122,48 +145,151 @@ tests/
 - **Elimination**: Records red/green screens and forced results with joker adjustments.
 - **User**: Administrative accounts for managing the system.
 
+## Domain Context: "De Test" (Wie is de Mol)
+
+**Wie is de Mol?** (WIDM) is a Dutch reality competition: a group of contestants ("kandidaten") travels together while
+one of them, "de Mol", secretly sabotages assignments. Each episode ends with the fixed line: *"Tijd voor de test.
+Twintig vragen over de identiteit en het doen en laten van de Mol. Degene die het minst weet, ligt uit het spel. Behalve
+de Mol. Die hoeft nooit naar huis."* ("Time for the test. Twenty questions about the identity and the actions of the
+Mol. Whoever knows the least is out of the game. Except the Mol — they never have to go home.") The contestant with the
+worst score is eliminated ("afvallen"); the Mol is immune regardless of score, since they already know the answers. This
+app is a generic engine for running that quiz format for private/fan seasons, not just modeling the TV show
+incidentally — the entity model below exists specifically to reproduce WIDM's test mechanics.
+
+### What a test's 20 questions actually are
+
+Per the intro line, questions fall into two factual categories — never opinion ("who would you vote off") — plus a
+third recurring format used on the show:
+
+1. **Identity of the Mol**: guessing which contestant is the Mol.
+2. **The Mol's actions**: what the Mol did or where the Mol was during a specific assignment/moment.
+3. **Candidate self-answered questions**: earlier, every contestant privately answered a question about themselves
+   (an interview-style question); the test then asks other contestants to guess what a *specific* candidate answered
+   about themselves. This tests how well contestants know each other, not just Mol-tracking.
+
+### Why answers can be bound to candidates
+
+All three categories above can have contestants themselves as the answer options rather than free text: "who is the
+Mol" and "who did X" both need contestant names as options, and "what did candidate Y answer" needs Y's own submitted
+answer among the options. In the domain model this is `Answer::$candidates` (a `ManyToMany` to `Candidate`, on both
+sides): an answer option can *be* another contestant, not just text.
+
+Because the relationship is many-to-many on the answer side too, a single answer option can cover **more than one
+candidate at once** — e.g. "Anna en Bram" as one option for "who missed the assignment together", or an option
+representing everyone who gave a particular self-answer in category 3 above. So a candidate-bound answer isn't always
+one candidate, it can be a group; treat `Answer::$candidates` as "the set of contestants this option represents", not
+as a single foreign key.
+
+Combined with `GivenAnswer::$candidate` (who answered), every given answer on a candidate-bound question is a directed
+relationship from the answering candidate to *every* candidate covered by the chosen option — a one-to-many edge when
+the option is a group, not just candidate A pointed at candidate B. This is the mechanic behind any "who's suspected of
+what" or sociogram-style statistic — it only applies to candidate-bound questions, plain trivia questions have no such
+relationship. `Quiz::getQuestionErrors()` already relies on this distinction to validate that every active candidate is
+covered exactly once per candidate-bound question (a candidate appearing across multiple group-options on the same
+question counts as covered more than once).
+
+### Elimination mechanics
+
+- **Red/green screens**: at the end of a test, contestants are shown red or green screens one at a time to build tension
+  before the elimination is revealed. `Elimination::$data` stores the colour shown per candidate (
+  `SCREEN_RED/SCREEN_GREEN` via `getScreenColour()`), independent of the actual quiz score.
+- **Jokers / corrections**: contestants can hold a "joker" (an advantage, e.g. an extra correct answer) that adjusts
+  their effective score without changing what they actually answered. This is `QuizCandidate::$corrections` — a float
+  added to the raw score, kept separate from `GivenAnswer` so the audit trail of what was actually answered stays
+  untouched.
+- **Dropouts**: `Quiz::$dropouts` controls how many contestants can be eliminated in a single test (normally 1, but some
+  episodes eliminate more).
+- **Finalization/locking**: `Quiz::$isFinalized` and `$isLocked` gate when a quiz's questions/answers can still be
+  edited — a quiz becomes immutable once a candidate has started it or an admin explicitly finalizes it. Treat this as
+  the natural point where computed results (scores, statistics) can be cached indefinitely, since nothing that feeds
+  them can change afterward.
+
+### Terminology map (Dutch UI ↔ domain code)
+
+| UI/domain term (Dutch)       | Code                          |
+|------------------------------|-------------------------------|
+| Test                         | `Quiz`                        |
+| Vraag                        | `Question`                    |
+| Antwoord                     | `Answer`                      |
+| Kandidaat                    | `Candidate`                   |
+| Ingevuld antwoord            | `GivenAnswer`                 |
+| Afvallen / rood-groen scherm | `Elimination`                 |
+| Joker / correctie            | `QuizCandidate::$corrections` |
+
 ## Architecture Notes
 
 ### Routing
+
 - Routes are **attribute-based** (PHP 8 attributes in controller methods)
 - Configured in `config/routes/attributes.yaml` for automatic discovery
 - Main entry point: `config/routes.yaml`
 
 ### Service Container & Dependency Injection
+
 - Services in `src/` are automatically registered via PSR-4 namespace `Tvdt\`
 - Exclusions: Entity, DependencyInjection, Kernel classes
 - Autowiring and autoconfiguration enabled by default
 - Service definitions in `config/services.yaml`
 
 ### Database & Migrations
+
 - PostgreSQL-based with Doctrine ORM
-- Migrations in `migrations/` at project root, namespace `DoctrineMigrations` (intentionally not autoloaded); generate with `bin/console make:migration`
+- Migrations in `migrations/` at project root, namespace `DoctrineMigrations` (intentionally not autoloaded); generate
+  with `bin/console make:migration`
 - Test fixtures in `src/DataFixtures/` (loaded with `--group=test`)
 - Test database configured separately via `.env.test`
 
 ### Testing Infrastructure
+
 - **PHPUnit 13** with DAMA Doctrine Test Bundle for transaction rollback
-- Bootstrap: `tests/bootstrap.php` loads env vars and autoloader; `tests/symfony-container.php` boots the test kernel/container (used by Rector)
+- Bootstrap: `tests/bootstrap.php` loads env vars and autoloader; `tests/symfony-container.php` boots the test
+  kernel/container (used by Rector)
 - Symfony test utilities (BrowserKit, CSS selectors) available
 - Coverage excluded from: `src/DataFixtures/`
 - Test environment: `APP_ENV=test` (set in phpunit.dist.xml)
 
 ### Testing Conventions (TDD)
-- **Write the failing test first.** When fixing any PHP-reachable bug, write a PHPUnit test that reproduces the failure before touching the production code. Fix the code until the test passes.
+
-- Only skip a test if the bug is purely in JavaScript/frontend where PHPUnit cannot reach it.
+- **Write the failing test first.** When fixing any PHP-reachable bug, write a PHPUnit test that reproduces the failure
-- Follow the pattern in `tests/Controller/Backoffice/` for controller/integration tests: log in, GET for CSRF token, POST form data, assert redirect, clear entity manager, assert DB state.
+  before touching the production code. Fix the code until the test passes.
+- For bugs in `assets/*.ts` logic, write a `deno test` first instead — same TDD rule, different runner. Only skip a
+  test if the bug is in markup/DOM wiring that isn't worth a test per the rule below.
+- Don't write tests for trivial presentational markup (e.g. asserting a tooltip/popover attribute or a CSS class exists
+  in a template). Tests cover behavior: routing, forms, persistence, authorization.
+- Follow the pattern in `tests/Controller/Backoffice/` for controller/integration tests: log in, GET for CSRF token,
+  POST form data, assert redirect, clear entity manager, assert DB state.
+- **Prefer `TestCase` over `WebTestCase`/`KernelTestCase`.** Reach for the full kernel/DB boot only when the test
+  genuinely needs routing, persistence, or the container — pure logic (services, listeners, helpers) should be tested
+  with plain PHPUnit `TestCase` and mocked dependencies; it's faster and more isolated.
+- **Boy Scout Rule**: when you're already touching a file for an unrelated change, fix small nearby issues in the same
+  commit (e.g. a test that unnecessarily extends `WebTestCase`, a stale comment) rather than leaving them for later —
+  but don't let this balloon into an unrelated refactor.
+- **Scope creep as a service**: when a review (yours or `/code-review`'s) turns up a real bug or gap outside the
+  original task's scope — even in already-merged code untouched by the current diff — fix it in the same MR rather
+  than just reporting it and moving on. Write a regression test first per the TDD rule above. Only leave something
+  unaddressed if fixing it would require a design decision only a human can make (e.g. reverting an intentional
+  security/access-control choice) — in that case, say so explicitly instead of silently skipping it.
 
 ### Code Style & Standards
+
 - **PHP-CS-Fixer**: Symfony ruleset + risky rules enabled
     - Strict types declaration required
     - Trailing commas in multiline structures
     - No else-only blocks
-- **Rector**: Aggressive modernization with all attribute sets + prepared sets (dead code, code quality, Doctrine, Symfony, PHPUnit)
+- **Rector**: Aggressive modernization with all attribute sets + prepared sets (dead code, code quality, Doctrine,
+  Symfony, PHPUnit)
 - **PHPStan**: Level 8 with extensions for Doctrine and Symfony
 - **Twig-CS-Fixer**: Template style enforcement
-- **Safe functions**: Use `thecodingmachine/safe` wrappers for standard PHP functions that return `false` on failure — they throw exceptions instead
+- **Safe functions**: Use `thecodingmachine/safe` wrappers for standard PHP functions that return `false` on failure —
+  they throw exceptions instead
+- **TypeScript (`assets/`)**: Compiled via `sensiolabs/typescript-bundle` (standalone SWC binary, no Node/npm).
+  Formatting, linting, type-checking, and tests use **Deno** (`deno fmt` / `deno lint` / `deno check` / `deno test`) —
+  a single standalone binary, kept dev-only (installed in the `frankenphp_dev` Docker stage, not prod), consistent
+  with the project's no-Node-anywhere approach. See `deno.json` for config; run via `just fix-ts` / `just check-ts` /
+  `just test-ts`. Tests live alongside their source as `*_test.ts` files
 
 ### Environment Configuration
+
 - `.env` - Local development defaults (uncommitted in .env.local)
 - `.env.dev` - Development overrides
 - `.env.test` - Test environment configuration
@@ -174,6 +300,7 @@ tests/
     - `MAILER_SENDER` - From address for emails
 
 ### Frontend Build
+
 - Asset mapper (no Node.js/Webpack) for JS/CSS bundling; JS modules declared in `importmap.php`
 - **Stimulus** controllers in `assets/controllers/`, **Turbo** for SPA-like navigation
 - Sass sources in `assets/styles/`, compiled via `bin/console sass:build`
@@ -190,6 +317,7 @@ GitHub Actions workflow (`.github/workflows/ci.yml`):
     - Twig-CS-Fixer style check
     - PHPStan static analysis
     - Rector dry-run
+    - Translation extraction check (fails if `translation:extract` produces uncommitted changes)
 3. **Integration Tests**:
     - Docker image build and start services
     - Database creation and migration
@@ -206,7 +334,8 @@ Runs on all pushes to main and pull requests. Concurrency cancels old runs on ne
 ## Important Files & Conventions
 
 - **Kernel**: `src/Kernel.php` - Symfony kernel class
-- **AbstractController**: Base class for all controllers — defines route parameter regexes (`SEASON_CODE_REGEX`, `CANDIDATE_HASH_REGEX`) and flash helpers
+- **AbstractController**: Base class for all controllers — defines route parameter regexes (`SEASON_CODE_REGEX`,
+  `CANDIDATE_HASH_REGEX`) and flash helpers
 - **Flash Messages**: Use `FlashType` enum instead of string literals
 - **QuizSpreadsheetService**: Handles importing quizzes from XLSX files
 - **Rector container**: `tests/symfony-container.php` — boots a test kernel so Rector can resolve Symfony service types
@@ -225,6 +354,7 @@ Runs on all pushes to main and pull requests. Concurrency cancels old runs on ne
 ## Composer Scripts
 
 Auto-executed scripts on install/update:
+
 - `cache:clear` - Symfony cache clear
 - `assets:install` - Copy public assets
 - `importmap:install` - JS import map setup
@@ -243,4 +373,5 @@ When writing Dutch help content in `templates/backoffice/help/nl/`:
 - The backoffice elimination logic is in `Controller/Backoffice/PrepareEliminationController.php`
 - Quiz timing logic starts on candidate start click and stops on final answer selection
 - Background music feature noted but not yet implemented (requirements only)
-- Statistics functionality is marked TBD in README
+- Statistics module (per-quiz statistics page, candidate accusation matrix, caching) is planned per GitHub issue #199 —
+  see "Domain Context" above for why candidate-bound answers matter to it

Dockerfile

@@ -32,6 +32,7 @@ RUN set -eux; \
 		opcache \
 		zip \
 		gd \
+		xsl \
 	;
 
 # https://getcomposer.org/doc/03-cli.md#composer-allow-superuser
@@ -62,11 +63,18 @@ ENV APP_ENV=dev XDEBUG_MODE=off
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
 	bash-completion \
+	unzip \
 	&& rm -rf /var/lib/apt/lists/*
 
 COPY --link frankenphp/console-complete.bash /usr/share/bash-completion/completions/console
 COPY --link frankenphp/composer-complete.bash /usr/share/bash-completion/completions/composer
 
+# Deno: standalone binary (no Node/npm) used for TypeScript lint/format/type-check/test,
+# dev-only tooling so it's not installed in the prod stage.
+ENV DENO_INSTALL=/usr/local
+# hadolint ignore=DL4006
+RUN curl -fsSL https://deno.land/install.sh | sh -s v2.9.2
+
 RUN mv "$PHP_INI_DIR/php.ini-development" "$PHP_INI_DIR/php.ini"
 
 RUN set -eux; \
@@ -109,3 +117,7 @@ RUN set -eux; \
 	bin/console sass:build; \
 	bin/console asset-map:compile --no-debug --quiet --no-ansi; \
 	sync;
+
+# Build timestamp for /.well-known/security.txt Expires; must be injected last to avoid cache busting.
+ARG BUILD_TIME=""
+ENV BUILD_TIME=$BUILD_TIME

Justfile

@@ -1,9 +1,94 @@
-up *args:
+# Load per-worktree overrides (project name, image tag, ports) generated by `just init`
+set dotenv-load := true
+set dotenv-filename := ".env.local"
+
+# Generate a per-worktree COMPOSE_PROJECT_NAME, IMAGES_PREFIX and free host ports in .env.local,
+# so multiple worktrees/checkouts of this repo can run `just up` at the same time without their
+# containers, volumes, images or ports colliding. Also points CADDY_DATA_DIR at a location shared
+# by all worktrees of the same clone, so they reuse one self-signed CA/cert instead of generating
+# their own. Safe to re-run; no-ops if already configured.
+init:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [ -f .env.local ] && grep -q '^COMPOSE_PROJECT_NAME=' .env.local; then
+        if ! grep -q '^CADDY_DATA_DIR=' .env.local; then
+            git_common_dir=$(git rev-parse --path-format=absolute --git-common-dir)
+            echo "CADDY_DATA_DIR=${git_common_dir}/tvdt-caddy-data" >> .env.local
+            echo "Backfilled CADDY_DATA_DIR into existing .env.local."
+        fi
+        echo ".env.local already configured for this worktree, skipping (delete it to regenerate)."
+        exit 0
+    fi
+    free_port() {
+        local port="$1" max="$2"
+        while [ "$port" -le "$max" ]; do
+            if ! (exec 3<>/dev/tcp/127.0.0.1/"$port") 2>/dev/null; then
+                echo "$port"
+                return
+            fi
+            exec 3>&- 2>/dev/null || true
+            port=$((port + 1))
+        done
+        echo "no free port found between $1 and $2" >&2
+        exit 1
+    }
+    if command -v sha1sum >/dev/null 2>&1; then
+        hash_cmd=(sha1sum)
+    elif command -v shasum >/dev/null 2>&1; then
+        hash_cmd=(shasum)
+    else
+        hash_cmd=(sha256sum)
+    fi
+    hash=$(pwd | "${hash_cmd[@]}" | cut -c1-8)
+    project="tvdt-${hash}"
+    http_port=$(free_port 8080 8179)
+    https_port=$(free_port 8443 8542)
+    postgres_port=$(free_port 5430 5529)
+    mailpit_port=$(free_port 8025 8124)
+    spotlight_port=$(free_port 8969 9068)
+    # .git is shared by all worktrees of the same clone, so anchoring the Caddy data dir
+    # (self-signed CA + TLS certs) there instead of under the worktree lets every worktree
+    # reuse the same CA, avoiding a fresh cert (and a fresh `just trust-cert`) per checkout.
+    git_common_dir=$(git rev-parse --path-format=absolute --git-common-dir)
+    caddy_data_dir="${git_common_dir}/tvdt-caddy-data"
+    {
+        echo "COMPOSE_PROJECT_NAME=${project}"
+        echo "IMAGES_PREFIX=${project}-"
+        echo "HTTP_PORT=${http_port}"
+        echo "HTTPS_PORT=${https_port}"
+        echo "POSTGRES_PORT=${postgres_port}"
+        echo "MAILPIT_PORT=${mailpit_port}"
+        echo "SPOTLIGHT_PORT=${spotlight_port}"
+        echo "CADDY_DATA_DIR=${caddy_data_dir}"
+    } >> .env.local
+    echo "Generated .env.local for this worktree:"
+    cat .env.local
+
+up *args: init
+    #!/usr/bin/env bash
+    set -a
+    [ -f .env.local ] && source .env.local
+    set +a
     docker compose up -d {{ args }}
 
 down *args:
     docker compose down --remove-orphans {{ args }}
 
+# Show the URLs (and DB connection) assigned to this worktree (see `just init`)
+ports:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [ ! -f .env.local ]; then
+        echo "No .env.local yet, run 'just up' or 'just init' first."
+        exit 0
+    fi
+    set -a
+    source .env.local
+    set +a
+    echo "Tvdt:      https://localhost:${HTTPS_PORT}"
+    echo "Mailpit:   http://localhost:${MAILPIT_PORT}"
+    echo "Spotlight: http://localhost:${SPOTLIGHT_PORT}"
+
 stop:
     docker compose stop
 
@@ -40,6 +125,16 @@ phpstan *args:
 test *args:
     docker compose exec php vendor/bin/phpunit {{ args }}
 
+fix-ts:
+    docker compose exec php deno fmt assets/
+    docker compose exec php deno lint --fix assets/
+
+check-ts:
+    docker compose exec php deno check assets/
+
+test-ts *args:
+    docker compose exec php deno test assets/ {{ args }}
+
 [confirm]
 clean:
     docker compose down -v --remove-orphans
@@ -56,8 +151,13 @@ install-hooks:
     chmod +x .githooks/pre-commit
     @echo "Pre-commit hook installed."
 
-trust-cert:
+trust-cert: init
+    #!/usr/bin/env bash
+    set -euo pipefail
+    set -a
+    source .env.local
+    set +a
     sudo security add-trusted-cer -d \
         -r trustRoot \
         -k "$HOME/Library/Keychains/login.keychain" \
-    ./frankenphp/data/caddy/pki/authorities/local/root.crt
+        "${CADDY_DATA_DIR:-./frankenphp/data}/caddy/pki/authorities/local/root.crt"

README.md

@@ -25,8 +25,13 @@ just migrate   # Run pending database migrations
 just fixtures  # Load dev fixtures (truncates first)
 ```
 
-The app is available at **https://localhost** (self-signed cert — run
+`just up` first runs `just init`, which generates a `.env.local` (gitignored)
-`just trust-cert` on macOS to trust it).
+with a unique `COMPOSE_PROJECT_NAME`, image tag and free host ports for this
+checkout, so multiple worktrees/clones can run at the same time without their
+containers, volumes, images or ports colliding. Run `just ports` to see the
+ports assigned to the current checkout — the app is served at
+`https://localhost:<HTTPS_PORT>` (self-signed cert — run `just trust-cert` on
+macOS to trust it).
 
 ### Useful commands
 

assets/backoffice.ts

@@ -2,12 +2,15 @@ import 'bootstrap/dist/css/bootstrap.min.css';
 import 'bootstrap-icons/font/bootstrap-icons.min.css';
 import './styles/backoffice.scss';
 import '@hotwired/turbo';
-import './stimulus.js';
+import './stimulus.ts';
-import './bootstrap.js';
+import './bootstrap.ts';
 import * as Sentry from '@sentry/browser';
 
-const dsn = document.querySelector('meta[name="sentry-dsn"]')?.content ?? '';
+const dsn = document.querySelector<HTMLMetaElement>('meta[name="sentry-dsn"]')
-const userEmail = document.querySelector('meta[name="user-email"]')?.content ?? '';
+    ?.content ?? '';
+const userEmail =
+    document.querySelector<HTMLMetaElement>('meta[name="user-email"]')
+        ?.content ?? '';
 
 // When no real DSN is configured, route to the local Spotlight sidecar so
 // nothing reaches Sentry. A syntactically valid DSN is still required for the

assets/bootstrap.js

@@ -1 +0,0 @@
-import * as bootstrap from 'bootstrap'

assets/bootstrap.ts

@@ -0,0 +1 @@
+import 'bootstrap';

assets/controllers/bo/form_collection_controller.js

@@ -1,136 +0,0 @@
-import {Controller} from '@hotwired/stimulus';
-
-export default class extends Controller {
-  static targets = ['collection'];
-  static values = {prototype: String};
-
-  connect() {
-    this.index = this.collectionTarget.children.length;
-    this._syncOrdering();
-
-    if (this.index === 0) {
-      this.addItem();
-    }
-
-    // `submit` fires on the ancestor <form>, which is outside this controller's
-    // subtree. Stimulus data-action only works within the controller element, so
-    // addEventListener on the form is the only option here.
-    this._form = this.element.closest('form');
-    if (this._form) {
-      this._submitHandler = () => {
-        [...this.collectionTarget.children].forEach(item => {
-          const input = item.querySelector('input[type="text"]');
-          if (input && input.value.trim() === '') item.remove();
-        });
-      };
-      this._form.addEventListener('submit', this._submitHandler);
-    }
-  }
-
-  disconnect() {
-    if (this._form && this._submitHandler) {
-      this._form.removeEventListener('submit', this._submitHandler);
-    }
-  }
-
-  addItem() {
-    const item = document.createElement('div');
-    item.innerHTML = this.prototypeValue.replace(/__name__/g, this.index);
-    const el = item.firstElementChild;
-    this.collectionTarget.appendChild(el);
-    this.index++;
-    this._syncOrdering();
-  }
-
-  removeItem(event) {
-    event.target.closest('[data-collection-item]').remove();
-    this._notifyChange();
-  }
-
-  sortAlphabetically() {
-    const items = [...this.collectionTarget.children];
-    items.sort((a, b) => {
-      const textA = (a.querySelector('input[type="text"]')?.value ?? '').toLowerCase();
-      const textB = (b.querySelector('input[type="text"]')?.value ?? '').toLowerCase();
-      return textA.localeCompare(textB);
-    });
-    items.forEach(item => this.collectionTarget.appendChild(item));
-    this._syncOrdering();
-    this._notifyChange();
-  }
-
-  randomize() {
-    const items = [...this.collectionTarget.children];
-    for (let i = items.length - 1; i > 0; i--) {
-      const j = Math.floor(Math.random() * (i + 1));
-      [items[i], items[j]] = [items[j], items[i]];
-    }
-    items.forEach(item => this.collectionTarget.appendChild(item));
-    this._syncOrdering();
-    this._notifyChange();
-  }
-
-  autoExpand(event) {
-    if (event.target.type !== 'text') return;
-    const item = event.target.closest('[data-collection-item]');
-    const last = [...this.collectionTarget.children].at(-1);
-    if (item && item === last && event.target.value.trim() !== '') {
-      this.addItem();
-    }
-  }
-
-  // — drag-and-drop —
-
-  dragStart(event) {
-    this._dragging = event.currentTarget.closest('[data-collection-item]');
-    this._dragging.classList.add('opacity-50');
-    event.dataTransfer.effectAllowed = 'move';
-  }
-
-  dragEnd(event) {
-    event.currentTarget.closest('[data-collection-item]').classList.remove('opacity-50');
-    this._dragging = null;
-    this.collectionTarget.querySelectorAll('[data-collection-item]').forEach(i =>
-      i.classList.remove('border-top', 'border-bottom', 'border-primary'),
-    );
-  }
-
-  dragOver(event) {
-    event.preventDefault();
-    const el = event.currentTarget;
-    if (!this._dragging || this._dragging === el) return;
-    event.dataTransfer.dropEffect = 'move';
-    const rect = el.getBoundingClientRect();
-    const isBottom = event.clientY > rect.top + rect.height / 2;
-    el.classList.toggle('border-top', !isBottom);
-    el.classList.toggle('border-bottom', isBottom);
-    el.classList.add('border-primary');
-  }
-
-  dragLeave(event) {
-    event.currentTarget.classList.remove('border-top', 'border-bottom', 'border-primary');
-  }
-
-  drop(event) {
-    event.preventDefault();
-    const el = event.currentTarget;
-    el.classList.remove('border-top', 'border-bottom', 'border-primary');
-    if (!this._dragging || this._dragging === el) return;
-    const rect = el.getBoundingClientRect();
-    const isBottom = event.clientY > rect.top + rect.height / 2;
-    this.collectionTarget.insertBefore(this._dragging, isBottom ? el.nextSibling : el);
-    this._syncOrdering();
-    this._notifyChange();
-  }
-
-  _notifyChange() {
-    this.element.dispatchEvent(new Event('change', {bubbles: true}));
-  }
-
-  _syncOrdering() {
-    [...this.collectionTarget.children].forEach((el, i) => {
-      const input = el.querySelector('input[name*="[ordering]"]');
-      if (input) input.value = i;
-    });
-  }
-}

assets/controllers/bo/form_collection_controller.ts

@@ -0,0 +1,172 @@
+import { Controller } from '@hotwired/stimulus';
+
+export default class extends Controller {
+    static targets = ['collection'];
+    static values = { prototype: String };
+
+    declare readonly collectionTarget: HTMLElement;
+    declare readonly prototypeValue: string;
+
+    index = 0;
+    _dragging: Element | null = null;
+    _form: HTMLFormElement | null = null;
+    _submitHandler: (() => void) | null = null;
+
+    connect(): void {
+        this.index = this.collectionTarget.children.length;
+        this._syncOrdering();
+
+        if (this.index === 0) {
+            this.addItem();
+        }
+
+        // `submit` fires on the ancestor <form>, which is outside this controller's
+        // subtree. Stimulus data-action only works within the controller element, so
+        // addEventListener on the form is the only option here.
+        this._form = this.element.closest('form');
+        if (this._form) {
+            this._submitHandler = () => {
+                [...this.collectionTarget.children].forEach((item) => {
+                    const input = item.querySelector<HTMLInputElement>(
+                        'input[type="text"]',
+                    );
+                    if (input && input.value.trim() === '') item.remove();
+                });
+            };
+            this._form.addEventListener('submit', this._submitHandler);
+        }
+    }
+
+    disconnect(): void {
+        if (this._form && this._submitHandler) {
+            this._form.removeEventListener('submit', this._submitHandler);
+        }
+    }
+
+    addItem(): void {
+        const item = document.createElement('div');
+        item.innerHTML = this.prototypeValue.replace(
+            /__name__/g,
+            String(this.index),
+        );
+        const el = item.firstElementChild;
+        if (el) this.collectionTarget.appendChild(el);
+        this.index++;
+        this._syncOrdering();
+    }
+
+    removeItem(event: Event): void {
+        (event.target as HTMLElement).closest('[data-collection-item]')
+            ?.remove();
+        this._notifyChange();
+    }
+
+    sortAlphabetically(): void {
+        const items = [...this.collectionTarget.children];
+        items.sort((a, b) => {
+            const textA =
+                (a.querySelector<HTMLInputElement>('input[type="text"]')
+                    ?.value ?? '').toLowerCase();
+            const textB =
+                (b.querySelector<HTMLInputElement>('input[type="text"]')
+                    ?.value ?? '').toLowerCase();
+            return textA.localeCompare(textB);
+        });
+        items.forEach((item) => this.collectionTarget.appendChild(item));
+        this._syncOrdering();
+        this._notifyChange();
+    }
+
+    randomize(): void {
+        const items = [...this.collectionTarget.children];
+        for (let i = items.length - 1; i > 0; i--) {
+            const j = Math.floor(Math.random() * (i + 1));
+            [items[i], items[j]] = [items[j], items[i]];
+        }
+        items.forEach((item) => this.collectionTarget.appendChild(item));
+        this._syncOrdering();
+        this._notifyChange();
+    }
+
+    autoExpand(event: Event): void {
+        const target = event.target as HTMLInputElement;
+        if (target.type !== 'text') return;
+        const item = target.closest('[data-collection-item]');
+        const last = [...this.collectionTarget.children].at(-1);
+        if (item && item === last && target.value.trim() !== '') {
+            this.addItem();
+        }
+    }
+
+    // — drag-and-drop —
+
+    dragStart(event: DragEvent): void {
+        this._dragging = (event.currentTarget as HTMLElement).closest(
+            '[data-collection-item]',
+        );
+        this._dragging?.classList.add('opacity-50');
+        event.dataTransfer!.effectAllowed = 'move';
+    }
+
+    dragEnd(event: DragEvent): void {
+        (event.currentTarget as HTMLElement).closest('[data-collection-item]')
+            ?.classList.remove('opacity-50');
+        this._dragging = null;
+        this.collectionTarget.querySelectorAll('[data-collection-item]')
+            .forEach((i) =>
+                i.classList.remove(
+                    'border-top',
+                    'border-bottom',
+                    'border-primary',
+                )
+            );
+    }
+
+    dragOver(event: DragEvent): void {
+        event.preventDefault();
+        const el = event.currentTarget as HTMLElement;
+        if (!this._dragging || this._dragging === el) return;
+        event.dataTransfer!.dropEffect = 'move';
+        const rect = el.getBoundingClientRect();
+        const isBottom = event.clientY > rect.top + rect.height / 2;
+        el.classList.toggle('border-top', !isBottom);
+        el.classList.toggle('border-bottom', isBottom);
+        el.classList.add('border-primary');
+    }
+
+    dragLeave(event: DragEvent): void {
+        (event.currentTarget as HTMLElement).classList.remove(
+            'border-top',
+            'border-bottom',
+            'border-primary',
+        );
+    }
+
+    drop(event: DragEvent): void {
+        event.preventDefault();
+        const el = event.currentTarget as HTMLElement;
+        el.classList.remove('border-top', 'border-bottom', 'border-primary');
+        if (!this._dragging || this._dragging === el) return;
+        const rect = el.getBoundingClientRect();
+        const isBottom = event.clientY > rect.top + rect.height / 2;
+        this.collectionTarget.insertBefore(
+            this._dragging,
+            isBottom ? el.nextSibling : el,
+        );
+        this._syncOrdering();
+        this._notifyChange();
+    }
+
+    _notifyChange(): void {
+        this.element.dispatchEvent(new Event('change', { bubbles: true }));
+    }
+
+    _syncOrdering(): void {
+        [...this.collectionTarget.children].forEach((el, i) => {
+            const input = el.querySelector<HTMLInputElement>(
+                'input[name*="[ordering]"]',
+            );
+            if (input) input.value = String(i);
+        });
+    }
+}

assets/controllers/bo/form_collection_controller_test.ts

@@ -0,0 +1,114 @@
+import { assertEquals } from '@std/assert';
+
+// Stimulus's Controller base class constructor only does `this.context = context`,
+// and target getters are normally installed by Application.register — since we
+// construct the controller directly (no real Stimulus app), collectionTarget/element
+// are assigned here as plain writable properties, backed by a minimal fake DOM
+// container that supports the one operation these methods actually rely on:
+// appendChild() moving an existing child to the end (real DOM semantics).
+class FakeInput {
+    value: string;
+    constructor(value = '') {
+        this.value = value;
+    }
+}
+
+class FakeItem {
+    textInput: FakeInput;
+    orderingInput = new FakeInput();
+
+    constructor(text: string) {
+        this.textInput = new FakeInput(text);
+    }
+
+    querySelector<T>(selector: string): T | null {
+        if (selector.includes('type="text"')) {
+            return this.textInput as unknown as T;
+        }
+        if (selector.includes('ordering')) {
+            return this.orderingInput as unknown as T;
+        }
+        return null;
+    }
+}
+
+class FakeCollection {
+    children: FakeItem[] = [];
+
+    appendChild(item: FakeItem) {
+        const idx = this.children.indexOf(item);
+        if (idx !== -1) this.children.splice(idx, 1);
+        this.children.push(item);
+    }
+}
+
+const { default: FormCollectionController } = await import(
+    './form_collection_controller.ts'
+);
+
+// deno-lint-ignore no-explicit-any
+function makeController(items: FakeItem[]): any {
+    const collectionTarget = new FakeCollection();
+    collectionTarget.children = items;
+    // `element` is a read-only getter on Controller (delegates to `this.scope.element`),
+    // so the fake element is supplied via the constructor context rather than assigned.
+    const controller = new FormCollectionController({
+        scope: { element: { dispatchEvent: () => true } },
+    } as never);
+    return Object.assign(controller, { collectionTarget });
+}
+
+Deno.test("_syncOrdering writes the current index into each item's ordering input", () => {
+    const items = [new FakeItem('c'), new FakeItem('a'), new FakeItem('b')];
+    const controller = makeController(items);
+
+    controller._syncOrdering();
+
+    assertEquals(items.map((i) => i.orderingInput.value), ['0', '1', '2']);
+});
+
+Deno.test('sortAlphabetically reorders items by their text input value, case-insensitively', () => {
+    const c = new FakeItem('Charlie');
+    const a = new FakeItem('alice');
+    const b = new FakeItem('Bob');
+    const controller = makeController([c, a, b]);
+
+    controller.sortAlphabetically();
+
+    assertEquals(
+        controller.collectionTarget.children.map((i: FakeItem) =>
+            i.textInput.value
+        ),
+        ['alice', 'Bob', 'Charlie'],
+    );
+    // _syncOrdering must run after the reorder, against the new order
+    assertEquals(
+        controller.collectionTarget.children.map((i: FakeItem) =>
+            i.orderingInput.value
+        ),
+        ['0', '1', '2'],
+    );
+});
+
+Deno.test('randomize keeps the same set of items and resyncs ordering', () => {
+    const items = [
+        new FakeItem('1'),
+        new FakeItem('2'),
+        new FakeItem('3'),
+        new FakeItem('4'),
+    ];
+    const controller = makeController([...items]);
+
+    controller.randomize();
+
+    const resultValues = controller.collectionTarget.children.map((
+        i: FakeItem,
+    ) => i.textInput.value);
+    assertEquals(resultValues.slice().sort(), ['1', '2', '3', '4']);
+    assertEquals(
+        controller.collectionTarget.children.map((i: FakeItem) =>
+            i.orderingInput.value
+        ),
+        ['0', '1', '2', '3'],
+    );
+});

assets/controllers/bo/modal_controller.js

@@ -1,49 +0,0 @@
-import {Controller} from '@hotwired/stimulus';
-import {Modal} from 'bootstrap';
-import {visit} from '@hotwired/turbo';
-
-export default class extends Controller {
-  static targets = ['modal', 'frame'];
-
-  open(event) {
-    event.preventDefault();
-    const {src, modalTitle} = event.currentTarget.dataset;
-    if (modalTitle) {
-      const titleEl = this.modalTarget.querySelector('.modal-title');
-      if (titleEl) titleEl.textContent = modalTitle;
-    }
-    this.resetDirty();
-    this.frameTarget.innerHTML = '<div class="modal-body text-center py-4"><div class="spinner-border" role="status"></div></div>';
-    this.frameTarget.removeAttribute('src');
-    this.frameTarget.setAttribute('src', src);
-    Modal.getOrCreateInstance(this.modalTarget).show();
-  }
-
-  frameSubmitEnd(event) {
-    if (event.detail.success) {
-      Modal.getOrCreateInstance(this.modalTarget).hide();
-      visit(window.location.href);
-    }
-  }
-
-  markDirty() {
-    if (this._dirty) return;
-    this._dirty = true;
-    // Using _config instead of preventDefault on hide.bs.modal because we need
-    // to block only user-triggered dismissal (backdrop click, Escape key) while
-    // keeping programmatic hide() working — frameSubmitEnd() calls hide() after
-    // a successful save and must not be blocked. _config.backdrop/keyboard is
-    // the correct primitive for that distinction and has been stable across all
-    // Bootstrap 5.x releases.
-    const modal = Modal.getOrCreateInstance(this.modalTarget);
-    modal._config.backdrop = 'static';
-    modal._config.keyboard = false;
-  }
-
-  resetDirty() {
-    this._dirty = false;
-    const modal = Modal.getOrCreateInstance(this.modalTarget);
-    modal._config.backdrop = true;
-    modal._config.keyboard = true;
-  }
-}

assets/controllers/bo/modal_controller.ts

@@ -0,0 +1,66 @@
+import { Controller } from '@hotwired/stimulus';
+import { Modal } from 'bootstrap';
+import { visit } from '@hotwired/turbo';
+
+// Bootstrap's public Modal type doesn't expose `_config` (an internal, but stable, field
+// across all 5.x releases) — extend it locally rather than casting to `any` everywhere.
+interface ModalWithConfig extends Modal {
+    _config: { backdrop: boolean | 'static'; keyboard: boolean };
+}
+
+export default class extends Controller {
+    static targets = ['modal', 'frame'];
+
+    declare readonly modalTarget: HTMLElement;
+    declare readonly frameTarget: HTMLElement;
+
+    _dirty = false;
+
+    open(event: MouseEvent): void {
+        event.preventDefault();
+        const { src, modalTitle } =
+            (event.currentTarget as HTMLElement).dataset;
+        if (modalTitle) {
+            const titleEl = this.modalTarget.querySelector('.modal-title');
+            if (titleEl) titleEl.textContent = modalTitle;
+        }
+        this.resetDirty();
+        this.frameTarget.innerHTML =
+            '<div class="modal-body text-center py-4"><div class="spinner-border" role="status"></div></div>';
+        this.frameTarget.removeAttribute('src');
+        if (src) this.frameTarget.setAttribute('src', src);
+        Modal.getOrCreateInstance(this.modalTarget).show();
+    }
+
+    frameSubmitEnd(event: CustomEvent<{ success: boolean }>): void {
+        if (event.detail.success) {
+            Modal.getOrCreateInstance(this.modalTarget).hide();
+            visit(window.location.href);
+        }
+    }
+
+    markDirty(): void {
+        if (this._dirty) return;
+        this._dirty = true;
+        // Using _config instead of preventDefault on hide.bs.modal because we need
+        // to block only user-triggered dismissal (backdrop click, Escape key) while
+        // keeping programmatic hide() working — frameSubmitEnd() calls hide() after
+        // a successful save and must not be blocked. _config.backdrop/keyboard is
+        // the correct primitive for that distinction and has been stable across all
+        // Bootstrap 5.x releases.
+        const modal = Modal.getOrCreateInstance(
+            this.modalTarget,
+        ) as ModalWithConfig;
+        modal._config.backdrop = 'static';
+        modal._config.keyboard = false;
+    }
+
+    resetDirty(): void {
+        this._dirty = false;
+        const modal = Modal.getOrCreateInstance(
+            this.modalTarget,
+        ) as ModalWithConfig;
+        modal._config.backdrop = true;
+        modal._config.keyboard = true;
+    }
+}

assets/controllers/bo/popover_controller.ts

@@ -0,0 +1,19 @@
+import { Controller } from '@hotwired/stimulus';
+import { Popover } from 'bootstrap';
+
+export default class extends Controller {
+    popovers: Popover[] = [];
+
+    connect(): void {
+        this.popovers = [
+            ...this.element.querySelectorAll('[data-bs-toggle="popover"]'),
+        ]
+            .map((popoverTriggerEl) =>
+                Popover.getOrCreateInstance(popoverTriggerEl)
+            );
+    }
+
+    disconnect(): void {
+        this.popovers.forEach((popover) => popover.dispose());
+    }
+}

assets/controllers/bo/question_list_controller.js

@@ -1,123 +0,0 @@
-import {Controller} from '@hotwired/stimulus';
-
-export default class extends Controller {
-  static targets = ['list', 'item', 'status'];
-  static values = {
-    reorderUrl: String,
-    csrf: String,
-    savedLabel: String,
-    errorLabel: String,
-    errorHint: String,
-  };
-
-  connect() {
-    this._locked = false;
-  }
-
-  dragStart(event) {
-    const item = event.currentTarget.closest('[data-bo--question-list-target="item"]');
-    this._dragging = item;
-    event.dataTransfer.effectAllowed = 'move';
-    setTimeout(() => item.classList.add('opacity-50'), 0);
-  }
-
-  dragEnd(event) {
-    const item = event.currentTarget.closest('[data-bo--question-list-target="item"]');
-    item.classList.remove('opacity-50');
-    this._dragging = null;
-    this._removePlaceholder();
-  }
-
-  dragOver(event) {
-    event.preventDefault();
-    if (!this._dragging) return;
-    event.dataTransfer.dropEffect = 'move';
-
-    const target = event.target.closest('[data-bo--question-list-target="item"]');
-    if (!target || target === this._dragging) return;
-
-    const rect = target.getBoundingClientRect();
-    const insertBefore = event.clientY > rect.top + rect.height / 2 ? target.nextSibling : target;
-
-    if (!this._placeholder) {
-      this._placeholder = document.createElement('div');
-      this._placeholder.className = 'bg-primary rounded mb-2';
-      this._placeholder.style.height = '3px';
-    }
-
-    if (this._placeholder.nextSibling !== insertBefore) {
-      this.listTarget.insertBefore(this._placeholder, insertBefore);
-    }
-  }
-
-  dragLeave(event) {
-    if (!event.relatedTarget || !this.listTarget.contains(event.relatedTarget)) {
-      this._removePlaceholder();
-    }
-  }
-
-  async drop(event) {
-    event.preventDefault();
-    if (!this._dragging || !this._placeholder || this._locked) return;
-    this.listTarget.insertBefore(this._dragging, this._placeholder);
-    this._removePlaceholder();
-    await this._persistOrder();
-  }
-
-  _removePlaceholder() {
-    if (this._placeholder) {
-      this._placeholder.remove();
-      this._placeholder = null;
-    }
-  }
-
-  _setStatus(state) {
-    if (!this.hasStatusTarget) return;
-    const el = this.statusTarget;
-    el.classList.remove('d-none', 'text-bg-success', 'text-bg-danger', 'text-bg-warning');
-    if (state === 'saving') {
-      el.classList.add('text-bg-warning');
-      el.textContent = '…';
-    } else if (state === 'saved') {
-      el.classList.add('text-bg-success');
-      el.textContent = this.savedLabelValue || 'Saved';
-    } else if (state === 'error') {
-      el.classList.add('text-bg-danger');
-      el.textContent = this.errorLabelValue || 'Error';
-    }
-  }
-
-  async _persistOrder() {
-    this._setStatus('saving');
-
-    const params = new URLSearchParams();
-    params.append('_token', this.csrfValue);
-    this.itemTargets.forEach((el, i) => {
-      params.append('ordering[]', el.dataset.questionId);
-      const numberEl = el.querySelector('[data-question-number]');
-      if (numberEl) numberEl.textContent = String(i + 1);
-    });
-
-    for (let attempt = 0; attempt < 2; attempt++) {
-      try {
-        const res = await fetch(this.reorderUrlValue, {method: 'POST', body: params});
-        if (res.ok) {
-          this._setStatus('saved');
-          return;
-        }
-      } catch {
-        // network error — retry on first attempt
-      }
-    }
-
-    this._locked = true;
-    this._setStatus('error');
-
-    const alert = document.createElement('div');
-    alert.className = 'alert alert-danger alert-dismissible mt-3';
-    alert.setAttribute('role', 'alert');
-    const hint = this.errorHintValue || 'Refresh the page to try again.';
-    alert.innerHTML = `${this.errorLabelValue || 'Error saving order'} &mdash; ${hint} <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>`;
-    this.listTarget.after(alert);
-  }
-}

assets/controllers/bo/question_list_controller.ts

@@ -0,0 +1,161 @@
+import { Controller } from '@hotwired/stimulus';
+
+type Status = 'saving' | 'saved' | 'error';
+
+export default class extends Controller {
+    static targets = ['list', 'item', 'status'];
+    static values = {
+        reorderUrl: String,
+        csrf: String,
+        savedLabel: String,
+        errorLabel: String,
+        errorHint: String,
+    };
+
+    declare readonly listTarget: HTMLElement;
+    declare readonly itemTargets: HTMLElement[];
+    declare readonly statusTarget: HTMLElement;
+    declare readonly hasStatusTarget: boolean;
+
+    declare readonly reorderUrlValue: string;
+    declare readonly csrfValue: string;
+    declare readonly savedLabelValue: string;
+    declare readonly errorLabelValue: string;
+    declare readonly errorHintValue: string;
+
+    _locked = false;
+    _dragging: HTMLElement | null = null;
+    _placeholder: HTMLDivElement | null = null;
+
+    connect(): void {
+        this._locked = false;
+    }
+
+    dragStart(event: DragEvent): void {
+        const item = (event.currentTarget as HTMLElement).closest<HTMLElement>(
+            '[data-bo--question-list-target="item"]',
+        );
+        this._dragging = item;
+        event.dataTransfer!.effectAllowed = 'move';
+        setTimeout(() => item?.classList.add('opacity-50'), 0);
+    }
+
+    dragEnd(event: DragEvent): void {
+        const item = (event.currentTarget as HTMLElement).closest<HTMLElement>(
+            '[data-bo--question-list-target="item"]',
+        );
+        item?.classList.remove('opacity-50');
+        this._dragging = null;
+        this._removePlaceholder();
+    }
+
+    dragOver(event: DragEvent): void {
+        event.preventDefault();
+        if (!this._dragging) return;
+        event.dataTransfer!.dropEffect = 'move';
+
+        const target = (event.target as HTMLElement).closest<HTMLElement>(
+            '[data-bo--question-list-target="item"]',
+        );
+        if (!target || target === this._dragging) return;
+
+        const rect = target.getBoundingClientRect();
+        const insertBefore = event.clientY > rect.top + rect.height / 2
+            ? target.nextSibling
+            : target;
+
+        if (!this._placeholder) {
+            this._placeholder = document.createElement('div');
+            this._placeholder.className = 'bg-primary rounded mb-2';
+            this._placeholder.style.height = '3px';
+        }
+
+        if (this._placeholder.nextSibling !== insertBefore) {
+            this.listTarget.insertBefore(this._placeholder, insertBefore);
+        }
+    }
+
+    dragLeave(event: DragEvent): void {
+        if (
+            !event.relatedTarget ||
+            !this.listTarget.contains(event.relatedTarget as Node)
+        ) {
+            this._removePlaceholder();
+        }
+    }
+
+    async drop(event: DragEvent): Promise<void> {
+        event.preventDefault();
+        if (!this._dragging || !this._placeholder || this._locked) return;
+        this.listTarget.insertBefore(this._dragging, this._placeholder);
+        this._removePlaceholder();
+        await this._persistOrder();
+    }
+
+    _removePlaceholder(): void {
+        if (this._placeholder) {
+            this._placeholder.remove();
+            this._placeholder = null;
+        }
+    }
+
+    _setStatus(state: Status): void {
+        if (!this.hasStatusTarget) return;
+        const el = this.statusTarget;
+        el.classList.remove(
+            'd-none',
+            'text-bg-success',
+            'text-bg-danger',
+            'text-bg-warning',
+        );
+        if (state === 'saving') {
+            el.classList.add('text-bg-warning');
+            el.textContent = '…';
+        } else if (state === 'saved') {
+            el.classList.add('text-bg-success');
+            el.textContent = this.savedLabelValue || 'Saved';
+        } else if (state === 'error') {
+            el.classList.add('text-bg-danger');
+            el.textContent = this.errorLabelValue || 'Error';
+        }
+    }
+
+    async _persistOrder(): Promise<void> {
+        this._setStatus('saving');
+
+        const params = new URLSearchParams();
+        params.append('_token', this.csrfValue);
+        this.itemTargets.forEach((el, i) => {
+            params.append('ordering[]', el.dataset.questionId ?? '');
+            const numberEl = el.querySelector('[data-question-number]');
+            if (numberEl) numberEl.textContent = String(i + 1);
+        });
+
+        for (let attempt = 0; attempt < 2; attempt++) {
+            try {
+                const res = await fetch(this.reorderUrlValue, {
+                    method: 'POST',
+                    body: params,
+                });
+                if (res.ok) {
+                    this._setStatus('saved');
+                    return;
+                }
+            } catch {
+                // network error — retry on first attempt
+            }
+        }
+
+        this._locked = true;
+        this._setStatus('error');
+
+        const alert = document.createElement('div');
+        alert.className = 'alert alert-danger alert-dismissible mt-3';
+        alert.setAttribute('role', 'alert');
+        const hint = this.errorHintValue || 'Refresh the page to try again.';
+        alert.innerHTML = `${
+            this.errorLabelValue || 'Error saving order'
+        } &mdash; ${hint} <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>`;
+        this.listTarget.after(alert);
+    }
+}

assets/controllers/bo/question_list_controller_test.ts

@@ -0,0 +1,140 @@
+import { assertEquals } from '@std/assert';
+
+// Stimulus's Controller base class constructor only does `this.context = context`,
+// and target/value getters (listTarget, csrfValue, ...) are normally installed by
+// Application.register — since we construct the controller directly (no real
+// Stimulus app), they're assigned here as plain writable properties instead.
+class FakeClassList {
+    classes = new Set<string>();
+    add(...names: string[]) {
+        names.forEach((n) => this.classes.add(n));
+    }
+    remove(...names: string[]) {
+        names.forEach((n) => this.classes.delete(n));
+    }
+    contains(name: string) {
+        return this.classes.has(name);
+    }
+}
+
+function fakeElement() {
+    return {
+        classList: new FakeClassList(),
+        textContent: '',
+        after: () => {},
+        setAttribute: () => {},
+    };
+}
+
+// deno-lint-ignore no-explicit-any
+(globalThis as any).document = {
+    createElement: () => ({
+        ...fakeElement(),
+        innerHTML: '',
+    }),
+};
+
+const { default: QuestionListController } = await import(
+    './question_list_controller.ts'
+);
+
+// deno-lint-ignore no-explicit-any
+function makeController(overrides: Record<string, unknown> = {}): any {
+    const controller = new QuestionListController({} as never);
+    return Object.assign(controller, {
+        listTarget: fakeElement(),
+        itemTargets: [],
+        hasStatusTarget: true,
+        statusTarget: fakeElement(),
+        csrfValue: 'csrf-token',
+        reorderUrlValue: '/reorder',
+        savedLabelValue: 'Saved',
+        errorLabelValue: 'Error',
+        errorHintValue: 'Refresh the page.',
+        ...overrides,
+    });
+}
+
+Deno.test('_setStatus renders the saving state', () => {
+    const controller = makeController();
+    controller._setStatus('saving');
+    assertEquals(
+        controller.statusTarget.classList.contains('text-bg-warning'),
+        true,
+    );
+    assertEquals(controller.statusTarget.textContent, '…');
+});
+
+Deno.test('_setStatus renders the saved state with the configured label', () => {
+    const controller = makeController();
+    controller._setStatus('saved');
+    assertEquals(
+        controller.statusTarget.classList.contains('text-bg-success'),
+        true,
+    );
+    assertEquals(controller.statusTarget.textContent, 'Saved');
+});
+
+Deno.test('_setStatus is a no-op when there is no status target', () => {
+    const controller = makeController({ hasStatusTarget: false });
+    controller._setStatus('saving');
+    assertEquals(controller.statusTarget.textContent, '');
+});
+
+Deno.test('_persistOrder posts the item ordering and reports success', async () => {
+    const numberEl = { textContent: '' };
+    const item = {
+        dataset: { questionId: '42' },
+        querySelector: () => numberEl,
+    };
+    const controller = makeController({ itemTargets: [item] });
+
+    let requestBody: URLSearchParams | undefined;
+    globalThis.fetch = ((_url: string, init: RequestInit) => {
+        requestBody = init.body as URLSearchParams;
+        return Promise.resolve({ ok: true } as Response);
+    }) as typeof fetch;
+
+    await controller._persistOrder();
+
+    assertEquals(controller._locked, false);
+    assertEquals(
+        controller.statusTarget.classList.contains('text-bg-success'),
+        true,
+    );
+    assertEquals(numberEl.textContent, '1');
+    assertEquals(requestBody?.get('_token'), 'csrf-token');
+    assertEquals(requestBody?.get('ordering[]'), '42');
+});
+
+Deno.test('_persistOrder retries once, then locks and shows an error after repeated failure', async () => {
+    const controller = makeController();
+    let calls = 0;
+    globalThis.fetch = (() => {
+        calls++;
+        return Promise.resolve({ ok: false } as Response);
+    }) as typeof fetch;
+
+    await controller._persistOrder();
+
+    assertEquals(calls, 2);
+    assertEquals(controller._locked, true);
+    assertEquals(
+        controller.statusTarget.classList.contains('text-bg-danger'),
+        true,
+    );
+});
+
+Deno.test('_persistOrder treats a network error the same as a failed response', async () => {
+    const controller = makeController();
+    globalThis.fetch =
+        (() => Promise.reject(new Error('network down'))) as typeof fetch;
+
+    await controller._persistOrder();
+
+    assertEquals(controller._locked, true);
+    assertEquals(
+        controller.statusTarget.classList.contains('text-bg-danger'),
+        true,
+    );
+});

assets/controllers/bo/quiz_controller.js

@@ -1,28 +0,0 @@
-import {Controller} from '@hotwired/stimulus';
-import {Tooltip, Modal} from 'bootstrap';
-
-export default class extends Controller {
-  static targets = ['clearModal', 'deleteModal'];
-
-  connect() {
-    this.tooltips = [];
-    const tooltipTriggerList = this.element.querySelectorAll('[data-bs-toggle="tooltip"]');
-    [...tooltipTriggerList].forEach(tooltipTriggerEl => {
-      this.tooltips.push(Tooltip.getOrCreateInstance(tooltipTriggerEl));
-    });
-  }
-
-  disconnect() {
-    this.tooltips.forEach(tooltip => tooltip.dispose());
-  }
-
-  clearQuiz() {
-    const modal = Modal.getOrCreateInstance(this.clearModalTarget);
-    modal.show();
-  }
-
-  deleteQuiz() {
-    const modal = Modal.getOrCreateInstance(this.deleteModalTarget);
-    modal.show();
-  }
-}

assets/controllers/bo/quiz_controller.ts

@@ -0,0 +1,35 @@
+import { Controller } from '@hotwired/stimulus';
+import { Modal, Tooltip } from 'bootstrap';
+
+export default class extends Controller {
+    static targets = ['clearModal', 'deleteModal'];
+
+    declare readonly clearModalTarget: HTMLElement;
+    declare readonly deleteModalTarget: HTMLElement;
+
+    tooltips: Tooltip[] = [];
+
+    connect(): void {
+        this.tooltips = [];
+        const tooltipTriggerList = this.element.querySelectorAll(
+            '[data-bs-toggle="tooltip"]',
+        );
+        [...tooltipTriggerList].forEach((tooltipTriggerEl) => {
+            this.tooltips.push(Tooltip.getOrCreateInstance(tooltipTriggerEl));
+        });
+    }
+
+    disconnect(): void {
+        this.tooltips.forEach((tooltip) => tooltip.dispose());
+    }
+
+    clearQuiz(): void {
+        const modal = Modal.getOrCreateInstance(this.clearModalTarget);
+        modal.show();
+    }
+
+    deleteQuiz(): void {
+        const modal = Modal.getOrCreateInstance(this.deleteModalTarget);
+        modal.show();
+    }
+}

assets/controllers/csrf_protection_controller.js

@@ -1,81 +0,0 @@
-const nameCheck = /^[-_a-zA-Z0-9]{4,22}$/;
-const tokenCheck = /^[-_/+a-zA-Z0-9]{24,}$/;
-
-// Generate and double-submit a CSRF token in a form field and a cookie, as defined by Symfony's SameOriginCsrfTokenManager
-// Use `form.requestSubmit()` to ensure that the submit event is triggered. Using `form.submit()` will not trigger the event
-// and thus this event-listener will not be executed.
-document.addEventListener('submit', function (event) {
-    generateCsrfToken(event.target);
-}, true);
-
-// When @hotwired/turbo handles form submissions, send the CSRF token in a header in addition to a cookie
-// The `framework.csrf_protection.check_header` config option needs to be enabled for the header to be checked
-document.addEventListener('turbo:submit-start', function (event) {
-    const h = generateCsrfHeaders(event.detail.formSubmission.formElement);
-    Object.keys(h).map(function (k) {
-        event.detail.formSubmission.fetchRequest.headers[k] = h[k];
-    });
-});
-
-// When @hotwired/turbo handles form submissions, remove the CSRF cookie once a form has been submitted
-document.addEventListener('turbo:submit-end', function (event) {
-    removeCsrfToken(event.detail.formSubmission.formElement);
-});
-
-export function generateCsrfToken (formElement) {
-    const csrfField = formElement.querySelector('input[data-controller="csrf-protection"], input[name="_csrf_token"]');
-
-    if (!csrfField) {
-        return;
-    }
-
-    let csrfCookie = csrfField.getAttribute('data-csrf-protection-cookie-value');
-    let csrfToken = csrfField.value;
-
-    if (!csrfCookie && nameCheck.test(csrfToken)) {
-        csrfField.setAttribute('data-csrf-protection-cookie-value', csrfCookie = csrfToken);
-        csrfField.defaultValue = csrfToken = btoa(String.fromCharCode.apply(null, (window.crypto || window.msCrypto).getRandomValues(new Uint8Array(18))));
-    }
-    csrfField.dispatchEvent(new Event('change', { bubbles: true }));
-
-    if (csrfCookie && tokenCheck.test(csrfToken)) {
-        const cookie = csrfCookie + '_' + csrfToken + '=' + csrfCookie + '; path=/; samesite=strict';
-        document.cookie = window.location.protocol === 'https:' ? '__Host-' + cookie + '; secure' : cookie;
-    }
-}
-
-export function generateCsrfHeaders (formElement) {
-    const headers = {};
-    const csrfField = formElement.querySelector('input[data-controller="csrf-protection"], input[name="_csrf_token"]');
-
-    if (!csrfField) {
-        return headers;
-    }
-
-    const csrfCookie = csrfField.getAttribute('data-csrf-protection-cookie-value');
-
-    if (tokenCheck.test(csrfField.value) && nameCheck.test(csrfCookie)) {
-        headers[csrfCookie] = csrfField.value;
-    }
-
-    return headers;
-}
-
-export function removeCsrfToken (formElement) {
-    const csrfField = formElement.querySelector('input[data-controller="csrf-protection"], input[name="_csrf_token"]');
-
-    if (!csrfField) {
-        return;
-    }
-
-    const csrfCookie = csrfField.getAttribute('data-csrf-protection-cookie-value');
-
-    if (tokenCheck.test(csrfField.value) && nameCheck.test(csrfCookie)) {
-        const cookie = csrfCookie + '_' + csrfField.value + '=0; path=/; samesite=strict; max-age=0';
-
-        document.cookie = window.location.protocol === 'https:' ? '__Host-' + cookie + '; secure' : cookie;
-    }
-}
-
-/* stimulusFetch: 'lazy' */
-export default 'csrf-protection-controller';

assets/controllers/csrf_protection_controller.ts

@@ -0,0 +1,129 @@
+const nameCheck = /^[-_a-zA-Z0-9]{4,22}$/;
+const tokenCheck = /^[-_/+a-zA-Z0-9]{24,}$/;
+
+interface TurboSubmitEventDetail {
+    formSubmission: {
+        formElement: HTMLFormElement;
+        fetchRequest: { headers: Record<string, string> };
+    };
+}
+
+const CSRF_FIELD_SELECTOR =
+    'input[data-controller="csrf-protection"], input[name="_csrf_token"]';
+
+// Generate and double-submit a CSRF token in a form field and a cookie, as defined by Symfony's SameOriginCsrfTokenManager
+// Use `form.requestSubmit()` to ensure that the submit event is triggered. Using `form.submit()` will not trigger the event
+// and thus this event-listener will not be executed.
+document.addEventListener('submit', function (event) {
+    generateCsrfToken(event.target as HTMLFormElement);
+}, true);
+
+// When @hotwired/turbo handles form submissions, send the CSRF token in a header in addition to a cookie
+// The `framework.csrf_protection.check_header` config option needs to be enabled for the header to be checked
+document.addEventListener('turbo:submit-start', function (event) {
+    const detail = (event as CustomEvent<TurboSubmitEventDetail>).detail;
+    const h = generateCsrfHeaders(detail.formSubmission.formElement);
+    Object.keys(h).forEach(function (k) {
+        detail.formSubmission.fetchRequest.headers[k] = h[k];
+    });
+});
+
+// When @hotwired/turbo handles form submissions, remove the CSRF cookie once a form has been submitted
+document.addEventListener('turbo:submit-end', function (event) {
+    const detail = (event as CustomEvent<TurboSubmitEventDetail>).detail;
+    removeCsrfToken(detail.formSubmission.formElement);
+});
+
+export function generateCsrfToken(formElement: HTMLFormElement): void {
+    const csrfField = formElement.querySelector<HTMLInputElement>(
+        CSRF_FIELD_SELECTOR,
+    );
+
+    if (!csrfField) {
+        return;
+    }
+
+    let csrfCookie = csrfField.getAttribute(
+        'data-csrf-protection-cookie-value',
+    );
+    let csrfToken = csrfField.value;
+
+    if (!csrfCookie && nameCheck.test(csrfToken)) {
+        csrfField.setAttribute(
+            'data-csrf-protection-cookie-value',
+            csrfCookie = csrfToken,
+        );
+        csrfField.defaultValue = csrfToken = btoa(
+            String.fromCharCode.apply(
+                null,
+                Array.from(
+                    (window.crypto ||
+                        (window as unknown as { msCrypto: Crypto }).msCrypto)
+                        .getRandomValues(new Uint8Array(18)),
+                ),
+            ),
+        );
+    }
+    csrfField.dispatchEvent(new Event('change', { bubbles: true }));
+
+    if (csrfCookie && tokenCheck.test(csrfToken)) {
+        const cookie = csrfCookie + '_' + csrfToken + '=' + csrfCookie +
+            '; path=/; samesite=strict';
+        document.cookie = window.location.protocol === 'https:'
+            ? '__Host-' + cookie + '; secure'
+            : cookie;
+    }
+}
+
+export function generateCsrfHeaders(
+    formElement: HTMLFormElement,
+): Record<string, string> {
+    const headers: Record<string, string> = {};
+    const csrfField = formElement.querySelector<HTMLInputElement>(
+        CSRF_FIELD_SELECTOR,
+    );
+
+    if (!csrfField) {
+        return headers;
+    }
+
+    const csrfCookie = csrfField.getAttribute(
+        'data-csrf-protection-cookie-value',
+    );
+
+    if (
+        tokenCheck.test(csrfField.value) && nameCheck.test(String(csrfCookie))
+    ) {
+        headers[String(csrfCookie)] = csrfField.value;
+    }
+
+    return headers;
+}
+
+export function removeCsrfToken(formElement: HTMLFormElement): void {
+    const csrfField = formElement.querySelector<HTMLInputElement>(
+        CSRF_FIELD_SELECTOR,
+    );
+
+    if (!csrfField) {
+        return;
+    }
+
+    const csrfCookie = csrfField.getAttribute(
+        'data-csrf-protection-cookie-value',
+    );
+
+    if (
+        tokenCheck.test(csrfField.value) && nameCheck.test(String(csrfCookie))
+    ) {
+        const cookie = String(csrfCookie) + '_' + csrfField.value +
+            '=0; path=/; samesite=strict; max-age=0';
+
+        document.cookie = window.location.protocol === 'https:'
+            ? '__Host-' + cookie + '; secure'
+            : cookie;
+    }
+}
+
+/* stimulusFetch: 'lazy' */
+export default 'csrf-protection-controller';

assets/controllers/csrf_protection_controller_test.ts

@@ -0,0 +1,119 @@
+import { assertEquals, assertMatch } from '@std/assert';
+
+// The module under test registers `document.addEventListener(...)` calls at
+// import time and reads `window.location`/`window.crypto`, so a minimal
+// `document`/`window` stub must exist in the global scope *before* the module
+// is imported. Deno has no browser DOM, and the actual surface these
+// functions touch on a form/input is narrow (getAttribute/setAttribute/value/
+// dispatchEvent), so hand-built fakes are used instead of a full DOM polyfill.
+let cookieJar = '';
+// deno-lint-ignore no-explicit-any
+(globalThis as any).document = {
+    addEventListener: () => {},
+    get cookie() {
+        return cookieJar;
+    },
+    set cookie(value: string) {
+        cookieJar += (cookieJar ? '; ' : '') + value;
+    },
+};
+// deno-lint-ignore no-explicit-any
+(globalThis as any).window = {
+    location: { protocol: 'http:' },
+    crypto: globalThis.crypto,
+};
+
+const { generateCsrfHeaders, generateCsrfToken, removeCsrfToken } =
+    await import(
+        './csrf_protection_controller.ts'
+    );
+
+function fakeField(attributes: Record<string, string> = {}, value = '') {
+    const store = new Map(Object.entries(attributes));
+    return {
+        getAttribute: (name: string) => store.get(name) ?? null,
+        setAttribute: (name: string, val: string) => {
+            store.set(name, val);
+        },
+        value,
+        defaultValue: value,
+        dispatchEvent: () => true,
+    };
+}
+
+// deno-lint-ignore no-explicit-any
+function fakeForm(field: ReturnType<typeof fakeField> | null): any {
+    return { querySelector: () => field };
+}
+
+Deno.test('generateCsrfToken does nothing when the form has no csrf field', () => {
+    cookieJar = '';
+    generateCsrfToken(fakeForm(null));
+    assertEquals(cookieJar, '');
+});
+
+Deno.test('generateCsrfToken generates a token and cookie on first use', () => {
+    cookieJar = '';
+    const field = fakeField({}, 'my_field_name');
+
+    generateCsrfToken(fakeForm(field));
+
+    assertEquals(
+        field.getAttribute('data-csrf-protection-cookie-value'),
+        'my_field_name',
+    );
+    assertMatch(field.defaultValue, /^[-_/+a-zA-Z0-9]{24,}$/);
+    assertMatch(cookieJar, /my_field_name_[-_/+a-zA-Z0-9]{24,}=my_field_name/);
+});
+
+Deno.test('generateCsrfToken keeps an existing valid token/cookie pair unchanged', () => {
+    cookieJar = '';
+    const token = 'a'.repeat(24);
+    const field = fakeField({
+        'data-csrf-protection-cookie-value': 'existing_name',
+    }, token);
+
+    generateCsrfToken(fakeForm(field));
+
+    assertEquals(field.value, token);
+    assertMatch(cookieJar, new RegExp(`existing_name_${token}=existing_name`));
+});
+
+Deno.test('generateCsrfHeaders returns empty headers without a csrf field', () => {
+    assertEquals(generateCsrfHeaders(fakeForm(null)), {});
+});
+
+Deno.test('generateCsrfHeaders returns the cookie-name/token header when both are valid', () => {
+    const token = 'b'.repeat(24);
+    const field = fakeField({
+        'data-csrf-protection-cookie-value': 'field_name',
+    }, token);
+
+    assertEquals(generateCsrfHeaders(fakeForm(field)), { field_name: token });
+});
+
+Deno.test('generateCsrfHeaders omits the header when the token is too short', () => {
+    const field = fakeField({
+        'data-csrf-protection-cookie-value': 'field_name',
+    }, 'too-short');
+
+    assertEquals(generateCsrfHeaders(fakeForm(field)), {});
+});
+
+Deno.test('removeCsrfToken expires the cookie for a valid token/cookie pair', () => {
+    cookieJar = '';
+    const token = 'c'.repeat(24);
+    const field = fakeField({
+        'data-csrf-protection-cookie-value': 'field_name',
+    }, token);
+
+    removeCsrfToken(fakeForm(field));
+
+    assertMatch(cookieJar, new RegExp(`field_name_${token}=0`));
+});
+
+Deno.test('removeCsrfToken does nothing without a csrf field', () => {
+    cookieJar = '';
+    removeCsrfToken(fakeForm(null));
+    assertEquals(cookieJar, '');
+});

assets/controllers/elimination_controller.js

@@ -1,14 +0,0 @@
-import {Controller} from '@hotwired/stimulus';
-
-export default class extends Controller {
-  next() {
-    const currentUrl = new URL(window.location.href);
-    const pathParts = currentUrl.pathname.split('/');
-    // Remove the last segment
-    pathParts.pop();
-    // Update the pathname
-    currentUrl.pathname = pathParts.join('/');
-    // Navigate
-    window.location.href = currentUrl.href;
-  }
-}

assets/controllers/elimination_controller.ts

@@ -0,0 +1,14 @@
+import { Controller } from '@hotwired/stimulus';
+
+export default class extends Controller {
+    next(): void {
+        const currentUrl = new URL(window.location.href);
+        const pathParts = currentUrl.pathname.split('/');
+        // Remove the last segment
+        pathParts.pop();
+        // Update the pathname
+        currentUrl.pathname = pathParts.join('/');
+        // Navigate
+        window.location.href = currentUrl.href;
+    }
+}

assets/controllers/fullscreen_controller.ts

@@ -0,0 +1,51 @@
+import { Controller } from '@hotwired/stimulus';
+
+const STORAGE_KEY = 'tvdt-fullscreen';
+
+export default class extends Controller {
+    connect(): void {
+        document.addEventListener('fullscreenchange', this.onFullscreenChange);
+        this.syncState();
+
+        if (
+            sessionStorage.getItem(STORAGE_KEY) === '1' &&
+            !document.fullscreenElement
+        ) {
+            this.request();
+        }
+    }
+
+    disconnect(): void {
+        document.removeEventListener(
+            'fullscreenchange',
+            this.onFullscreenChange,
+        );
+    }
+
+    toggle(): void {
+        if (document.fullscreenElement) {
+            document.exitFullscreen();
+        } else {
+            this.request();
+        }
+    }
+
+    request(): void {
+        document.documentElement.requestFullscreen().catch(() => {});
+    }
+
+    onFullscreenChange = (): void => {
+        sessionStorage.setItem(
+            STORAGE_KEY,
+            document.fullscreenElement ? '1' : '0',
+        );
+        this.syncState();
+    };
+
+    syncState(): void {
+        document.documentElement.classList.toggle(
+            'is-fullscreen',
+            Boolean(document.fullscreenElement),
+        );
+    }
+}

assets/controllers/fullscreen_controller_test.ts

@@ -0,0 +1,75 @@
+import { assertEquals } from '@std/assert';
+
+// Stimulus's Controller base class constructor only does `this.context = context`
+// (see @hotwired/stimulus dist/stimulus.js), and none of this controller's methods
+// touch Stimulus-specific getters (element/scope/targets), so a plain `{}` context
+// is enough to construct a real instance. `document`/`sessionStorage` are stubbed
+// since Deno has no browser DOM.
+class FakeClassList {
+    classes = new Set<string>();
+    toggle(name: string, force?: boolean) {
+        const shouldAdd = force ?? !this.classes.has(name);
+        if (shouldAdd) this.classes.add(name);
+        else this.classes.delete(name);
+    }
+    contains(name: string) {
+        return this.classes.has(name);
+    }
+}
+
+const classList = new FakeClassList();
+let fullscreenElement: unknown = null;
+const sessionStore = new Map<string, string>();
+
+// deno-lint-ignore no-explicit-any
+(globalThis as any).document = {
+    documentElement: { classList },
+    get fullscreenElement() {
+        return fullscreenElement;
+    },
+    addEventListener: () => {},
+    removeEventListener: () => {},
+};
+// Deno defines a native `sessionStorage` accessor on globalThis (get/set pair), so a
+// plain assignment would just call through to it instead of replacing it — redefine
+// the property outright.
+Object.defineProperty(globalThis, 'sessionStorage', {
+    value: {
+        getItem: (key: string) => sessionStore.get(key) ?? null,
+        setItem: (key: string, value: string) => sessionStore.set(key, value),
+    },
+    configurable: true,
+});
+
+const { default: FullscreenController } = await import(
+    './fullscreen_controller.ts'
+);
+
+// deno-lint-ignore no-explicit-any
+function makeController(): any {
+    return new FullscreenController({} as never);
+}
+
+Deno.test('syncState adds is-fullscreen when a fullscreen element is set', () => {
+    fullscreenElement = { tagName: 'HTML' };
+    makeController().syncState();
+    assertEquals(classList.contains('is-fullscreen'), true);
+});
+
+Deno.test('syncState removes is-fullscreen when there is no fullscreen element', () => {
+    fullscreenElement = null;
+    makeController().syncState();
+    assertEquals(classList.contains('is-fullscreen'), false);
+});
+
+Deno.test('onFullscreenChange persists the fullscreen state and syncs classes', () => {
+    fullscreenElement = { tagName: 'HTML' };
+    makeController().onFullscreenChange();
+    assertEquals(sessionStore.get('tvdt-fullscreen'), '1');
+    assertEquals(classList.contains('is-fullscreen'), true);
+
+    fullscreenElement = null;
+    makeController().onFullscreenChange();
+    assertEquals(sessionStore.get('tvdt-fullscreen'), '0');
+    assertEquals(classList.contains('is-fullscreen'), false);
+});

assets/quiz.ts

@@ -1,4 +1,4 @@
 import 'bootstrap/dist/css/bootstrap.min.css';
 import './styles/quiz.scss';
-import './stimulus.js';
+import './stimulus.ts';
-import './bootstrap.js';
+import './bootstrap.ts';

assets/stimulus.ts

@@ -1,3 +1,3 @@
 import { startStimulusApp } from '@symfony/stimulus-bundle';
 
-const app = startStimulusApp();
+startStimulusApp();

assets/styles/backoffice.scss

@@ -3,3 +3,9 @@
 .col-result-md { width: 20%; }
 
 .modal-content > turbo-frame { display: contents; }
+
+.release-notes {
+  overflow-wrap: break-word;
+
+  > :last-child { margin-bottom: 0; }
+}

assets/styles/quiz.scss

@@ -94,6 +94,32 @@ input.btn-check:checked + label.answer-btn {
     gap: 0.5rem;
 }
 
+.fullscreen-btn {
+    position: fixed;
+    bottom: 0.75rem;
+    left: 0.75rem;
+    z-index: 1040;
+    width: 2.25rem;
+    height: 2.25rem;
+    padding: 0;
+    background: transparent;
+    border: none;
+    color: rgba(255, 255, 255, 0.35);
+    font-size: 1.25rem;
+    line-height: 1;
+    cursor: pointer;
+
+    &:hover,
+    &:focus {
+        color: rgba(255, 255, 255, 0.8);
+        outline: none;
+    }
+}
+
+html.is-fullscreen .fullscreen-btn {
+    display: none;
+}
+
 .elimination-screen {
     position: fixed;
     top: 0;

assets/types/global.d.ts

@@ -0,0 +1,11 @@
+// Ambient declarations for the parts of the AssetMapper toolchain that Deno's
+// module resolution doesn't otherwise understand: CSS/SCSS side-effect imports
+// (handled by AssetMapper at build time, not a JS module) and the Symfony
+// stimulus-bundle loader (a local vendor/ file, not an npm package).
+
+declare module '*.css';
+declare module '*.scss';
+
+declare module '@symfony/stimulus-bundle' {
+    export function startStimulusApp(): unknown;
+}

compose.override.yaml

@@ -10,7 +10,7 @@ services:
       - ~/.composer/cache:/root/.composer/cache
       - ./frankenphp/Caddyfile:/etc/caddy/Caddyfile:ro
       - ./frankenphp/conf.d/20-app.dev.ini:/usr/local/etc/php/app.conf.d/20-app.dev.ini:ro
-      - ./frankenphp/data:/data
+      - ${CADDY_DATA_DIR:-./frankenphp/data}:/data
       - sass:/app/var/sass
     environment:
       MERCURE_EXTRA_DIRECTIVES: demo
@@ -24,15 +24,15 @@ services:
     ports:
       # HTTP
       - target: 80
-        published: ${HTTP_PORT:-80}
+        published: ${HTTP_PORT:-8080}
         protocol: tcp
       # HTTPS
       - target: 443
-        published: ${HTTPS_PORT:-443}
+        published: ${HTTPS_PORT:-8443}
         protocol: tcp
       # HTTP/3
       - target: 443
-        published: ${HTTP3_PORT:-443}
+        published: ${HTTPS_PORT:-8443}
         protocol: udp
   sass:
     image: ${IMAGES_PREFIX:-}app-php
@@ -56,7 +56,7 @@ services:
   ###> doctrine/doctrine-bundle ###
   database:
     ports:
-      - "5432:5432"
+      - "${POSTGRES_PORT:-5430}:5432"
   ###< doctrine/doctrine-bundle ###
   
   ###> symfony/mailer ###
@@ -64,7 +64,7 @@ services:
     image: axllent/mailpit
     ports:
       - "1025"
-      - "8025:8025"
+      - "${MAILPIT_PORT:-8025}:8025"
     environment:
       MP_SMTP_AUTH_ACCEPT_ANY: 1
       MP_SMTP_AUTH_ALLOW_INSECURE: 1
@@ -73,7 +73,7 @@ services:
   spotlight:
     image: ghcr.io/getsentry/spotlight:latest
     ports:
-      - "8969:8969"
+      - "${SPOTLIGHT_PORT:-8969}:8969"
 
 volumes:
   sass:

composer.json

@@ -13,10 +13,12 @@
         "doctrine/doctrine-bundle": "^3.2.2",
         "doctrine/doctrine-migrations-bundle": "^4.0",
         "doctrine/orm": "^3.6.2",
+        "league/commonmark": "^2.7",
         "martin-georgiev/postgresql-for-doctrine": "^4.4",
         "phpdocumentor/reflection-docblock": "^6.0.3",
         "phpoffice/phpspreadsheet": "^5.5",
         "phpstan/phpdoc-parser": "^2.3.2",
+        "sensiolabs/typescript-bundle": "^0.2.2",
         "sentry/sentry-symfony": "^5.9.0",
         "stof/doctrine-extensions-bundle": "^1.15.3",
         "symfony/asset": "8.1.*",
@@ -27,6 +29,7 @@
         "symfony/flex": "^2.11.0",
         "symfony/form": "8.1.*",
         "symfony/framework-bundle": "8.1.*",
+        "symfony/http-client": "8.1.*",
         "symfony/mailer": "8.1.*",
         "symfony/object-mapper": "8.1.*",
         "symfony/property-access": "8.1.*",
@@ -35,17 +38,22 @@
         "symfony/security-bundle": "8.1.*",
         "symfony/security-csrf": "8.1.*",
         "symfony/serializer": "8.1.*",
+        "symfony/string": "8.1.*",
         "symfony/translation": "8.1.*",
         "symfony/twig-bundle": "8.1.*",
         "symfony/uid": "8.1.*",
         "symfony/ux-turbo": "^3.1",
         "symfony/validator": "8.1.*",
         "symfony/yaml": "8.1.*",
+        "symfonycasts/reset-password-bundle": "^1.25",
         "symfonycasts/sass-bundle": "^0.10",
         "symfonycasts/verify-email-bundle": "^1.18.0",
         "thecodingmachine/safe": "^3.4.0",
+        "twig/cssinliner-extra": "^3.26.0",
         "twig/extra-bundle": "^3.24.0",
+        "twig/inky-extra": "^3.26.0",
         "twig/intl-extra": "^3.24.0",
+        "twig/markdown-extra": "^3.24.0",
         "twig/twig": "^3.27.1"
     },
     "require-dev": {

config/bundles.php

@@ -6,6 +6,7 @@ use DAMA\DoctrineTestBundle\DAMADoctrineTestBundle;
 use Doctrine\Bundle\DoctrineBundle\DoctrineBundle;
 use Doctrine\Bundle\FixturesBundle\DoctrineFixturesBundle;
 use Doctrine\Bundle\MigrationsBundle\DoctrineMigrationsBundle;
+use Sensiolabs\TypeScriptBundle\SensiolabsTypeScriptBundle;
 use Sentry\SentryBundle\SentryBundle;
 use Stof\DoctrineExtensionsBundle\StofDoctrineExtensionsBundle;
 use Symfony\Bundle\FrameworkBundle\FrameworkBundle;
@@ -15,6 +16,7 @@ use Symfony\Bundle\TwigBundle\TwigBundle;
 use Symfony\Bundle\WebProfilerBundle\WebProfilerBundle;
 use Symfony\UX\StimulusBundle\StimulusBundle;
 use Symfony\UX\Turbo\TurboBundle;
+use SymfonyCasts\Bundle\ResetPassword\SymfonyCastsResetPasswordBundle;
 use SymfonyCasts\Bundle\VerifyEmail\SymfonyCastsVerifyEmailBundle;
 use Symfonycasts\SassBundle\SymfonycastsSassBundle;
 use Twig\Extra\TwigExtraBundle\TwigExtraBundle;
@@ -36,4 +38,6 @@ return [
     TurboBundle::class => ['all' => true],
     DAMADoctrineTestBundle::class => ['test' => true],
     StofDoctrineExtensionsBundle::class => ['all' => true],
+    SymfonyCastsResetPasswordBundle::class => ['all' => true],
+    SensiolabsTypeScriptBundle::class => ['all' => true],
 ];

config/packages/asset_mapper.yaml

@@ -6,8 +6,12 @@ framework:
         excluded_patterns:
             - '*/assets/styles/_*.scss'
             - '*/assets/styles/**/_*.scss'
+            - '*/assets/**/*_test.ts'
+            - '*/assets/types/*.d.ts'
         missing_import_mode: strict
 
+sensiolabs_typescript:
+    source_dir: ['%kernel.project_dir%/assets']
 
 when@prod:
     framework:

config/packages/framework.yaml

@@ -14,7 +14,7 @@ when@prod:
         # shortcut for private IP address ranges of your proxy
         trusted_proxies: 'private_ranges'
         # or, if your proxy instead uses the "Forwarded" header
-        trusted_headers: [ 'forwarded' ]
+        trusted_headers: [ 'x-forwarded-proto' ]
 
 when@test:
     framework:

config/packages/reset_password.yaml

@@ -0,0 +1,2 @@
+symfonycasts_reset_password:
+    request_password_repository: Tvdt\Repository\ResetPasswordRequestRepository

config/packages/security.yaml

@@ -30,6 +30,7 @@ security:
 
     access_control:
         - { path: ^/admin, roles: ROLE_ADMIN }
+        - { path: ^/backoffice/releases$, roles: PUBLIC_ACCESS }
         - { path: ^/backoffice, roles: IS_AUTHENTICATED }
 
 when@test:

config/packages/twig_extra.yaml

@@ -0,0 +1,8 @@
+twig_extra:
+    commonmark:
+        allow_unsafe_links: false
+        html_input: escape
+
+services:
+    League\CommonMark\Extension\Autolink\AutolinkExtension:
+        tags: ['twig.markdown.league_extension']

config/reference.php

@@ -1271,16 +1271,16 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         enabled?: bool|Param, // Default: false
  *     },
  *     markdown?: bool|array{
- *         enabled?: bool|Param, // Default: false
+ *         enabled?: bool|Param, // Default: true
  *     },
  *     intl?: bool|array{
  *         enabled?: bool|Param, // Default: true
  *     },
  *     cssinliner?: bool|array{
- *         enabled?: bool|Param, // Default: false
+ *         enabled?: bool|Param, // Default: true
  *     },
  *     inky?: bool|array{
- *         enabled?: bool|Param, // Default: false
+ *         enabled?: bool|Param, // Default: true
  *     },
  *     string?: bool|array{
  *         enabled?: bool|Param, // Default: false
@@ -1490,6 +1490,19 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *     skip_translation_on_load?: bool|Param, // Default: false
  *     metadata_cache_pool?: scalar|Param|null, // Default: null
  * }
+ * @psalm-type SymfonycastsResetPasswordConfig = array{
+ *     request_password_repository?: scalar|Param|null, // A class that implements ResetPasswordRequestRepositoryInterface - usually your ResetPasswordRequestRepository.
+ *     lifetime?: int|Param, // The length of time in seconds that a password reset request is valid for after it is created. // Default: 3600
+ *     throttle_limit?: int|Param, // Another password reset cannot be made faster than this throttle time in seconds. // Default: 3600
+ *     enable_garbage_collection?: bool|Param, // Enable/Disable automatic garbage collection. // Default: true
+ * }
+ * @psalm-type SensiolabsTypescriptConfig = array{
+ *     source_dir?: list<scalar|Param|null>,
+ *     binary_download_dir?: scalar|Param|null, // The directory where the SWC binary will be downloaded // Default: "%kernel.project_dir%/var"
+ *     swc_binary?: scalar|Param|null, // The SWC binary to use // Default: null
+ *     swc_config_file?: scalar|Param|null, // Path to .swcrc configuration file to use // Default: "%kernel.project_dir%/.swcrc"
+ *     swc_version?: scalar|Param|null, // The SWC version to use // Default: "v1.3.92"
+ * }
  * @psalm-type ConfigType = array{
  *     imports?: ImportsConfig,
  *     parameters?: ParametersConfig,
@@ -1505,6 +1518,8 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *     stimulus?: StimulusConfig,
  *     turbo?: TurboConfig,
  *     stof_doctrine_extensions?: StofDoctrineExtensionsConfig,
+ *     symfonycasts_reset_password?: SymfonycastsResetPasswordConfig,
+ *     sensiolabs_typescript?: SensiolabsTypescriptConfig,
  *     "when@dev"?: array{
  *         imports?: ImportsConfig,
  *         parameters?: ParametersConfig,
@@ -1523,6 +1538,8 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         stimulus?: StimulusConfig,
  *         turbo?: TurboConfig,
  *         stof_doctrine_extensions?: StofDoctrineExtensionsConfig,
+ *         symfonycasts_reset_password?: SymfonycastsResetPasswordConfig,
+ *         sensiolabs_typescript?: SensiolabsTypescriptConfig,
  *     },
  *     "when@prod"?: array{
  *         imports?: ImportsConfig,
@@ -1540,6 +1557,8 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         stimulus?: StimulusConfig,
  *         turbo?: TurboConfig,
  *         stof_doctrine_extensions?: StofDoctrineExtensionsConfig,
+ *         symfonycasts_reset_password?: SymfonycastsResetPasswordConfig,
+ *         sensiolabs_typescript?: SensiolabsTypescriptConfig,
  *     },
  *     "when@test"?: array{
  *         imports?: ImportsConfig,
@@ -1558,6 +1577,8 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         turbo?: TurboConfig,
  *         dama_doctrine_test?: DamaDoctrineTestConfig,
  *         stof_doctrine_extensions?: StofDoctrineExtensionsConfig,
+ *         symfonycasts_reset_password?: SymfonycastsResetPasswordConfig,
+ *         sensiolabs_typescript?: SensiolabsTypescriptConfig,
  *     },
  *     ...<string, ExtensionType|array{ // extra keys must follow the when@%env% pattern or match an extension alias
  *         imports?: ImportsConfig,

deno.json

@@ -0,0 +1,33 @@
+{
+    "exclude": ["assets/vendor/"],
+    "compilerOptions": {
+        "lib": ["deno.window", "dom", "dom.iterable"],
+        "strict": true,
+        "noImplicitOverride": false,
+        "types": ["./assets/types/global.d.ts"]
+    },
+    "imports": {
+        "@hotwired/stimulus": "npm:@hotwired/stimulus@^3.2.2",
+        "@hotwired/turbo": "npm:@hotwired/turbo@^8.0.23",
+        "bootstrap": "npm:bootstrap@^5.3.8",
+        "@sentry/browser": "npm:@sentry/browser@^10.63.0",
+        "@std/assert": "jsr:@std/assert@^1.0.19"
+    },
+    "fmt": {
+        "include": ["assets/"],
+        "exclude": ["assets/vendor/", "assets/styles/", "assets/img/"],
+        "singleQuote": true,
+        "indentWidth": 4
+    },
+    "lint": {
+        "include": ["assets/"],
+        "exclude": ["assets/vendor/"],
+        "rules": {
+            "exclude": ["no-window", "no-window-prefix"]
+        }
+    },
+    "test": {
+        "include": ["assets/"],
+        "exclude": ["assets/vendor/"]
+    }
+}

deno.lock

@@ -0,0 +1,96 @@
+{
+  "version": "5",
+  "specifiers": {
+    "jsr:@std/assert@*": "1.0.19",
+    "jsr:@std/assert@^1.0.19": "1.0.19",
+    "jsr:@std/internal@^1.0.12": "1.0.14",
+    "npm:@hotwired/stimulus@^3.2.2": "3.2.2",
+    "npm:@hotwired/turbo@^8.0.23": "8.0.23",
+    "npm:@sentry/browser@^10.63.0": "10.65.0",
+    "npm:bootstrap@^5.3.8": "5.3.8_@popperjs+core@2.11.8"
+  },
+  "jsr": {
+    "@std/assert@1.0.19": {
+      "integrity": "eaada96ee120cb980bc47e040f82814d786fe8162ecc53c91d8df60b8755991e",
+      "dependencies": [
+        "jsr:@std/internal"
+      ]
+    },
+    "@std/internal@1.0.14": {
+      "integrity": "291516b3d4c35024d6ffbc0a9df5bf4c64116e05b50012cf846710152d2ffdf7"
+    }
+  },
+  "npm": {
+    "@hotwired/stimulus@3.2.2": {
+      "integrity": "sha512-eGeIqNOQpXoPAIP7tC1+1Yc1yl1xnwYqg+3mzqxyrbE5pg5YFBZcA6YoTiByJB6DKAEsiWtl6tjTJS4IYtbB7A=="
+    },
+    "@hotwired/turbo@8.0.23": {
+      "integrity": "sha512-GZ7cijxEZ6Ig71u7rD6LHaRv/wcE/hNsc+nEfiWOkLNqUgLOwo5MNGWOy5ZV9ZUDSiQx1no7YxjTNnT4O6//cQ=="
+    },
+    "@popperjs/core@2.11.8": {
+      "integrity": "sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A=="
+    },
+    "@sentry/browser-utils@10.65.0": {
+      "integrity": "sha512-4J0mkfNJAGUOkpg1ZggizyftFTn9N20b+Jl87UnWsDUkNG0Ic1l/FIzMPTVxXrAnhBGu0ULO0TFWMoQ5s3QtZw==",
+      "dependencies": [
+        "@sentry/conventions",
+        "@sentry/core"
+      ]
+    },
+    "@sentry/browser@10.65.0": {
+      "integrity": "sha512-XUDDsx0qxzeIlcOu1fDEqTcDl0eiOqghsgV+ReuuNP4jYjZ9kUQxE3rXWM5mlT1pBi4VaQ4FHqvQZZrRXy+oDw==",
+      "dependencies": [
+        "@sentry/browser-utils",
+        "@sentry/conventions",
+        "@sentry/core",
+        "@sentry/feedback",
+        "@sentry/replay",
+        "@sentry/replay-canvas"
+      ]
+    },
+    "@sentry/conventions@0.15.1": {
+      "integrity": "sha512-ZLP8bRdMON3prWE2tJyImuYscCxdcJeIPIhrOs/rgyFm3C1nCh1B6gdvPj3AZ5zW08oSFFCsq7T+tYEW3h8MNA=="
+    },
+    "@sentry/core@10.65.0": {
+      "integrity": "sha512-3aqtmM5NgNGo45BNaaBzi0LPQZAw//NEL4HKS5fXm12pJMa4KEkze8DEKnkTEIrGnWaOJKamecHKlnNg/Mqf/Q==",
+      "dependencies": [
+        "@sentry/conventions"
+      ]
+    },
+    "@sentry/feedback@10.65.0": {
+      "integrity": "sha512-ck8h7wgd3F3bYNk0v1OgohmyLBeXcKxqlfBJRtQq4k6KZUq+pXimOG7ckNguVMYjCo3PEfuG+ckKc21yqotKug==",
+      "dependencies": [
+        "@sentry/core"
+      ]
+    },
+    "@sentry/replay-canvas@10.65.0": {
+      "integrity": "sha512-A7X3RVk1Gk+knK8Ip/2EjejckNCLgCfRZo6eGlsy6qyz904KBpYmys1a0o7QkzFRjhIndjHAfcVxwt6jSLJlrQ==",
+      "dependencies": [
+        "@sentry/core",
+        "@sentry/replay"
+      ]
+    },
+    "@sentry/replay@10.65.0": {
+      "integrity": "sha512-aW988CcQBNArbOMzOFOziipHz6uQyXSa4i5CPWsu+nhVPTJHafosi5Lv9n6NM/icDX5e23VdnX6mZd8SyJuo8A==",
+      "dependencies": [
+        "@sentry/browser-utils",
+        "@sentry/core"
+      ]
+    },
+    "bootstrap@5.3.8_@popperjs+core@2.11.8": {
+      "integrity": "sha512-HP1SZDqaLDPwsNiqRqi5NcP0SSXciX2s9E+RyqJIIqGo+vJeN5AJVM98CXmW/Wux0nQ5L7jeWUdplCEf0Ee+tg==",
+      "dependencies": [
+        "@popperjs/core"
+      ]
+    }
+  },
+  "workspace": {
+    "dependencies": [
+      "jsr:@std/assert@^1.0.19",
+      "npm:@hotwired/stimulus@^3.2.2",
+      "npm:@hotwired/turbo@^8.0.23",
+      "npm:@sentry/browser@^10.63.0",
+      "npm:bootstrap@^5.3.8"
+    ]
+  }
+}

frankenphp/docker-entrypoint.sh

@@ -33,6 +33,10 @@ if [ "$1" = 'frankenphp' ] || [ "$1" = 'php' ] || [ "$1" = 'bin/console' ]; then
 		fi
 	fi
 
+	# var/ is a Docker volume that survives redeploys, so cache.app (e.g. the GitHub releases cache)
+	# can carry stale entries from the previous image into the new one unless cleared here.
+	php bin/console cache:pool:clear cache.app
+
 	setfacl -R -m u:www-data:rwX -m u:"$(whoami)":rwX var
 	setfacl -dR -m u:www-data:rwX -m u:"$(whoami)":rwX var
 

importmap.php

@@ -25,8 +25,8 @@ declare(strict_types=1);
  * }>
  */
 return [
-    'quiz' => ['path' => './assets/quiz.js', 'entrypoint' => true],
+    'quiz' => ['path' => './assets/quiz.ts', 'entrypoint' => true],
-    'backoffice' => ['path' => './assets/backoffice.js', 'entrypoint' => true],
+    'backoffice' => ['path' => './assets/backoffice.ts', 'entrypoint' => true],
     '@symfony/stimulus-bundle' => ['path' => './vendor/symfony/stimulus-bundle/assets/dist/loader.js'],
     'bootstrap' => ['version' => '5.3.8'],
     '@popperjs/core' => ['version' => '2.11.8'],

migrations/Version20260707205155.php

@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/** Auto-generated Migration: Please modify to your needs! */
+final class Version20260707205155 extends AbstractMigration
+{
+    #[\Override]
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('CREATE TABLE reset_password_request (id UUID NOT NULL, selector VARCHAR(20) NOT NULL, hashed_token VARCHAR(100) NOT NULL, requested_at TIMESTAMP(0) WITHOUT TIME ZONE NOT NULL, expires_at TIMESTAMP(0) WITHOUT TIME ZONE NOT NULL, user_id UUID NOT NULL, PRIMARY KEY (id))');
+        $this->addSql('CREATE INDEX IDX_7CE748AA76ED395 ON reset_password_request (user_id)');
+        $this->addSql('ALTER TABLE reset_password_request ADD CONSTRAINT FK_7CE748AA76ED395 FOREIGN KEY (user_id) REFERENCES "user" (id) NOT DEFERRABLE');
+    }
+
+    #[\Override]
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE reset_password_request DROP CONSTRAINT FK_7CE748AA76ED395');
+        $this->addSql('DROP TABLE reset_password_request');
+    }
+}

src/Controller/AbstractController.php

@@ -5,6 +5,9 @@ declare(strict_types=1);
 namespace Tvdt\Controller;
 
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController as AbstractBaseController;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Tvdt\Entity\Season;
+use Tvdt\Entity\User;
 use Tvdt\Enum\FlashType;
 
 abstract class AbstractController extends AbstractBaseController
@@ -13,6 +16,22 @@ abstract class AbstractController extends AbstractBaseController
 
     protected const string CANDIDATE_HASH_REGEX = '[\w\-=]+';
 
+    protected User $authenticatedUser {
+        get {
+            $user = $this->getUser();
+            \assert($user instanceof User);
+
+            return $user;
+        }
+    }
+
+    protected function assertSameSeason(Season $season, Season $subjectSeason): void
+    {
+        if ($season !== $subjectSeason) {
+            throw new NotFoundHttpException();
+        }
+    }
+
     #[\Override]
     protected function addFlash(FlashType|string $type, mixed $message): void
     {

src/Controller/Backoffice/BackofficeController.php

@@ -14,11 +14,13 @@ use Symfony\Component\HttpKernel\Attribute\AsController;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Routing\Requirement\Requirement;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
+use Symfony\Contracts\Translation\TranslatorInterface;
 use Tvdt\Controller\AbstractController;
 use Tvdt\Entity\Quiz;
 use Tvdt\Entity\Season;
-use Tvdt\Entity\User;
+use Tvdt\Enum\FlashType;
 use Tvdt\Form\CreateSeasonFormType;
+use Tvdt\Helpers\FilenameSanitizer;
 use Tvdt\Repository\SeasonRepository;
 use Tvdt\Security\Voter\SeasonVoter;
 use Tvdt\Service\QuizSpreadsheetService;
@@ -32,17 +34,15 @@ final class BackofficeController extends AbstractController
         private readonly Security $security,
         private readonly QuizSpreadsheetService $excel,
         private readonly EntityManagerInterface $em,
+        private readonly TranslatorInterface $translator,
     ) {}
 
     #[Route('/backoffice/', name: 'tvdt_backoffice_index')]
     public function index(): Response
     {
-        $user = $this->getUser();
-        \assert($user instanceof User);
-
         $seasons = $this->security->isGranted('ROLE_ADMIN')
             ? $this->seasonRepository->findAll()
-            : $this->seasonRepository->getSeasonsForUser($user);
+            : $this->seasonRepository->getSeasonsForUser($this->authenticatedUser);
 
         return $this->render('backoffice/index.html.twig', [
             'seasons' => $seasons,
@@ -58,10 +58,7 @@ final class BackofficeController extends AbstractController
         $form->handleRequest($request);
 
         if ($form->isSubmitted() && $form->isValid()) {
-            $user = $this->getUser();
+            $season->addOwner($this->authenticatedUser);
-            \assert($user instanceof User);
-
-            $season->addOwner($user);
             $season->generateSeasonCode();
 
             $this->em->persist($season);
@@ -90,11 +87,17 @@ final class BackofficeController extends AbstractController
         requirements: ['quiz' => Requirement::UUID],
         methods: ['GET'],
     )]
-    public function exportQuiz(Quiz $quiz): StreamedResponse
+    public function exportQuiz(Quiz $quiz): Response
     {
+        if (!$this->authenticatedUser->isVerified) {
+            $this->addFlash(FlashType::Warning, $this->translator->trans('Please confirm your email address before exporting a quiz.'));
+
+            return $this->redirectToRoute('tvdt_backoffice_season', ['seasonCode' => $quiz->season->seasonCode]);
+        }
+
         $response = new StreamedResponse($this->excel->quizToXlsx($quiz));
         $response->headers->set('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
-        $response->headers->set('Content-Disposition', HeaderUtils::makeDisposition(HeaderUtils::DISPOSITION_ATTACHMENT, $quiz->name.'.xlsx'));
+        $response->headers->set('Content-Disposition', HeaderUtils::makeDisposition(HeaderUtils::DISPOSITION_ATTACHMENT, FilenameSanitizer::sanitize($quiz->name).'.xlsx'));
 
         return $response;
     }

src/Controller/Backoffice/QuestionBankController.php

@@ -114,17 +114,11 @@ class QuestionBankController extends AbstractController
             ? 'backoffice/question_bank/_frame.html.twig'
             : 'backoffice/question_bank/form.html.twig';
 
-        $response = $this->render($template, [
+        return $this->render($template, [
             'season' => $season,
             'form' => $form,
             'bankQuestion' => null,
         ]);
-
-        if ($form->isSubmitted()) {
-            $response->setStatusCode(Response::HTTP_UNPROCESSABLE_ENTITY);
-        }
-
-        return $response;
     }
 
     #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
@@ -167,17 +161,11 @@ class QuestionBankController extends AbstractController
             ? 'backoffice/question_bank/_frame.html.twig'
             : 'backoffice/question_bank/form.html.twig';
 
-        $response = $this->render($template, [
+        return $this->render($template, [
             'season' => $season,
             'form' => $form,
             'bankQuestion' => $bankQuestion,
         ]);
-
-        if ($form->isSubmitted()) {
-            $response->setStatusCode(Response::HTTP_UNPROCESSABLE_ENTITY);
-        }
-
-        return $response;
     }
 
     #[IsCsrfTokenValid('delete_bank_question')]
@@ -382,13 +370,6 @@ class QuestionBankController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_question_bank', ['seasonCode' => $season->seasonCode]);
     }
 
-    private function assertSameSeason(Season $season, Season $subjectSeason): void
-    {
-        if ($season !== $subjectSeason) {
-            throw new NotFoundHttpException();
-        }
-    }
-
     private function syncUsagesAfterEdit(BankQuestion $bankQuestion): void
     {
         $pendingNames = [];

src/Controller/Backoffice/QuizController.php

@@ -25,6 +25,7 @@ use Tvdt\Entity\QuizCandidate;
 use Tvdt\Entity\Season;
 use Tvdt\Enum\FlashType;
 use Tvdt\Exception\ErrorClearingQuizException;
+use Tvdt\Repository\GivenAnswerRepository;
 use Tvdt\Repository\QuizCandidateRepository;
 use Tvdt\Repository\QuizRepository;
 use Tvdt\Security\Voter\SeasonVoter;
@@ -37,6 +38,7 @@ class QuizController extends AbstractController
         private readonly QuizRepository $quizRepository,
         private readonly TranslatorInterface $translator,
         private readonly QuizCandidateRepository $quizCandidateRepository,
+        private readonly GivenAnswerRepository $givenAnswerRepository,
         private readonly EntityManagerInterface $em,
     ) {}
 
@@ -61,25 +63,7 @@ class QuizController extends AbstractController
     {
         $fetchedQuiz = $this->quizRepository->fetchWithQuestionsAndCandidates($quiz->id);
 
-        // Create indexed lookup for quiz candidates by candidate ID
+        $candidateData = $this->buildCandidateData($season, $quiz, $fetchedQuiz->candidateData);
-        $quizCandidatesByCandidateId = [];
-        foreach ($fetchedQuiz->candidateData as $qc) {
-            $quizCandidatesByCandidateId[$qc->candidate->id->toString()] = $qc;
-        }
-
-        // Get given answers counts efficiently via database query
-        $givenAnswersCountByCandidateId = $this->quizRepository->getGivenAnswersCountPerCandidate($quiz);
-
-        // Pre-compute candidate data to avoid nested loops in template
-        $candidateData = [];
-        foreach ($season->candidates as $candidate) {
-            $candidateIdString = $candidate->id->toString();
-            $candidateData[] = [
-                'candidate' => $candidate,
-                'quizCandidate' => $quizCandidatesByCandidateId[$candidateIdString] ?? null,
-                'givenAnswersCount' => $givenAnswersCountByCandidateId[$candidateIdString] ?? 0,
-            ];
-        }
 
         return $this->render('backoffice/quiz.html.twig', [
             'season' => $season,
@@ -118,25 +102,7 @@ class QuizController extends AbstractController
     )]
     public function candidatesTab(Season $season, Quiz $quiz): Response
     {
-        // Create indexed lookup for quiz candidates by candidate ID
+        $candidateData = $this->buildCandidateData($season, $quiz, $quiz->candidateData);
-        $quizCandidatesByCandidateId = [];
-        foreach ($quiz->candidateData as $qc) {
-            $quizCandidatesByCandidateId[$qc->candidate->id->toString()] = $qc;
-        }
-
-        // Get given answers counts efficiently via database query
-        $givenAnswersCountByCandidateId = $this->quizRepository->getGivenAnswersCountPerCandidate($quiz);
-
-        // Pre-compute candidate data to avoid nested loops in template
-        $candidateData = [];
-        foreach ($season->candidates as $candidate) {
-            $candidateIdString = $candidate->id->toString();
-            $candidateData[] = [
-                'candidate' => $candidate,
-                'quizCandidate' => $quizCandidatesByCandidateId[$candidateIdString] ?? null,
-                'givenAnswersCount' => $givenAnswersCountByCandidateId[$candidateIdString] ?? 0,
-            ];
-        }
 
         return $this->render('backoffice/quiz.html.twig', [
             'season' => $season,
@@ -432,4 +398,53 @@ class QuizController extends AbstractController
 
         return $this->redirectToRoute('tvdt_backoffice_quiz_candidates_tab', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
     }
+
+    #[IsCsrfTokenValid('reset_candidate_progress')]
+    #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
+    #[Route(
+        '/backoffice/quiz/{quiz}/candidate/{candidate}/reset',
+        name: 'tvdt_backoffice_reset_candidate_progress',
+        requirements: ['quiz' => Requirement::UUID, 'candidate' => Requirement::UUID],
+        methods: ['POST'],
+    )]
+    public function resetCandidateProgress(Quiz $quiz, Candidate $candidate): RedirectResponse
+    {
+        $this->em->wrapInTransaction(function () use ($quiz, $candidate): void {
+            $this->givenAnswerRepository->deleteAllForCandidateInQuiz($quiz, $candidate);
+            $this->quizCandidateRepository->resetProgressForCandidate($quiz, $candidate);
+        });
+
+        $this->addFlash(FlashType::Success, $this->translator->trans('Candidate progress reset'));
+
+        return $this->redirectToRoute('tvdt_backoffice_quiz_candidates_tab', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
+    }
+
+    /**
+     * Pre-computes per-candidate data (quiz participation and given answer counts) to avoid nested loops in templates.
+     *
+     * @param iterable<QuizCandidate> $quizCandidates
+     *
+     * @return list<array{candidate: Candidate, quizCandidate: QuizCandidate|null, givenAnswersCount: int}>
+     */
+    private function buildCandidateData(Season $season, Quiz $quiz, iterable $quizCandidates): array
+    {
+        $quizCandidatesByCandidateId = [];
+        foreach ($quizCandidates as $qc) {
+            $quizCandidatesByCandidateId[$qc->candidate->id->toString()] = $qc;
+        }
+
+        $givenAnswersCountByCandidateId = $this->quizRepository->getGivenAnswersCountPerCandidate($quiz);
+
+        $candidateData = [];
+        foreach ($season->candidates as $candidate) {
+            $candidateIdString = $candidate->id->toString();
+            $candidateData[] = [
+                'candidate' => $candidate,
+                'quizCandidate' => $quizCandidatesByCandidateId[$candidateIdString] ?? null,
+                'givenAnswersCount' => $givenAnswersCountByCandidateId[$candidateIdString] ?? 0,
+            ];
+        }
+
+        return $candidateData;
+    }
 }

src/Controller/Backoffice/QuizQuestionController.php

@@ -74,18 +74,12 @@ class QuizQuestionController extends AbstractController
             ? 'backoffice/quiz/_question_frame.html.twig'
             : 'backoffice/quiz/question_form.html.twig';
 
-        $response = $this->render($template, [
+        return $this->render($template, [
             'season' => $season,
             'quiz' => $quiz,
             'question' => $question,
             'form' => $form,
         ]);
-
-        if ($form->isSubmitted()) {
-            $response->setStatusCode(Response::HTTP_UNPROCESSABLE_ENTITY);
-        }
-
-        return $response;
     }
 
     #[IsGranted(SeasonVoter::EDIT, subject: 'season')]

src/Controller/Backoffice/ReleasesController.php

@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Controller\Backoffice;
+
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+use Tvdt\Controller\AbstractController;
+use Tvdt\Service\GitHubReleasesService;
+
+final class ReleasesController extends AbstractController
+{
+    public function __construct(
+        private readonly GitHubReleasesService $gitHubReleasesService,
+    ) {}
+
+    #[Route('/backoffice/releases', name: 'tvdt_backoffice_releases', methods: ['GET'])]
+    public function index(): Response
+    {
+        return $this->render('backoffice/releases/_frame.html.twig', [
+            'releases' => $this->gitHubReleasesService->getReleases(),
+        ]);
+    }
+}

src/Controller/Backoffice/SeasonController.php

@@ -10,10 +10,13 @@ use Symfony\Component\Form\Extension\Core\Type\SubmitType;
 use Symfony\Component\Form\Extension\Core\Type\TextType;
 use Symfony\Component\Form\FormError;
 use Symfony\Component\HttpFoundation\File\UploadedFile;
+use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Attribute\AsController;
 use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Routing\Requirement\Requirement;
+use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Component\Validator\Constraints\Length;
 use Symfony\Component\Validator\Constraints\NotBlank;
@@ -26,6 +29,7 @@ use Tvdt\Enum\FlashType;
 use Tvdt\Form\AddCandidatesFormType;
 use Tvdt\Form\SettingsForm;
 use Tvdt\Form\UploadQuizFormType;
+use Tvdt\Repository\CandidateRepository;
 use Tvdt\Security\Voter\SeasonVoter;
 use Tvdt\Service\QuizSpreadsheetService;
 
@@ -37,6 +41,7 @@ class SeasonController extends AbstractController
         private readonly TranslatorInterface $translator,
         private readonly EntityManagerInterface $em,
         private readonly QuizSpreadsheetService $quizSpreadsheet,
+        private readonly CandidateRepository $candidateRepository,
     ) {}
 
     #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
@@ -97,6 +102,24 @@ class SeasonController extends AbstractController
         ]);
     }
 
+    #[IsCsrfTokenValid('regenerate_season_code')]
+    #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/settings/regenerate-code',
+        name: 'tvdt_backoffice_season_regenerate_code',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX],
+        methods: ['POST'],
+    )]
+    public function regenerateSeasonCode(Season $season): RedirectResponse
+    {
+        $season->generateSeasonCode();
+        $this->em->flush();
+
+        $this->addFlash(FlashType::Success, $this->translator->trans('Season code regenerated'));
+
+        return $this->redirectToRoute('tvdt_backoffice_season_settings', ['seasonCode' => $season->seasonCode]);
+    }
+
     #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
     #[Route(
         '/backoffice/season/{seasonCode:season}/add-candidate',
@@ -106,6 +129,8 @@ class SeasonController extends AbstractController
     )]
     public function addCandidates(Season $season, Request $request): Response
     {
+        $isTurboFrame = $request->headers->has('Turbo-Frame');
+
         $form = $this->createForm(AddCandidatesFormType::class);
         $form->handleRequest($request);
 
@@ -117,10 +142,68 @@ class SeasonController extends AbstractController
 
             $this->em->flush();
 
-            return $this->redirectToRoute('tvdt_backoffice_season', ['seasonCode' => $season->seasonCode]);
+            if ($isTurboFrame) {
+                return new Response('<turbo-frame id="add-candidates-modal-frame"></turbo-frame>');
             }
 
-        return $this->render('backoffice/season_add_candidates.html.twig', ['form' => $form, 'season' => $season]);
+            return $this->redirectToRoute('tvdt_backoffice_season_candidates', ['seasonCode' => $season->seasonCode]);
+        }
+
+        $template = $isTurboFrame
+            ? 'backoffice/season/_add_candidates_frame.html.twig'
+            : 'backoffice/season_add_candidates.html.twig';
+
+        return $this->render($template, ['form' => $form, 'season' => $season]);
+    }
+
+    #[IsCsrfTokenValid('rename_candidate')]
+    #[IsGranted(SeasonVoter::EDIT, subject: 'candidate')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/candidate/{candidate}/rename',
+        name: 'tvdt_backoffice_candidate_rename',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'candidate' => Requirement::UUID],
+        methods: ['POST'],
+    )]
+    public function renameCandidate(Season $season, Candidate $candidate, Request $request): RedirectResponse
+    {
+        $name = mb_trim($request->request->getString('name'));
+
+        if ('' === $name || mb_strlen($name) > 16) {
+            $this->addFlash(FlashType::Danger, $this->translator->trans('The candidate name must be between 1 and 16 characters'));
+
+            return $this->redirectToRoute('tvdt_backoffice_season_candidates', ['seasonCode' => $season->seasonCode]);
+        }
+
+        $candidate->name = $name;
+
+        try {
+            $this->em->flush();
+        } catch (UniqueConstraintViolationException) {
+            $this->addFlash(FlashType::Danger, $this->translator->trans('A candidate with this name already exists in this season'));
+
+            return $this->redirectToRoute('tvdt_backoffice_season_candidates', ['seasonCode' => $season->seasonCode]);
+        }
+
+        $this->addFlash(FlashType::Success, $this->translator->trans('Candidate renamed'));
+
+        return $this->redirectToRoute('tvdt_backoffice_season_candidates', ['seasonCode' => $season->seasonCode]);
+    }
+
+    #[IsCsrfTokenValid('delete_candidate')]
+    #[IsGranted(SeasonVoter::DELETE, subject: 'candidate')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/candidate/{candidate}/delete',
+        name: 'tvdt_backoffice_candidate_delete',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'candidate' => Requirement::UUID],
+        methods: ['POST'],
+    )]
+    public function deleteCandidate(Season $season, Candidate $candidate): RedirectResponse
+    {
+        $this->candidateRepository->deleteCandidate($candidate);
+
+        $this->addFlash(FlashType::Success, $this->translator->trans('Candidate deleted'));
+
+        return $this->redirectToRoute('tvdt_backoffice_season_candidates', ['seasonCode' => $season->seasonCode]);
     }
 
     #[IsGranted(SeasonVoter::EDIT, subject: 'season')]

src/Controller/Backoffice/SettingsController.php

@@ -0,0 +1,214 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Controller\Backoffice;
+
+use Doctrine\DBAL\Exception\UniqueConstraintViolationException;
+use Doctrine\ORM\EntityManagerInterface;
+use Safe\DateTimeImmutable;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Form\FormError;
+use Symfony\Component\Form\FormInterface;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\HeaderUtils;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
+use Symfony\Contracts\Translation\TranslatorInterface;
+use Tvdt\Controller\AbstractController;
+use Tvdt\Entity\User;
+use Tvdt\Enum\FlashType;
+use Tvdt\Form\ChangeEmailFormType;
+use Tvdt\Form\ChangeUserPasswordFormType;
+use Tvdt\Helpers\FilenameSanitizer;
+use Tvdt\Repository\UserRepository;
+use Tvdt\Security\EmailVerifier;
+use Tvdt\Service\DataExportService;
+
+final class SettingsController extends AbstractController
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly UserPasswordHasherInterface $passwordHasher,
+        private readonly UserRepository $userRepository,
+        private readonly EmailVerifier $emailVerifier,
+        private readonly Security $security,
+        private readonly TranslatorInterface $translator,
+        private readonly DataExportService $dataExportService,
+    ) {}
+
+    #[Route('/backoffice/settings', name: 'tvdt_backoffice_settings', methods: ['GET'])]
+    public function index(): Response
+    {
+        return $this->renderSettings();
+    }
+
+    #[IsCsrfTokenValid('settings_language')]
+    #[Route('/backoffice/settings/language', name: 'tvdt_backoffice_settings_language', methods: ['POST'])]
+    public function saveLanguage(): RedirectResponse
+    {
+        // Only Dutch is available for now, so saving is a noop.
+        $this->addFlash(FlashType::Success, $this->translator->trans('Language saved'));
+
+        return $this->redirectToRoute('tvdt_backoffice_settings');
+    }
+
+    #[Route('/backoffice/settings/password', name: 'tvdt_backoffice_settings_password', methods: ['POST'])]
+    public function changePassword(Request $request): Response
+    {
+        $user = $this->authenticatedUser;
+        $form = $this->createForm(ChangeUserPasswordFormType::class);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            /** @var string $plainPassword */
+            $plainPassword = $form->get('plainPassword')->getData();
+
+            $user->password = $this->passwordHasher->hashPassword($user, $plainPassword);
+            $this->entityManager->flush();
+            $this->userRepository->invalidateResetPasswordRequests($user);
+
+            $this->security->login($user, 'form_login', 'main');
+            $this->addFlash(FlashType::Success, $this->translator->trans('Your password has been changed.'));
+
+            return $this->redirectToRoute('tvdt_backoffice_settings');
+        }
+
+        return $this->renderSettings(passwordForm: $form);
+    }
+
+    #[Route('/backoffice/settings/email', name: 'tvdt_backoffice_settings_email', methods: ['POST'])]
+    public function changeEmail(Request $request): Response
+    {
+        $user = $this->authenticatedUser;
+        $form = $this->createForm(ChangeEmailFormType::class);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            /** @var string $email */
+            $email = $form->get('email')->getData();
+
+            $found = $this->userRepository->findOneBy(['email' => $email]);
+            if ($found instanceof User && $found !== $user) {
+                $form->get('email')->addError(new FormError($this->translator->trans('There is already an account with this email')));
+
+                return $this->renderSettings(emailForm: $form);
+            }
+
+            $originalEmail = $user->email;
+            $originalIsVerified = $user->isVerified;
+
+            $user->email = $email;
+            $user->isVerified = false;
+
+            try {
+                $this->entityManager->flush();
+            } catch (UniqueConstraintViolationException) {
+                // A concurrent request can claim the email between the uniqueness check above and the flush
+                $user->email = $originalEmail;
+                $user->isVerified = $originalIsVerified;
+                $form->get('email')->addError(new FormError($this->translator->trans('There is already an account with this email')));
+
+                return $this->renderSettings(emailForm: $form);
+            }
+
+            $this->userRepository->invalidateResetPasswordRequests($user);
+
+            if ($this->emailVerifier->sendDefaultConfirmation($user)) {
+                $this->addFlash(FlashType::Success, $this->translator->trans('Your email address has been changed. Please check your inbox to confirm it.'));
+            } else {
+                $this->addFlash(FlashType::Success, $this->translator->trans('Your email address has been changed.'));
+                $this->addFlash(FlashType::Warning, $this->translator->trans('The confirmation email could not be sent. Please use the resend button to try again.'));
+            }
+
+            $this->security->login($user, 'form_login', 'main');
+
+            return $this->redirectToRoute('tvdt_backoffice_settings');
+        }
+
+        return $this->renderSettings(emailForm: $form);
+    }
+
+    #[IsCsrfTokenValid('resend_confirmation')]
+    #[Route('/backoffice/settings/resend-confirmation', name: 'tvdt_backoffice_settings_resend_confirmation', methods: ['POST'])]
+    public function resendConfirmationEmail(): RedirectResponse
+    {
+        $user = $this->authenticatedUser;
+
+        if ($user->isVerified) {
+            $this->addFlash(FlashType::Info, $this->translator->trans('Your email address is already confirmed.'));
+
+            return $this->redirectToRoute('tvdt_backoffice_settings');
+        }
+
+        if ($this->emailVerifier->sendDefaultConfirmation($user)) {
+            $this->addFlash(FlashType::Success, $this->translator->trans('A new confirmation email has been sent. Please check your inbox.'));
+        } else {
+            $this->addFlash(FlashType::Warning, $this->translator->trans('The confirmation email could not be sent. Please try again later.'));
+        }
+
+        return $this->redirectToRoute('tvdt_backoffice_settings');
+    }
+
+    #[Route('/backoffice/settings/download-data', name: 'tvdt_backoffice_settings_download_data', methods: ['GET'])]
+    public function downloadData(): Response
+    {
+        if (!$this->authenticatedUser->isVerified) {
+            $this->addFlash(FlashType::Warning, $this->translator->trans('Please confirm your email address before downloading your data.'));
+
+            return $this->redirectToRoute('tvdt_backoffice_settings');
+        }
+
+        $zipPath = $this->dataExportService->exportForUser($this->authenticatedUser);
+
+        $filename = \sprintf(
+            'tijd-voor-de-test-data-%s-%s.zip',
+            FilenameSanitizer::sanitize($this->authenticatedUser->email),
+            new DateTimeImmutable()->format('Y-m-d_H-i-s'),
+        );
+
+        $response = new BinaryFileResponse($zipPath);
+        $response->deleteFileAfterSend(true);
+        $response->headers->set('Content-Type', 'application/zip');
+        $response->headers->set(
+            'Content-Disposition',
+            HeaderUtils::makeDisposition(HeaderUtils::DISPOSITION_ATTACHMENT, $filename),
+        );
+
+        return $response;
+    }
+
+    #[IsCsrfTokenValid('delete_account')]
+    #[Route('/backoffice/settings/delete', name: 'tvdt_backoffice_settings_delete', methods: ['POST'])]
+    public function deleteAccount(Request $request): Response
+    {
+        $user = $this->authenticatedUser;
+        $password = (string) $request->request->get('password', '');
+
+        if (!$this->passwordHasher->isPasswordValid($user, $password)) {
+            $this->addFlash(FlashType::Danger, $this->translator->trans('Wrong password, your account has not been deleted.'));
+
+            return $this->redirectToRoute('tvdt_backoffice_settings');
+        }
+
+        $this->userRepository->deleteUser($user);
+
+        return $this->security->logout(false) ?? $this->redirectToRoute('tvdt_login_login');
+    }
+
+    /**
+     * @param FormInterface<array{currentPassword: string, plainPassword: string}|null>|null $passwordForm
+     * @param FormInterface<array{email: string}|null>|null                                  $emailForm
+     */
+    private function renderSettings(?FormInterface $passwordForm = null, ?FormInterface $emailForm = null): Response
+    {
+        return $this->render('backoffice/settings/index.html.twig', [
+            'passwordForm' => $passwordForm ?? $this->createForm(ChangeUserPasswordFormType::class),
+            'emailForm' => $emailForm ?? $this->createForm(ChangeEmailFormType::class),
+        ]);
+    }
+}

src/Controller/RegistrationController.php

@@ -5,14 +5,11 @@ declare(strict_types=1);
 namespace Tvdt\Controller;
 
 use Doctrine\ORM\EntityManagerInterface;
-use Psr\Log\LoggerInterface;
-use Symfony\Bridge\Twig\Mime\TemplatedEmail;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
-use Symfony\Component\Mailer\Exception\TransportExceptionInterface;
 use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Core\User\UserInterface;
@@ -26,7 +23,7 @@ use Tvdt\Security\EmailVerifier;
 
 final class RegistrationController extends AbstractController
 {
-    public function __construct(private readonly EmailVerifier $emailVerifier, private readonly TranslatorInterface $translator, private readonly UserPasswordHasherInterface $userPasswordHasher, private readonly Security $security, private readonly LoggerInterface $logger, private readonly UserRepository $userRepository, private readonly EntityManagerInterface $entityManager) {}
+    public function __construct(private readonly EmailVerifier $emailVerifier, private readonly TranslatorInterface $translator, private readonly UserPasswordHasherInterface $userPasswordHasher, private readonly Security $security, private readonly UserRepository $userRepository, private readonly EntityManagerInterface $entityManager) {}
 
     #[Route('/register', name: 'tvdt_register')]
     public function register(
@@ -49,17 +46,8 @@ final class RegistrationController extends AbstractController
             $this->entityManager->persist($user);
             $this->entityManager->flush();
 
-            try {
             // generate a signed url and email it to the user
-                $this->emailVerifier->sendEmailConfirmation('tvdt_verify_email', $user,
+            $this->emailVerifier->sendDefaultConfirmation($user);
-                    new TemplatedEmail()
-                        ->to($user->email)
-                        ->subject($this->translator->trans('Please Confirm your Email'))
-                        ->htmlTemplate('backoffice/registration/confirmation_email.html.twig'),
-                );
-            } catch (TransportExceptionInterface $e) {
-                $this->logger->error($e->getMessage());
-            }
 
             $response = $this->security->login($user, 'form_login', 'main');
             \assert($response instanceof Response);

src/Controller/ResetPasswordController.php

@@ -0,0 +1,147 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Controller;
+
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bridge\Twig\Mime\TemplatedEmail;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Mailer\MailerInterface;
+use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Contracts\Translation\TranslatorInterface;
+use SymfonyCasts\Bundle\ResetPassword\Controller\ResetPasswordControllerTrait;
+use SymfonyCasts\Bundle\ResetPassword\Exception\ResetPasswordExceptionInterface;
+use SymfonyCasts\Bundle\ResetPassword\Model\ResetPasswordToken;
+use SymfonyCasts\Bundle\ResetPassword\ResetPasswordHelperInterface;
+use Tvdt\Entity\User;
+use Tvdt\Enum\FlashType;
+use Tvdt\Form\ChangePasswordFormType;
+use Tvdt\Form\ResetPasswordRequestFormType;
+
+final class ResetPasswordController extends AbstractController
+{
+    use ResetPasswordControllerTrait;
+
+    public function __construct(
+        private readonly ResetPasswordHelperInterface $resetPasswordHelper,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly MailerInterface $mailer,
+        private readonly TranslatorInterface $translator,
+        private readonly UserPasswordHasherInterface $passwordHasher,
+    ) {}
+
+    #[Route('/reset-password', name: 'tvdt_forgot_password_request')]
+    public function request(Request $request): Response
+    {
+        $form = $this->createForm(ResetPasswordRequestFormType::class);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            /** @var string $email */
+            $email = $form->get('email')->getData();
+
+            return $this->processSendingPasswordResetEmail($email, $this->mailer, $this->translator);
+        }
+
+        return $this->render('reset_password/request.html.twig', [
+            'requestForm' => $form,
+        ]);
+    }
+
+    #[Route('/reset-password/check-email', name: 'tvdt_check_email')]
+    public function checkEmail(): Response
+    {
+        if (!($resetToken = $this->getTokenObjectFromSession()) instanceof ResetPasswordToken) {
+            $resetToken = $this->resetPasswordHelper->generateFakeResetToken();
+        }
+
+        return $this->render('reset_password/check_email.html.twig', [
+            'resetToken' => $resetToken,
+        ]);
+    }
+
+    #[Route('/reset-password/reset/{token}', name: 'tvdt_reset_password')]
+    public function reset(Request $request, ?string $token = null): Response
+    {
+        if ($token) {
+            $this->storeTokenInSession($token);
+
+            return $this->redirectToRoute('tvdt_reset_password');
+        }
+
+        $token = $this->getTokenFromSession();
+        if (null === $token) {
+            throw $this->createNotFoundException('No reset password token found in the URL or in the session.');
+        }
+
+        try {
+            /** @var User $user */
+            $user = $this->resetPasswordHelper->validateTokenAndFetchUser($token);
+        } catch (ResetPasswordExceptionInterface $resetPasswordException) {
+            $this->addFlash(FlashType::Danger->value, \sprintf(
+                '%s - %s',
+                $this->translator->trans(ResetPasswordExceptionInterface::MESSAGE_PROBLEM_VALIDATE, [], 'ResetPasswordBundle'),
+                $this->translator->trans($resetPasswordException->getReason(), [], 'ResetPasswordBundle'),
+            ));
+
+            return $this->redirectToRoute('tvdt_forgot_password_request');
+        }
+
+        $form = $this->createForm(ChangePasswordFormType::class);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            $this->resetPasswordHelper->removeResetRequest($token);
+
+            /** @var string $plainPassword */
+            $plainPassword = $form->get('plainPassword')->getData();
+
+            $user->password = $this->passwordHasher->hashPassword($user, $plainPassword);
+            $this->entityManager->flush();
+
+            $this->cleanSessionAfterReset();
+
+            return $this->redirectToRoute('tvdt_backoffice_index');
+        }
+
+        return $this->render('reset_password/reset.html.twig', [
+            'resetForm' => $form,
+        ]);
+    }
+
+    private function processSendingPasswordResetEmail(string $emailFormData, MailerInterface $mailer, TranslatorInterface $translator): RedirectResponse
+    {
+        $user = $this->entityManager->getRepository(User::class)->findOneBy([
+            'email' => $emailFormData,
+        ]);
+
+        if (!$user instanceof User) {
+            return $this->redirectToRoute('tvdt_check_email');
+        }
+
+        try {
+            $resetToken = $this->resetPasswordHelper->generateResetToken($user);
+        } catch (ResetPasswordExceptionInterface) {
+            return $this->redirectToRoute('tvdt_check_email');
+        }
+
+        $email = new TemplatedEmail()
+            ->to($user->getUserIdentifier())
+            ->subject($translator->trans('Your password reset request'))
+            ->htmlTemplate('reset_password/email.html.twig')
+            ->context([
+                'resetToken' => $resetToken,
+            ]);
+
+        $mailer->send($email);
+
+        $this->setTokenObjectInSession($resetToken);
+
+        return $this->redirectToRoute('tvdt_check_email');
+    }
+}

src/Controller/WellKnownController.php

@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Controller;
+
+use Safe\DateTimeImmutable;
+use Safe\Exceptions\DatetimeException;
+use Symfony\Component\DependencyInjection\Attribute\Autowire;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+
+/** Serves well-known URIs (https://www.rfc-editor.org/rfc/rfc8615). */
+final class WellKnownController extends AbstractController
+{
+    public function __construct(
+        #[Autowire(env: 'default::BUILD_TIME')]
+        private readonly ?string $buildTime,
+        #[Autowire(env: 'APP_ENV')]
+        private readonly string $appEnv,
+    ) {}
+
+    /** @see https://w3c.github.io/webappsec-change-password-url/ */
+    #[Route('/.well-known/change-password', name: 'tvdt_well_known_change_password', methods: ['GET'])]
+    public function changePassword(): RedirectResponse
+    {
+        return $this->redirectToRoute('tvdt_backoffice_settings');
+    }
+
+    /**
+     * @see https://www.rfc-editor.org/rfc/rfc9116
+     *
+     * @throws DatetimeException
+     * @throws \Exception
+     */
+    #[Route('/.well-known/security.txt', name: 'tvdt_well_known_security_txt', methods: ['GET'])]
+    public function securityTxt(): Response
+    {
+        // One year after the container build, so the file goes stale when deployments stop.
+        // In prod the build arg must be set; falling back to 'now' would renew Expires on every request,
+        // defeating the go-stale purpose. In dev/test 'now' is fine — no build bake happens there.
+        if ((null === $this->buildTime || '' === $this->buildTime) && 'prod' === $this->appEnv) {
+            throw new \LogicException('BUILD_TIME env var must be set in production (baked in during Docker build).');
+        }
+
+        $buildTime = (null !== $this->buildTime && '' !== $this->buildTime) ? $this->buildTime : 'now';
+        $expires = new DateTimeImmutable($buildTime)->modify('+1 year')->format(\DATE_RFC3339);
+
+        $content = <<<TXT
+            Contact: https://github.com/MarijnDoeve/TijdVoorDeTest/security/advisories/new
+            Expires: {$expires}
+            Preferred-Languages: nl, en
+
+            TXT;
+
+        return new Response($content, headers: ['Content-Type' => 'text/plain; charset=UTF-8']);
+    }
+}

src/DataFixtures/TestFixtures.php

@@ -9,6 +9,10 @@ use Doctrine\Bundle\FixturesBundle\FixtureGroupInterface;
 use Doctrine\Common\DataFixtures\DependentFixtureInterface;
 use Doctrine\Persistence\ObjectManager;
 use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+use Tvdt\Entity\Answer;
+use Tvdt\Entity\Candidate;
+use Tvdt\Entity\Question;
+use Tvdt\Entity\Quiz;
 use Tvdt\Entity\Season;
 use Tvdt\Entity\User;
 
@@ -70,6 +74,33 @@ final class TestFixtures extends Fixture implements FixtureGroupInterface, Depen
         $krtek->addOwner($user);
         $anotherSeason->addOwner($user);
 
+        $soleOwner = new User();
+        $soleOwner->email = 'sole-owner@example.org';
+        $soleOwner->password = $this->passwordHasher->hashPassword($soleOwner, self::PASSWORD);
+
+        $manager->persist($soleOwner);
+
+        $doomedSeason = new Season();
+        $doomedSeason->name = 'Doomed Season';
+        $doomedSeason->seasonCode = 'doomd';
+        $doomedSeason->addCandidate(new Candidate('Vera'));
+
+        $quiz = new Quiz();
+        $quiz->name = 'Doomed Quiz';
+
+        $question = new Question();
+        $question->question = 'Wie is de Krtek?';
+        $question->ordering = 1;
+        $question->addAnswer(new Answer('Vera', true));
+
+        $quiz->addQuestion($question);
+        $doomedSeason->addQuiz($quiz);
+
+        $manager->persist($doomedSeason);
+
+        $doomedSeason->addOwner($soleOwner);
+        $anotherSeason->addOwner($soleOwner);
+
         $manager->flush();
     }
 }

src/Entity/ResetPasswordRequest.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Entity;
+
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Bridge\Doctrine\Types\UuidType;
+use Symfony\Component\Uid\Uuid;
+use SymfonyCasts\Bundle\ResetPassword\Model\ResetPasswordRequestInterface;
+use SymfonyCasts\Bundle\ResetPassword\Model\ResetPasswordRequestTrait;
+use Tvdt\Repository\ResetPasswordRequestRepository;
+
+#[ORM\Entity(repositoryClass: ResetPasswordRequestRepository::class)]
+class ResetPasswordRequest implements ResetPasswordRequestInterface
+{
+    use ResetPasswordRequestTrait;
+
+    #[ORM\Column(type: UuidType::NAME, unique: true)]
+    #[ORM\CustomIdGenerator(class: 'doctrine.uuid_generator')]
+    #[ORM\GeneratedValue(strategy: 'CUSTOM')]
+    #[ORM\Id]
+    public private(set) Uuid $id;
+
+    public function __construct(#[ORM\JoinColumn(nullable: false)]
+        #[ORM\ManyToOne]
+        private User $user, \DateTimeInterface $expiresAt, string $selector, string $hashedToken)
+    {
+        $this->initialize($expiresAt, $selector, $hashedToken);
+    }
+
+    public function getUser(): User
+    {
+        return $this->user;
+    }
+}

src/Entity/User.php

@@ -21,6 +21,10 @@ use Tvdt\Repository\UserRepository;
 #[UniqueEntity(fields: ['email'], message: 'There is already an account with this email')]
 class User implements UserInterface, PasswordAuthenticatedUserInterface
 {
+    public const int PASSWORD_MIN_LENGTH = 8;
+
+    public const int PASSWORD_MAX_LENGTH = 4096;
+
     #[ORM\Column(type: UuidType::NAME, unique: true)]
     #[ORM\CustomIdGenerator(class: 'doctrine.uuid_generator')]
     #[ORM\GeneratedValue(strategy: 'CUSTOM')]

src/Form/AddCandidatesFormType.php

@@ -19,7 +19,9 @@ class AddCandidatesFormType extends AbstractType
     {
         $builder
             ->add('candidates', TextareaType::class, [
-                'label' => $this->translator->trans('Candidates'), 'translation_domain' => false,
+                'label' => $this->translator->trans('Candidates'),
+                'help' => $this->translator->trans('One candidate per line'),
+                'translation_domain' => false,
             ])
         ;
     }

src/Form/ChangeEmailFormType.php

@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Form;
+
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\EmailType;
+use Symfony\Component\Form\Extension\Core\Type\SubmitType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use Symfony\Component\Validator\Constraints\Email;
+use Symfony\Component\Validator\Constraints\NotBlank;
+use Symfony\Contracts\Translation\TranslatorInterface;
+
+/** @extends AbstractType<array{email: string}> */
+final class ChangeEmailFormType extends AbstractType
+{
+    public function __construct(private readonly TranslatorInterface $translator) {}
+
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        $builder
+            ->add('email', EmailType::class, [
+                'label' => $this->translator->trans('New email address'),
+                'attr' => ['autocomplete' => 'email'],
+                'mapped' => false,
+                'constraints' => [
+                    new NotBlank(message: 'Please enter an email address'),
+                    new Email(),
+                ],
+                'translation_domain' => false,
+            ])
+            ->add('save', SubmitType::class, [
+                'label' => $this->translator->trans('Change email'),
+                'translation_domain' => false,
+            ]);
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([]);
+    }
+}

src/Form/ChangePasswordFormType.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Form;
+
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\PasswordType;
+use Symfony\Component\Form\Extension\Core\Type\RepeatedType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use Symfony\Component\Validator\Constraints\Length;
+use Symfony\Component\Validator\Constraints\NotBlank;
+use Symfony\Contracts\Translation\TranslatorInterface;
+use Tvdt\Entity\User;
+
+/** @extends AbstractType<array{plainPassword: string}> */
+final class ChangePasswordFormType extends AbstractType
+{
+    public function __construct(private readonly TranslatorInterface $translator) {}
+
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        $builder
+            ->add('plainPassword', RepeatedType::class, [
+                'type' => PasswordType::class,
+                'options' => [
+                    'attr' => ['autocomplete' => 'new-password'],
+                ],
+                'first_options' => [
+                    'label' => $this->translator->trans('New password'),
+                    'constraints' => [
+                        new NotBlank(message: 'Please enter a password'),
+                        new Length(
+                            min: User::PASSWORD_MIN_LENGTH,
+                            max: User::PASSWORD_MAX_LENGTH,
+                            minMessage: 'Your password should be at least {{ limit }} characters',
+                        ),
+                    ],
+                ],
+                'second_options' => [
+                    'label' => $this->translator->trans('Repeat Password'),
+                ],
+                'invalid_message' => $this->translator->trans('The password fields must match.'),
+                'mapped' => false,
+                'translation_domain' => false,
+            ]);
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([]);
+    }
+}

src/Form/ChangeUserPasswordFormType.php

@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Form;
+
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\PasswordType;
+use Symfony\Component\Form\Extension\Core\Type\RepeatedType;
+use Symfony\Component\Form\Extension\Core\Type\SubmitType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use Symfony\Component\Security\Core\Validator\Constraints\UserPassword;
+use Symfony\Component\Validator\Constraints\Length;
+use Symfony\Component\Validator\Constraints\NotBlank;
+use Symfony\Contracts\Translation\TranslatorInterface;
+use Tvdt\Entity\User;
+
+/** @extends AbstractType<array{currentPassword: string, plainPassword: string}> */
+final class ChangeUserPasswordFormType extends AbstractType
+{
+    public function __construct(private readonly TranslatorInterface $translator) {}
+
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        $builder
+            ->add('currentPassword', PasswordType::class, [
+                'label' => $this->translator->trans('Current password'),
+                'attr' => ['autocomplete' => 'current-password'],
+                'mapped' => false,
+                'constraints' => [
+                    new NotBlank(message: 'Please enter your current password'),
+                    new UserPassword(message: 'This is not your current password.'),
+                ],
+                'translation_domain' => false,
+            ])
+            ->add('plainPassword', RepeatedType::class, [
+                'type' => PasswordType::class,
+                'options' => [
+                    'attr' => ['autocomplete' => 'new-password'],
+                ],
+                'first_options' => [
+                    'label' => $this->translator->trans('New password'),
+                    'constraints' => [
+                        new NotBlank(message: 'Please enter a password'),
+                        new Length(
+                            min: User::PASSWORD_MIN_LENGTH,
+                            max: User::PASSWORD_MAX_LENGTH,
+                            minMessage: 'Your password should be at least {{ limit }} characters',
+                        ),
+                    ],
+                ],
+                'second_options' => [
+                    'label' => $this->translator->trans('Repeat Password'),
+                ],
+                'invalid_message' => $this->translator->trans('The password fields must match.'),
+                'mapped' => false,
+                'translation_domain' => false,
+            ])
+            ->add('save', SubmitType::class, [
+                'label' => $this->translator->trans('Change password'),
+                'translation_domain' => false,
+            ]);
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([]);
+    }
+}

src/Form/RegistrationFormType.php

@@ -38,7 +38,7 @@ class RegistrationFormType extends AbstractType
                 'mapped' => false,
                 'constraints' => [
                     new NotBlank(message: 'Please enter a password'),
-                    new Length(min: 8, max: 4096, minMessage: 'Your password should be at least {{ limit }} characters'),
+                    new Length(min: User::PASSWORD_MIN_LENGTH, max: User::PASSWORD_MAX_LENGTH, minMessage: 'Your password should be at least {{ limit }} characters'),
                 ],
                 'translation_domain' => false,
             ])

src/Form/ResetPasswordRequestFormType.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Form;
+
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\EmailType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use Symfony\Component\Validator\Constraints\NotBlank;
+use Symfony\Contracts\Translation\TranslatorInterface;
+
+/** @extends AbstractType<array{email: string}> */
+final class ResetPasswordRequestFormType extends AbstractType
+{
+    public function __construct(private readonly TranslatorInterface $translator) {}
+
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        $builder
+            ->add('email', EmailType::class, [
+                'label' => $this->translator->trans('Email'),
+                'attr' => ['autocomplete' => 'email'],
+                'translation_domain' => false,
+                'constraints' => [
+                    new NotBlank(message: 'Please enter your email'),
+                ],
+            ]);
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([]);
+    }
+}

src/Helpers/FilenameSanitizer.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Helpers;
+
+use Symfony\Component\String\Slugger\AsciiSlugger;
+
+class FilenameSanitizer
+{
+    /** Slugs user-supplied text (e.g. a season/quiz name) into a string safe to use as a zip entry path segment or a downloaded filename. */
+    public static function sanitize(string $value): string
+    {
+        $slug = new AsciiSlugger()->slug($value)->toString();
+
+        return '' === $slug ? 'unnamed' : $slug;
+    }
+}

src/Repository/CandidateRepository.php

@@ -19,6 +19,12 @@ class CandidateRepository extends ServiceEntityRepository
         parent::__construct($registry, Candidate::class);
     }
 
+    public function deleteCandidate(Candidate $candidate): void
+    {
+        $this->getEntityManager()->remove($candidate);
+        $this->getEntityManager()->flush();
+    }
+
     public function getCandidateByHash(Season $season, string $hash): ?Candidate
     {
         try {

src/Repository/GivenAnswerRepository.php

@@ -6,7 +6,9 @@ namespace Tvdt\Repository;
 
 use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
 use Doctrine\Persistence\ManagerRegistry;
+use Tvdt\Entity\Candidate;
 use Tvdt\Entity\GivenAnswer;
+use Tvdt\Entity\Quiz;
 
 /** @extends ServiceEntityRepository<GivenAnswer> */
 class GivenAnswerRepository extends ServiceEntityRepository
@@ -15,4 +17,15 @@ class GivenAnswerRepository extends ServiceEntityRepository
     {
         parent::__construct($registry, GivenAnswer::class);
     }
+
+    public function deleteAllForCandidateInQuiz(Quiz $quiz, Candidate $candidate): void
+    {
+        $givenAnswers = $this->findBy(['quiz' => $quiz, 'candidate' => $candidate]);
+
+        foreach ($givenAnswers as $givenAnswer) {
+            $this->getEntityManager()->remove($givenAnswer);
+        }
+
+        $this->getEntityManager()->flush();
+    }
 }

src/Repository/QuizCandidateRepository.php

@@ -68,4 +68,15 @@ class QuizCandidateRepository extends ServiceEntityRepository
         $quizCandidate->penaltySeconds = $penalty;
         $this->getEntityManager()->flush();
     }
+
+    public function resetProgressForCandidate(Quiz $quiz, Candidate $candidate): void
+    {
+        $quizCandidate = $this->findOneBy(['candidate' => $candidate, 'quiz' => $quiz]);
+        if (!$quizCandidate instanceof QuizCandidate) {
+            return;
+        }
+
+        $quizCandidate->started = null;
+        $this->getEntityManager()->flush();
+    }
 }

src/Repository/ResetPasswordRequestRepository.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Repository;
+
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+use SymfonyCasts\Bundle\ResetPassword\Model\ResetPasswordRequestInterface;
+use SymfonyCasts\Bundle\ResetPassword\Persistence\Repository\ResetPasswordRequestRepositoryTrait;
+use SymfonyCasts\Bundle\ResetPassword\Persistence\ResetPasswordRequestRepositoryInterface;
+use Tvdt\Entity\ResetPasswordRequest;
+use Tvdt\Entity\User;
+
+/** @extends ServiceEntityRepository<ResetPasswordRequest> */
+final class ResetPasswordRequestRepository extends ServiceEntityRepository implements ResetPasswordRequestRepositoryInterface
+{
+    use ResetPasswordRequestRepositoryTrait;
+
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, ResetPasswordRequest::class);
+    }
+
+    public function createResetPasswordRequest(object $user, \DateTimeInterface $expiresAt, string $selector, string $hashedToken): ResetPasswordRequestInterface
+    {
+        \assert($user instanceof User);
+
+        return new ResetPasswordRequest($user, $expiresAt, $selector, $hashedToken);
+    }
+}

src/Repository/UserRepository.php

@@ -5,9 +5,15 @@ declare(strict_types=1);
 namespace Tvdt\Repository;
 
 use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\ORM\EntityManagerInterface;
 use Doctrine\Persistence\ManagerRegistry;
 use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
 use Symfony\Component\Security\Core\User\PasswordUpgraderInterface;
+use Tvdt\Entity\BankQuestion;
+use Tvdt\Entity\Elimination;
+use Tvdt\Entity\GivenAnswer;
+use Tvdt\Entity\QuizCandidate;
+use Tvdt\Entity\Season;
 use Tvdt\Entity\User;
 
 /** @extends ServiceEntityRepository<User> */
@@ -28,6 +34,94 @@ class UserRepository extends ServiceEntityRepository implements PasswordUpgrader
         $this->getEntityManager()->flush();
     }
 
+    /** Deletes all outstanding reset-password tokens for the user (e.g. after a password or email change). */
+    public function invalidateResetPasswordRequests(User $user): void
+    {
+        $this->getEntityManager()
+            ->createQuery('delete from Tvdt\Entity\ResetPasswordRequest r where r.user = :user')
+            ->setParameter('user', $user)
+            ->execute();
+    }
+
+    /** Deletes the user, all seasons the user is the sole owner of, and the user's ownership of shared seasons. */
+    public function deleteUser(User $user): void
+    {
+        $em = $this->getEntityManager();
+        $em->wrapInTransaction(function () use ($em, $user): void {
+            $this->invalidateResetPasswordRequests($user);
+
+            $bankQuestionIds = [];
+            foreach ($user->seasons->toArray() as $season) {
+                if (1 === $season->owners->count()) {
+                    $this->purgeSoftDeletableData($em, $season);
+                    array_push($bankQuestionIds, ...$this->bankQuestionIds($season));
+                    $em->remove($season);
+
+                    continue;
+                }
+
+                $season->removeOwner($user);
+            }
+
+            $em->remove($user);
+            $em->flush();
+
+            // Gedmo\Loggable writes its own "removed" log entry as part of the flush above, so the
+            // audit-log purge must happen after — purging first would just leave that final row behind.
+            $this->purgeBankQuestionAuditLog($em, $bankQuestionIds);
+        });
+    }
+
+    /**
+     * QuizCandidate, GivenAnswer, and Elimination are Gedmo\SoftDeleteable, so cascading their
+     * removal through the season/quiz/candidate relations only sets deletedAt — it never removes
+     * the row. That leaves personal data behind indefinitely and, since Candidate/Answer are hard
+     * deleted via orphanRemoval, it also breaks their foreign keys and rolls back the whole
+     * deletion. Bulk DQL deletes bypass the Gedmo listener and physically remove these rows first.
+     */
+    private function purgeSoftDeletableData(EntityManagerInterface $em, Season $season): void
+    {
+        foreach ([QuizCandidate::class, GivenAnswer::class, Elimination::class] as $class) {
+            $em->createQuery(<<<DQL
+                delete from {$class} e
+                where e.quiz in (select q from Tvdt\Entity\Quiz q where q.season = :season)
+                DQL)
+                ->setParameter('season', $season)
+                ->execute();
+        }
+    }
+
+    /** @return list<string> */
+    private function bankQuestionIds(Season $season): array
+    {
+        return array_values(array_map(
+            static fn (BankQuestion $bankQuestion): string => $bankQuestion->id->toString(),
+            $season->bankQuestions->toArray(),
+        ));
+    }
+
+    /**
+     * Gedmo\Loggable audit rows (ext_log_entries) aren't foreign-keyed to the entity they log —
+     * object_id is a plain string — so removing a BankQuestion never cleans up its history, and
+     * the editor's username/email would otherwise remain in those rows forever.
+     *
+     * @param list<string> $bankQuestionIds
+     */
+    private function purgeBankQuestionAuditLog(EntityManagerInterface $em, array $bankQuestionIds): void
+    {
+        if ([] === $bankQuestionIds) {
+            return;
+        }
+
+        $em->createQuery(<<<'DQL'
+            delete from Tvdt\Entity\LogEntry l
+            where l.objectClass = :class and l.objectId in (:ids)
+            DQL)
+            ->setParameter('class', BankQuestion::class)
+            ->setParameter('ids', $bankQuestionIds)
+            ->execute();
+    }
+
     public function makeAdmin(string $email): void
     {
         $user = $this->findOneBy(['email' => $email]);

src/Security/EmailVerifier.php

@@ -5,10 +5,12 @@ declare(strict_types=1);
 namespace Tvdt\Security;
 
 use Doctrine\ORM\EntityManagerInterface;
+use Psr\Log\LoggerInterface;
 use Symfony\Bridge\Twig\Mime\TemplatedEmail;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\Mailer\Exception\TransportExceptionInterface;
 use Symfony\Component\Mailer\MailerInterface;
+use Symfony\Contracts\Translation\TranslatorInterface;
 use SymfonyCasts\Bundle\VerifyEmail\VerifyEmailHelperInterface;
 use Tvdt\Entity\User;
 
@@ -18,8 +20,29 @@ readonly class EmailVerifier
         private VerifyEmailHelperInterface $verifyEmailHelper,
         private MailerInterface $mailer,
         private EntityManagerInterface $entityManager,
+        private TranslatorInterface $translator,
+        private LoggerInterface $logger,
     ) {}
 
+    /** Sends the standard confirmation email to the user. Returns false (and logs) on transport errors. */
+    public function sendDefaultConfirmation(User $user): bool
+    {
+        try {
+            $this->sendEmailConfirmation('tvdt_verify_email', $user,
+                new TemplatedEmail()
+                    ->to($user->email)
+                    ->subject($this->translator->trans('Please Confirm your Email'))
+                    ->htmlTemplate('backoffice/registration/confirmation_email.html.twig'),
+            );
+
+            return true;
+        } catch (TransportExceptionInterface $transportException) {
+            $this->logger->error($transportException->getMessage());
+
+            return false;
+        }
+    }
+
     /** @throws TransportExceptionInterface */
     public function sendEmailConfirmation(string $verifyEmailRouteName, User $user, TemplatedEmail $email): void
     {

src/Security/LogoutRedirectListener.php

@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Security;
+
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Http\Event\LogoutEvent;
+
+final readonly class LogoutRedirectListener implements EventSubscriberInterface
+{
+    private const array BLOCKED_TARGET_PREFIXES = ['/backoffice', '/elimination'];
+
+    public function __construct(private UrlGeneratorInterface $urlGenerator) {}
+
+    public function onLogout(LogoutEvent $event): void
+    {
+        $target = $event->getRequest()->query->get('target');
+
+        if (\is_string($target) && $this->isAllowedTarget($target)) {
+            $event->setResponse(new RedirectResponse($target));
+
+            return;
+        }
+
+        $event->setResponse(new RedirectResponse($this->urlGenerator->generate('tvdt_quiz_select_season')));
+    }
+
+    public static function getSubscribedEvents(): array
+    {
+        // Must run before Symfony's DefaultLogoutListener (priority 64), which only
+        // sets a response if none is set yet.
+        return [
+            LogoutEvent::class => ['onLogout', 128],
+        ];
+    }
+
+    private function isAllowedTarget(string $target): bool
+    {
+        if (!str_starts_with($target, '/') || str_starts_with($target, '//')) {
+            return false;
+        }
+
+        return !array_any(self::BLOCKED_TARGET_PREFIXES, static fn (string $prefix): bool => str_starts_with($target, $prefix));
+    }
+}

src/Service/DataExportService.php

@@ -0,0 +1,472 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Service;
+
+use Doctrine\ORM\EntityManagerInterface;
+use PhpOffice\PhpSpreadsheet\Cell\Coordinate;
+use PhpOffice\PhpSpreadsheet\Spreadsheet;
+use PhpOffice\PhpSpreadsheet\Worksheet\Worksheet;
+use PhpOffice\PhpSpreadsheet\Writer;
+use Safe\Exceptions\FilesystemException;
+use Tvdt\Dto\Result;
+use Tvdt\Entity\BankQuestionUsage;
+use Tvdt\Entity\Candidate;
+use Tvdt\Entity\Question;
+use Tvdt\Entity\QuestionLabel;
+use Tvdt\Entity\Quiz;
+use Tvdt\Entity\Season;
+use Tvdt\Entity\User;
+use Tvdt\Helpers\FilenameSanitizer;
+use Tvdt\Repository\QuizRepository;
+
+use function Safe\tempnam;
+use function Safe\unlink;
+
+/** Builds a GDPR data-portability export (a zip of xlsx files) for everything owned by a single user. */
+class DataExportService
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly QuizSpreadsheetService $quizSpreadsheetService,
+        private readonly QuizRepository $quizRepository,
+    ) {}
+
+    /** @throws FilesystemException @return string path to a temp zip file; caller is responsible for removing it */
+    public function exportForUser(User $user): string
+    {
+        $filter = $this->entityManager->getFilters();
+        $filter->disable('softdeleteable');
+
+        try {
+            return $this->buildZip($user);
+        } finally {
+            $filter->enable('softdeleteable');
+        }
+    }
+
+    private function buildZip(User $user): string
+    {
+        $zipPath = tempnam(sys_get_temp_dir(), 'tvdt_export_');
+        $tempXlsxFiles = [];
+
+        $zip = new \ZipArchive();
+        if (true !== $zip->open($zipPath, \ZipArchive::OVERWRITE)) {
+            unlink($zipPath);
+
+            throw new \RuntimeException('Could not create the export zip archive.');
+        }
+
+        try {
+            $profilePath = $this->writeToTempFile($this->buildProfileWorkbook($user));
+            $tempXlsxFiles[] = $profilePath;
+            $zip->addFile($profilePath, 'profile.xlsx');
+
+            foreach ($user->seasons as $season) {
+                $folder = FilenameSanitizer::sanitize($season->seasonCode.'-'.$season->name).'/';
+
+                foreach ($season->quizzes as $quiz) {
+                    $quizPath = $this->writeToTempFile($this->buildQuizWorkbook($quiz));
+                    $tempXlsxFiles[] = $quizPath;
+                    $zip->addFile($quizPath, $folder.FilenameSanitizer::sanitize($quiz->name).'.xlsx');
+                }
+
+                $candidatesPath = $this->writeToTempFile($this->buildCandidatesWorkbook($season));
+                $tempXlsxFiles[] = $candidatesPath;
+                $zip->addFile($candidatesPath, $folder.'candidates.xlsx');
+
+                $questionBankPath = $this->writeToTempFile($this->buildQuestionBankWorkbook($season));
+                $tempXlsxFiles[] = $questionBankPath;
+                $zip->addFile($questionBankPath, $folder.'question-bank.xlsx');
+            }
+
+            if (!$zip->close()) {
+                throw new \RuntimeException('Could not finalize the export zip archive.');
+            }
+        } catch (\Throwable $throwable) {
+            unlink($zipPath);
+
+            throw $throwable;
+        } finally {
+            foreach ($tempXlsxFiles as $tempXlsxFile) {
+                unlink($tempXlsxFile);
+            }
+        }
+
+        return $zipPath;
+    }
+
+    private function buildProfileWorkbook(User $user): Spreadsheet
+    {
+        $spreadsheet = new Spreadsheet();
+
+        $account = $spreadsheet->getActiveSheet();
+        $account->setTitle('Account');
+        $account->getStyle('A:A')->getFont()->setBold(true);
+        $account->fromArray([
+            ['Email', $user->email],
+            ['Roles', implode(', ', $user->getRoles())],
+            ['Email verified', $user->isVerified ? 'Yes' : 'No'],
+            ['Account ID', $user->id->toString()],
+        ], null, 'A1');
+        $account->getColumnDimension('A')->setAutoSize(true);
+        $account->getColumnDimension('B')->setAutoSize(true);
+
+        $seasons = $spreadsheet->createSheet();
+        $seasons->setTitle('Seasons');
+        $seasons->fromArray(['Season', 'Season code', 'Quizzes', 'Candidates', 'Shared with other owners'], null, 'A1');
+        $seasons->getStyle('1:1')->getFont()->setBold(true);
+
+        $row = 2;
+        foreach ($user->seasons as $season) {
+            $seasons->fromArray([
+                $season->name,
+                $season->seasonCode,
+                $season->quizzes->count(),
+                $season->candidates->count(),
+                $season->owners->count() > 1 ? 'Yes' : 'No',
+            ], null, 'A'.$row);
+            ++$row;
+        }
+
+        foreach (['A', 'B', 'C', 'D', 'E'] as $column) {
+            $seasons->getColumnDimension($column)->setAutoSize(true);
+        }
+
+        $spreadsheet->setActiveSheetIndex(0);
+
+        return $spreadsheet;
+    }
+
+    private function buildQuizWorkbook(Quiz $quiz): Spreadsheet
+    {
+        $spreadsheet = new Spreadsheet();
+
+        $info = $spreadsheet->getActiveSheet();
+        $info->setTitle('Quiz info');
+        $this->fillQuizInfoSheet($info, $quiz);
+
+        $questions = $spreadsheet->createSheet();
+        $questions->setTitle('Questions');
+
+        $this->quizSpreadsheetService->fillQuestionsSheet($questions, $quiz);
+
+        $rawAnswers = $spreadsheet->createSheet();
+        $rawAnswers->setTitle('Raw answers');
+        $this->fillRawAnswersSheet($rawAnswers, $quiz);
+
+        $results = $spreadsheet->createSheet();
+        $results->setTitle('Results');
+        $this->fillResultsSheet($results, $quiz);
+
+        $eliminations = $spreadsheet->createSheet();
+        $eliminations->setTitle('Eliminations');
+        $this->fillEliminationsSheet($eliminations, $quiz);
+
+        $spreadsheet->setActiveSheetIndex(0);
+
+        return $spreadsheet;
+    }
+
+    private function fillQuizInfoSheet(Worksheet $sheet, Quiz $quiz): void
+    {
+        $disabledQuestions = $quiz->questions
+            ->filter(static fn (Question $question): bool => !$question->enabled)
+            ->map(static fn (Question $question): string => $question->question)
+            ->toArray();
+
+        $sheet->getStyle('A:A')->getFont()->setBold(true);
+        $sheet->fromArray([
+            ['Quiz name', $quiz->name],
+            ['Number of dropouts', $quiz->dropouts],
+            ['Finalized', $quiz->isFinalized ? 'Yes' : 'No'],
+            ['Finalized at', $quiz->finalizedAt?->format(\DateTimeInterface::ATOM) ?? ''],
+            ['Disabled questions', implode(', ', $disabledQuestions)],
+        ], null, 'A1');
+        $sheet->getColumnDimension('A')->setAutoSize(true);
+        $sheet->getColumnDimension('B')->setAutoSize(true);
+    }
+
+    private function fillResultsSheet(Worksheet $sheet, Quiz $quiz): void
+    {
+        $sheet->fromArray(['Candidate', 'Correct answers', 'Corrections', 'Penalty (s)', 'Score', 'Time', 'Started', 'Active', 'Deleted'], null, 'A1');
+        $sheet->getStyle('1:1')->getFont()->setBold(true);
+
+        /** @var array<string, Result> $scoresByCandidateId */
+        $scoresByCandidateId = [];
+        foreach ($this->quizRepository->getScores($quiz) as $result) {
+            $scoresByCandidateId[$result->id->toString()] = $result;
+        }
+
+        $row = 2;
+        foreach ($quiz->candidateData as $quizCandidate) {
+            $candidate = $quizCandidate->candidate;
+            $result = $scoresByCandidateId[$candidate->id->toString()] ?? null;
+
+            $sheet->fromArray([
+                $candidate->name,
+                $result?->correct,
+                $result?->corrections,
+                $result?->penaltySeconds,
+                $result?->score,
+                $result instanceof Result ? $result->time->format('%i:%S') : null,
+                $quizCandidate->started?->format(\DateTimeInterface::ATOM),
+                $quizCandidate->active ? 'Yes' : 'No',
+                $quizCandidate->getDeletedAt()?->format(\DateTimeInterface::ATOM) ?? '',
+            ], null, 'A'.$row);
+            ++$row;
+        }
+
+        foreach (range('A', 'I') as $column) {
+            $sheet->getColumnDimension($column)->setAutoSize(true);
+        }
+    }
+
+    /** Raw crosstab: one row per candidate, one column per question, cell = the answer text they gave (bold when correct). */
+    private function fillRawAnswersSheet(Worksheet $sheet, Quiz $quiz): void
+    {
+        /** @var list<Question> $questions */
+        $questions = $quiz->questions->toArray();
+
+        $header = ['Candidate'];
+        foreach ($questions as $question) {
+            $header[] = $question->question;
+        }
+
+        $sheet->fromArray($header, null, 'A1');
+        $sheet->getStyle('1:1')->getFont()->setBold(true);
+        $sheet->getStyle('1:1')->getAlignment()->setWrapText(true);
+
+        /** @var array<string, array<string, string>> $answersByCandidateAndQuestion */
+        $answersByCandidateAndQuestion = [];
+        /** @var array<string, array<string, bool>> $correctnessByCandidateAndQuestion */
+        $correctnessByCandidateAndQuestion = [];
+        foreach ($questions as $question) {
+            foreach ($question->answers as $answer) {
+                foreach ($answer->givenAnswers as $givenAnswer) {
+                    $candidateId = $givenAnswer->candidate->id->toString();
+                    $answersByCandidateAndQuestion[$candidateId][$question->id->toString()] = $answer->text;
+                    $correctnessByCandidateAndQuestion[$candidateId][$question->id->toString()] = $answer->isRightAnswer;
+                }
+            }
+        }
+
+        $row = 2;
+        foreach ($quiz->candidateData as $quizCandidate) {
+            $candidate = $quizCandidate->candidate;
+            $candidateId = $candidate->id->toString();
+
+            $line = [$candidate->name];
+            foreach ($questions as $question) {
+                $line[] = $answersByCandidateAndQuestion[$candidateId][$question->id->toString()] ?? '';
+            }
+
+            $sheet->fromArray($line, null, 'A'.$row);
+
+            foreach ($questions as $columnIndex => $question) {
+                if ($correctnessByCandidateAndQuestion[$candidateId][$question->id->toString()] ?? false) {
+                    $column = Coordinate::stringFromColumnIndex(2 + $columnIndex);
+                    $sheet->getStyle($column.$row)->getFont()->setBold(true);
+                }
+            }
+
+            ++$row;
+        }
+
+        $lastColumnIndex = 1 + \count($questions);
+        foreach ($this->columnLetters($lastColumnIndex) as $column) {
+            $sheet->getColumnDimension($column)->setWidth(30);
+            $sheet->getStyle($column.':'.$column)->getAlignment()->setWrapText(true);
+        }
+    }
+
+    private function fillEliminationsSheet(Worksheet $sheet, Quiz $quiz): void
+    {
+        /** @var list<Candidate> $candidates */
+        $candidates = $quiz->season->candidates->toArray();
+
+        $header = ['Prepared at', 'Deleted'];
+        foreach ($candidates as $candidate) {
+            $header[] = $candidate->name;
+        }
+
+        $sheet->fromArray($header, null, 'A1');
+        $sheet->getStyle('1:1')->getFont()->setBold(true);
+
+        $row = 2;
+        foreach ($quiz->eliminations as $elimination) {
+            $line = [
+                $elimination->getCreatedAt()?->format(\DateTimeInterface::ATOM) ?? '',
+                $elimination->getDeletedAt()?->format(\DateTimeInterface::ATOM) ?? '',
+            ];
+
+            foreach ($candidates as $candidate) {
+                $line[] = $elimination->getScreenColour($candidate->name) ?? '';
+            }
+
+            $sheet->fromArray($line, null, 'A'.$row);
+            ++$row;
+        }
+
+        foreach ($this->columnLetters(2 + \count($candidates)) as $column) {
+            $sheet->getColumnDimension($column)->setAutoSize(true);
+        }
+    }
+
+    private function buildCandidatesWorkbook(Season $season): Spreadsheet
+    {
+        $spreadsheet = new Spreadsheet();
+
+        $candidatesSheet = $spreadsheet->getActiveSheet();
+        $candidatesSheet->setTitle('Candidates');
+        $candidatesSheet->fromArray(['Name'], null, 'A1');
+        $candidatesSheet->getStyle('1:1')->getFont()->setBold(true);
+
+        $row = 2;
+        foreach ($season->candidates as $candidate) {
+            $candidatesSheet->fromArray([$candidate->name], null, 'A'.$row);
+            ++$row;
+        }
+
+        $candidatesSheet->getColumnDimension('A')->setAutoSize(true);
+
+        $infoSheet = $spreadsheet->createSheet();
+        $infoSheet->setTitle('Season info');
+        $infoSheet->getStyle('A:A')->getFont()->setBold(true);
+        $infoSheet->fromArray([
+            ['Season name', $season->name],
+            ['Season code', $season->seasonCode],
+            ['Number of quizzes', $season->quizzes->count()],
+            ['Number of candidates', $season->candidates->count()],
+            ['Active quiz', $season->activeQuiz instanceof Quiz ? $season->activeQuiz->name : ''],
+            ['Show numbers', $season->settings?->showNumbers ? 'Yes' : 'No'],
+            ['Confirm answers', $season->settings?->confirmAnswers ? 'Yes' : 'No'],
+            ['Shared with other owners', $season->owners->count() > 1 ? 'Yes' : 'No'],
+        ], null, 'A1');
+        $infoSheet->getColumnDimension('A')->setAutoSize(true);
+        $infoSheet->getColumnDimension('B')->setAutoSize(true);
+
+        $spreadsheet->setActiveSheetIndex(0);
+
+        return $spreadsheet;
+    }
+
+    private function buildQuestionBankWorkbook(Season $season): Spreadsheet
+    {
+        $spreadsheet = new Spreadsheet();
+
+        $questions = $spreadsheet->getActiveSheet();
+        $questions->setTitle('Questions');
+        $this->fillBankQuestionsSheet($questions, $season);
+
+        $labels = $spreadsheet->createSheet();
+        $labels->setTitle('Labels');
+        $this->fillQuestionLabelsSheet($labels, $season);
+
+        $spreadsheet->setActiveSheetIndex(0);
+
+        return $spreadsheet;
+    }
+
+    private function fillBankQuestionsSheet(Worksheet $sheet, Season $season): void
+    {
+        $metaColumns = ['Question', 'Reusable', 'Complete for quiz', 'Labels', 'Used in quizzes'];
+        $sheet->fromArray($metaColumns, null, 'A1');
+        $sheet->getStyle('1:1')->getFont()->setBold(true);
+
+        $answerStartColumnIndex = \count($metaColumns);
+        $maxAnswers = 0;
+        $row = 2;
+
+        foreach ($season->bankQuestions as $bankQuestion) {
+            $labels = implode(', ', array_map(
+                static fn (QuestionLabel $label): string => $label->name,
+                $bankQuestion->labels->toArray(),
+            ));
+            $usedInQuizzes = implode(', ', array_map(
+                static fn (BankQuestionUsage $usage): string => $usage->quiz->name,
+                $bankQuestion->usages->toArray(),
+            ));
+
+            $sheet->fromArray([
+                $bankQuestion->question,
+                $bankQuestion->reusable ? 'Yes' : 'No',
+                $bankQuestion->isCompleteForQuiz ? 'Yes' : 'No',
+                $labels,
+                $usedInQuizzes,
+            ], null, 'A'.$row);
+
+            $col = 0;
+            foreach ($bankQuestion->answers as $answer) {
+                $sheet->setCellValue(Coordinate::stringFromColumnIndex($answerStartColumnIndex + 1 + 2 * $col).$row, $answer->text);
+                $sheet->setCellValue(Coordinate::stringFromColumnIndex($answerStartColumnIndex + 2 + 2 * $col).$row, $answer->isRightAnswer);
+                ++$col;
+            }
+
+            $maxAnswers = max($maxAnswers, $col);
+            ++$row;
+        }
+
+        for ($i = 0; $i < $maxAnswers; ++$i) {
+            $answerCol = Coordinate::stringFromColumnIndex($answerStartColumnIndex + 1 + 2 * $i);
+            $correctCol = Coordinate::stringFromColumnIndex($answerStartColumnIndex + 2 + 2 * $i);
+
+            $sheet->setCellValue($answerCol.'1', 'Answer '.($i + 1));
+            $sheet->setCellValue($correctCol.'1', 'Correct');
+        }
+
+        $lastColumnIndex = $answerStartColumnIndex + max(1, 2 * $maxAnswers);
+        foreach ($this->columnLetters($lastColumnIndex) as $column) {
+            $sheet->getColumnDimension($column)->setAutoSize(true);
+        }
+    }
+
+    private function fillQuestionLabelsSheet(Worksheet $sheet, Season $season): void
+    {
+        $sheet->fromArray(['Name', 'Colour', 'Slug'], null, 'A1');
+        $sheet->getStyle('1:1')->getFont()->setBold(true);
+
+        $row = 2;
+        foreach ($season->questionLabels as $label) {
+            $sheet->fromArray([$label->name, $label->colour->name, $label->slug], null, 'A'.$row);
+            ++$row;
+        }
+
+        foreach (['A', 'B', 'C'] as $column) {
+            $sheet->getColumnDimension($column)->setAutoSize(true);
+        }
+    }
+
+    /**
+     * Column letters from 'A' up to and including the given 1-based column index.
+     * Unlike range('A', ...), this works past 'Z' (e.g. index 27 => 'AA').
+     *
+     * @return list<string>
+     */
+    private function columnLetters(int $lastColumnIndex): array
+    {
+        $letters = [];
+        for ($columnIndex = 1; $columnIndex <= $lastColumnIndex; ++$columnIndex) {
+            $letters[] = Coordinate::stringFromColumnIndex($columnIndex);
+        }
+
+        return $letters;
+    }
+
+    /** @throws FilesystemException */
+    private function writeToTempFile(Spreadsheet $spreadsheet): string
+    {
+        $path = tempnam(sys_get_temp_dir(), 'tvdt_export_sheet_');
+
+        try {
+            new Writer\Xlsx($spreadsheet)->save($path);
+        } catch (\Throwable $throwable) {
+            unlink($path);
+
+            throw $throwable;
+        }
+
+        return $path;
+    }
+}

src/Service/GitHubReleasesService.php

@@ -0,0 +1,72 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Service;
+
+use Psr\Cache\InvalidArgumentException;
+use Safe\DateTimeImmutable;
+use Safe\Exceptions\SafeExceptionInterface;
+use Symfony\Contracts\Cache\CacheInterface;
+use Symfony\Contracts\Cache\ItemInterface;
+use Symfony\Contracts\HttpClient\Exception\ExceptionInterface;
+use Symfony\Contracts\HttpClient\HttpClientInterface;
+
+final readonly class GitHubReleasesService
+{
+    private const string RELEASES_URL = 'https://api.github.com/repos/MarijnDoeve/TijdVoorDeTest/releases';
+
+    public function __construct(
+        private HttpClientInterface $httpClient,
+        private CacheInterface $cache,
+    ) {}
+
+    /**
+     * @throws InvalidArgumentException
+     *
+     * @return list<array{tagName: string, name: string, publishedAt: ?\DateTimeImmutable, body: string, url: string}>
+     */
+    public function getReleases(): array
+    {
+        return $this->cache->get('github_releases', $this->fetchReleases(...));
+    }
+
+    /** @return list<array{tagName: string, name: string, publishedAt: ?\DateTimeImmutable, body: string, url: string}> */
+    private function fetchReleases(ItemInterface $item, bool &$save): array
+    {
+        try {
+            $response = $this->httpClient->request('GET', self::RELEASES_URL, [
+                'timeout' => 5,
+                'headers' => [
+                    'Accept' => 'application/vnd.github+json',
+                    'User-Agent' => 'TijdVoorDeTest',
+                ],
+            ]);
+
+            /** @var list<array{tag_name: string, name: ?string, published_at: ?string, body: ?string, html_url: string}> $releases */
+            $releases = $response->toArray();
+
+            usort($releases, static fn (array $a, array $b): int => ($b['published_at'] ?? '') <=> ($a['published_at'] ?? ''));
+
+            $result = array_map(static function (array $release): array {
+                $name = $release['name'] ?? '';
+
+                return [
+                    'tagName' => $release['tag_name'],
+                    'name' => '' !== $name ? $name : $release['tag_name'],
+                    'publishedAt' => $release['published_at'] ? new DateTimeImmutable($release['published_at']) : null,
+                    'body' => (string) $release['body'],
+                    'url' => $release['html_url'],
+                ];
+            }, $releases);
+        } catch (ExceptionInterface|SafeExceptionInterface|\DateMalformedStringException) {
+            $save = false;
+
+            return [];
+        }
+
+        $item->expiresAfter(3600);
+
+        return $result;
+    }
+}

src/Service/QuizSpreadsheetService.php

@@ -7,6 +7,7 @@ namespace Tvdt\Service;
 use PhpOffice\PhpSpreadsheet\Cell\Coordinate;
 use PhpOffice\PhpSpreadsheet\Reader;
 use PhpOffice\PhpSpreadsheet\Spreadsheet;
+use PhpOffice\PhpSpreadsheet\Worksheet\Worksheet;
 use PhpOffice\PhpSpreadsheet\Writer;
 use Symfony\Component\HttpFoundation\File\File;
 use Tvdt\Entity\Answer;
@@ -117,8 +118,13 @@ class QuizSpreadsheetService
     public function quizToXlsx(Quiz $quiz): \Closure
     {
         $spreadsheet = new Spreadsheet();
-        $sheet = $spreadsheet->getActiveSheet();
+        $this->fillQuestionsSheet($spreadsheet->getActiveSheet(), $quiz);
 
+        return $this->toXlsx($spreadsheet);
+    }
+
+    public function fillQuestionsSheet(Worksheet $sheet, Quiz $quiz): void
+    {
         // Write data rows first so we know the maximum answer count.
         $maxAnswers = 0;
         $row = 2;
@@ -153,11 +159,9 @@ class QuizSpreadsheetService
             $sheet->setCellValue($correctCol.'1', 'Correct');
             $sheet->getColumnDimension($correctCol)->setAutoSize(true);
         }
-
-        return $this->toXlsx($spreadsheet);
     }
 
-    private function toXlsx(Spreadsheet $spreadsheet): \Closure
+    public function toXlsx(Spreadsheet $spreadsheet): \Closure
     {
         $writer = new Writer\Xlsx($spreadsheet);
 

symfony.lock

@@ -98,6 +98,9 @@
             "tests/bootstrap.php"
         ]
     },
+    "sensiolabs/typescript-bundle": {
+        "version": "v0.2.2"
+    },
     "sentry/sentry-symfony": {
         "version": "5.8",
         "recipe": {
@@ -356,6 +359,18 @@
             "config/routes/web_profiler.yaml"
         ]
     },
+    "symfonycasts/reset-password-bundle": {
+        "version": "1.25",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "1.0",
+            "ref": "97c1627c0384534997ae1047b93be517ca16de43"
+        },
+        "files": [
+            "config/packages/reset_password.yaml"
+        ]
+    },
     "symfonycasts/sass-bundle": {
         "version": "v0.8.2"
     },

templates/backoffice/help/nl/season_candidates.html.twig

@@ -1,3 +1,4 @@
 <h6>Kandidaten</h6>
 <p>Dit zijn de spelers van dit seizoen. Voeg alle deelnemers toe voordat je de eerste test start, kandidaten worden automatisch aan nieuwe testen gekoppeld.</p>
 <p>Namen zijn vrij in te voeren, gebruik dezelfde schrijfwijze die je in het spel gebruikt.</p>
+<p>Gebruik het potlood-icoon om een kandidaat te hernoemen en het prullenbak-icoon om er een te verwijderen. Verwijderen gooit ook alle gegeven antwoorden van die kandidaat weg.</p>

templates/backoffice/help/nl/season_settings.html.twig

@@ -1,3 +1,4 @@
 <h6>Seizoensinstellingen</h6>
 <p>Pas hier de weergave-instellingen van dit seizoen aan.</p>
 <p><strong>Nummers tonen:</strong> toont vraagnummers tijdens de test. <strong>Antwoord bevestigen:</strong> vraagt kandidaten om hun antwoord te bevestigen voordat ze doorgaan.</p>
+<p><strong>Seizoenscode:</strong> de code waarmee kandidaten dit seizoen kunnen vinden. Genereer een nieuwe code als de huidige per ongeluk gedeeld is, de oude code werkt daarna niet meer.</p>

templates/backoffice/login/login.html.twig

@@ -4,7 +4,7 @@
 
 {% block body %}
     <form method="post">
-        <h1 class="py-2 h3 mb-3 font-weight-normal">{{ 'Please sign in'|trans }}</h1>
+        <h3 class="mb-3">{{ 'Please sign in'|trans }}</h3>
         <div class="mb-3">
             <label for="username" class="form-label">{{ 'Email'|trans }}</label>
             <input type="email" value="{{ last_username }}" name="_username" id="username" class="form-control"
@@ -31,5 +31,7 @@
         </button>
         <a href="{{ path('tvdt_register') }}"
            class="btn btn-link">{{ 'Create an account'|trans }}</a>
+        <a href="{{ path('tvdt_forgot_password_request') }}"
+           class="btn btn-link">{{ 'Forgot your password?'|trans }}</a>
     </form>
 {% endblock %}

templates/backoffice/nav.html.twig

@@ -10,9 +10,9 @@
                 aria-label="Toggle navigation">
             <span class="navbar-toggler-icon"></span>
         </button>
-        {% if is_granted('IS_AUTHENTICATED') %}
         <div class="collapse navbar-collapse" id="navbarSupportedContent">
             <ul class="navbar-nav me-auto mb-2 mb-lg-0">
+                {% if is_granted('IS_AUTHENTICATED') %}
                     <li class="nav-item">
                         <a class="nav-link{% if 'tvdt_backoffice_index' == app.current_route() %} active{% endif %}"
                            href="{{ path('tvdt_backoffice_index') }}">{{ 'Seasons'|trans }}</a>
@@ -21,14 +21,37 @@
                         <a class="nav-link"
                            href="{{ path('tvdt_backoffice_template') }}">{{ 'Download Template'|trans }}</a>
                     </li>
+                {% endif %}
             </ul>
             <ul class="navbar-nav mb-auto me-2 me-lg-0">
+                <li class="nav-item" data-controller="bo--modal"
+                    data-action="turbo:submit-end->bo--modal#frameSubmitEnd">
+                    <button type="button" class="nav-link border-0 bg-transparent"
+                            data-action="click->bo--modal#open"
+                            data-src="{{ path('tvdt_backoffice_releases') }}"
+                            data-modal-title="{{ 'Releases'|trans }}">{{ 'Releases'|trans }}</button>
+
+                    <div class="modal fade" tabindex="-1" data-bo--modal-target="modal"
+                         data-action="hidden.bs.modal->bo--modal#resetDirty"
+                         aria-labelledby="releasesModalLabel" aria-hidden="true">
+                        <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                            <div class="modal-content">
+                                <turbo-frame id="releases-modal-frame" data-bo--modal-target="frame"></turbo-frame>
+                            </div>
+                        </div>
+                    </div>
+                </li>
+                {% if is_granted('IS_AUTHENTICATED') %}
+                    <li class="nav-item">
+                        <a class="nav-link{% if 'tvdt_backoffice_settings' == app.current_route() %} active{% endif %}"
+                           href="{{ path('tvdt_backoffice_settings') }}">{{ 'Settings'|trans }}</a>
+                    </li>
                     <li class="nav-item">
                         <a class="nav-link"
                            href="{{ path('tvdt_login_logout') }}">{{ 'Logout'|trans }}</a>
                     </li>
+                {% endif %}
             </ul>
         </div>
-        {% endif %}
     </div>
 </nav>

templates/backoffice/quiz/tab_candidates_list.html.twig

@@ -37,7 +37,7 @@
                     {% endif %}
                 </td>
                 <td>
-                    <form action="{{ path('tvdt_backoffice_toggle_candidate', {quiz: quiz.id, candidate: candidate.id}) }}" method="POST">
+                    <form action="{{ path('tvdt_backoffice_toggle_candidate', {quiz: quiz.id, candidate: candidate.id}) }}" method="POST" class="d-inline">
                         <input type="hidden" name="_token" value="{{ csrf_token('toggle_candidate') }}">
                         <button type="submit" class="btn btn-sm btn-outline-secondary">
                             {% if quizCandidate == null or quizCandidate.active %}
@@ -47,6 +47,12 @@
                             {% endif %}
                         </button>
                     </form>
+                    {% if quizCandidate and quizCandidate.started %}
+                        <form action="{{ path('tvdt_backoffice_reset_candidate_progress', {quiz: quiz.id, candidate: candidate.id}) }}" method="POST" class="d-inline" onsubmit="return confirm('{{ 'Are you sure you want to reset progress for this candidate? Their given answers for this quiz will be deleted.'|trans|e('js') }}');">
+                            <input type="hidden" name="_token" value="{{ csrf_token('reset_candidate_progress') }}">
+                            <button type="submit" class="btn btn-sm btn-outline-danger">{{ 'Reset progress'|trans }}</button>
+                        </form>
+                    {% endif %}
                 </td>
             </tr>
         {% endfor %}

templates/backoffice/registration/confirmation_email.html.twig

@@ -1,11 +1,22 @@
-<h1>Hi! Please confirm your email!</h1>
+{% extends 'emails/layout.html.twig' %}
 
-<p>
+{% block preheader %}Bevestig je e-mailadres voor Tijd voor de test.{% endblock %}
-    Please confirm your email address by clicking the following link: <br><br>
+
-    <a href="{{ signedUrl|raw }}">Confirm my Email</a>.
+{% block heading %}Nog één stap voor je mee mag doen{% endblock %}
-    This link will expire in {{ expiresAtMessageKey|trans(expiresAtMessageData, 'VerifyEmailBundle') }}.
+
+{% block body %}
+    <p class="text">Beste speler,</p>
+    <p class="text">
+        Welkom bij Tijd voor de test! Voor je echt aan de slag kunt, moeten we nog één ding
+        weten: of jij écht bent wie je zegt dat je bent. Klik daarom op de knop hieronder.
     </p>
 
-<p>
+    <center><button href="{{ signedUrl|raw }}">Bevestig e-mailadres</button></center>
-    Cheers!
+
+    <p class="text">
+        Deze link verloopt over {{ expiresAtMessageKey|trans(expiresAtMessageData, 'VerifyEmailBundle') }}, dus
+        wacht niet te lang.
     </p>
+
+    <p class="text">Veel plezier!</p>
+{% endblock %}

templates/backoffice/registration/register.html.twig

@@ -2,7 +2,7 @@
 {% block title %}{{ 'Register'|trans }}{% endblock %}
 
 {% block body %}
-    <h3>{{ 'Register'|trans }}</h3>
+    <h3 class="mb-3">{{ 'Register'|trans }}</h3>
 
     {{ form_errors(registrationForm) }}
 

templates/backoffice/releases/_frame.html.twig

@@ -0,0 +1,40 @@
+<turbo-frame id="releases-modal-frame">
+    <div class="modal-header">
+        <h1 class="modal-title fs-5" id="releasesModalLabel">
+            {{ 'Releases'|trans }}
+            {% if releases[0] is defined %}
+                <span class="text-muted fs-6 ms-2">{{ 'Current version'|trans }}: {{ releases[0].tagName }}</span>
+            {% endif %}
+        </h1>
+        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+    </div>
+    <div class="modal-body">
+        {% if releases is empty %}
+            <p class="text-muted mb-0">{{ 'Could not load releases from GitHub.'|trans }}</p>
+        {% else %}
+            <div class="accordion" id="releasesAccordion">
+                {% for release in releases %}
+                    <div class="accordion-item">
+                        <h2 class="accordion-header">
+                            <button class="accordion-button{% if not loop.first %} collapsed{% endif %}" type="button"
+                                    data-bs-toggle="collapse" data-bs-target="#release-{{ loop.index }}">
+                                {{ release.name }}
+                                {% if release.publishedAt %}
+                                    <span class="text-muted ms-2 small">{{ release.publishedAt|date('d-m-Y', 'UTC') }}</span>
+                                {% endif %}
+                            </button>
+                        </h2>
+                        <div id="release-{{ loop.index }}"
+                             class="accordion-collapse collapse{% if loop.first %} show{% endif %}"
+                             data-bs-parent="#releasesAccordion">
+                            <div class="accordion-body">
+                                <div class="release-notes">{{ release.body|markdown_to_html }}</div>
+                                <a href="{{ release.url }}" target="_blank" rel="noopener noreferrer" class="small">{{ 'View on GitHub'|trans }}</a>
+                            </div>
+                        </div>
+                    </div>
+                {% endfor %}
+            </div>
+        {% endif %}
+    </div>
+</turbo-frame>

templates/backoffice/season/_add_candidates_frame.html.twig

@@ -0,0 +1,11 @@
+<turbo-frame id="add-candidates-modal-frame">
+    {{ form_start(form, {attr: {novalidate: 'novalidate'}}) }}
+    <div class="modal-body">
+        {{ form_row(form.candidates) }}
+    </div>
+    <div class="modal-footer">
+        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'Cancel'|trans }}</button>
+        <button type="submit" class="btn btn-primary">{{ 'Submit'|trans }}</button>
+    </div>
+    {{ form_end(form) }}
+</turbo-frame>

templates/backoffice/season/tab_candidates.html.twig

@@ -1,16 +1,96 @@
-<div class="row">
+<div class="row" data-controller="bo--modal" data-action="turbo:submit-end->bo--modal#frameSubmitEnd">
     <div class="col-md-6 col-12">
         <div class="mb-3">
-            <a class="btn btn-sm btn-outline-primary"
+            <button type="button" class="btn btn-sm btn-outline-primary"
-               href="{{ path('tvdt_backoffice_add_candidates', {seasonCode: season.seasonCode}) }}">{{ 'Add Candidate'|trans }}</a>
+                    data-action="click->bo--modal#open"
+                    data-src="{{ path('tvdt_backoffice_add_candidates', {seasonCode: season.seasonCode}) }}"
+                    data-modal-title="{{ 'Add Candidate'|trans }}">{{ 'Add Candidate'|trans }}</button>
         </div>
-        <ul class="mb-3">
+        <ul class="list-group mb-3">
             {% for candidate in season.candidates %}
-                <li>{{ candidate.name }}</li>
+                <li class="list-group-item d-flex align-items-center justify-content-between gap-2">
+                    {{ candidate.name }}
+                    <div class="btn-group btn-group-sm" role="group">
+                        <button type="button" class="btn btn-outline-secondary" data-bs-toggle="modal"
+                                data-bs-target="#renameCandidate-{{ candidate.id }}"
+                                title="{{ 'Rename'|trans }}"><i class="bi bi-pencil"></i></button>
+                        <button type="button" class="btn btn-outline-danger" data-bs-toggle="modal"
+                                data-bs-target="#deleteCandidate-{{ candidate.id }}"
+                                title="{{ 'Delete'|trans }}"><i class="bi bi-trash"></i></button>
+                    </div>
+
+                    <div class="modal fade" id="renameCandidate-{{ candidate.id }}"
+                         data-controller="bo--modal" data-bo--modal-target="modal"
+                         data-action="hidden.bs.modal->bo--modal#resetDirty"
+                         tabindex="-1" aria-labelledby="renameCandidate-{{ candidate.id }}Label" aria-hidden="true">
+                        <div class="modal-dialog">
+                            <div class="modal-content">
+                                <form action="{{ path('tvdt_backoffice_candidate_rename', {seasonCode: season.seasonCode, candidate: candidate.id}) }}"
+                                      method="POST">
+                                    <div class="modal-header">
+                                        <h1 class="modal-title fs-5" id="renameCandidate-{{ candidate.id }}Label">{{ 'Rename candidate'|trans }}</h1>
+                                        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                                    </div>
+                                    <div class="modal-body text-start">
+                                        <input type="hidden" name="_token" value="{{ csrf_token('rename_candidate') }}">
+                                        <label class="form-label" for="renameCandidateName-{{ candidate.id }}">{{ 'Name'|trans }}</label>
+                                        <input type="text" class="form-control" id="renameCandidateName-{{ candidate.id }}"
+                                               name="name" value="{{ candidate.name }}" maxlength="16" required autofocus
+                                               data-action="input->bo--modal#markDirty change->bo--modal#markDirty">
+                                    </div>
+                                    <div class="modal-footer">
+                                        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'Cancel'|trans }}</button>
+                                        <button type="submit" class="btn btn-primary">{{ 'Rename'|trans }}</button>
+                                    </div>
+                                </form>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="modal fade" id="deleteCandidate-{{ candidate.id }}" data-bs-backdrop="static"
+                         tabindex="-1" aria-labelledby="deleteCandidate-{{ candidate.id }}Label" aria-hidden="true">
+                        <div class="modal-dialog">
+                            <div class="modal-content">
+                                <div class="modal-header">
+                                    <h1 class="modal-title fs-5" id="deleteCandidate-{{ candidate.id }}Label">{{ 'Please Confirm'|trans }}</h1>
+                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                                </div>
+                                <div class="modal-body text-start">
+                                    {{ 'Are you sure you want to delete this candidate? All their answers will be lost.'|trans }}
+                                </div>
+                                <div class="modal-footer">
+                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'No'|trans }}</button>
+                                    <form action="{{ path('tvdt_backoffice_candidate_delete', {seasonCode: season.seasonCode, candidate: candidate.id}) }}"
+                                          method="POST">
+                                        <input type="hidden" name="_token" value="{{ csrf_token('delete_candidate') }}">
+                                        <button type="submit" class="btn btn-danger">{{ 'Yes'|trans }}</button>
+                                    </form>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </li>
             {% else %}
                 {{ 'No candidates'|trans }}
             {% endfor %}
         </ul>
+
+        <div class="modal fade" tabindex="-1"
+             data-bo--modal-target="modal"
+             data-action="hidden.bs.modal->bo--modal#resetDirty"
+             aria-labelledby="addCandidatesModalLabel" aria-hidden="true">
+            <div class="modal-dialog">
+                <div class="modal-content">
+                    <div class="modal-header">
+                        <h1 class="modal-title fs-5" id="addCandidatesModalLabel">{{ 'Add Candidate'|trans }}</h1>
+                        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                    </div>
+                    <turbo-frame id="add-candidates-modal-frame"
+                                 data-bo--modal-target="frame"
+                                 data-action="input->bo--modal#markDirty change->bo--modal#markDirty"></turbo-frame>
+                </div>
+            </div>
+        </div>
     </div>
     <div class="col-md-6 col-12">
         {{ include('backoffice/help/season_candidates.html.twig') }}

templates/backoffice/season/tab_settings.html.twig

@@ -1,8 +1,40 @@
 <div class="row">
     <div class="col-md-6 col-12">
         {{ form(form) }}
+
+        <hr>
+
+        <h4 class="text-danger">{{ 'Season code'|trans }}</h4>
+        <p>{{ 'The season code is used by candidates to join this season. Regenerating it invalidates the current code, so make sure to share the new one.'|trans }}</p>
+        <p><strong>{{ 'Current code:'|trans }}</strong> {{ season.seasonCode }}</p>
+        <button type="button" class="btn btn-danger" data-bs-toggle="modal" data-bs-target="#regenerateSeasonCodeModal">
+            {{ 'Regenerate season code...'|trans }}
+        </button>
     </div>
     <div class="col-md-6 col-12">
         {{ include('backoffice/help/season_settings.html.twig') }}
     </div>
 </div>
+
+<div class="modal fade" id="regenerateSeasonCodeModal" data-bs-backdrop="static"
+     tabindex="-1"
+     aria-labelledby="regenerateSeasonCodeModalLabel" aria-hidden="true">
+    <div class="modal-dialog">
+        <div class="modal-content">
+            <form action="{{ path('tvdt_backoffice_season_regenerate_code', {seasonCode: season.seasonCode}) }}" method="POST">
+                <div class="modal-header">
+                    <h1 class="modal-title fs-5" id="regenerateSeasonCodeModalLabel">{{ 'Regenerate season code'|trans }}</h1>
+                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                </div>
+                <div class="modal-body">
+                    <p>{{ 'This invalidates the current season code. Anyone using the old code will no longer be able to join this season.'|trans }}</p>
+                    <input type="hidden" name="_token" value="{{ csrf_token('regenerate_season_code') }}">
+                </div>
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'Cancel'|trans }}</button>
+                    <button type="submit" class="btn btn-danger">{{ 'Regenerate season code'|trans }}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>

templates/backoffice/season/tab_tests.html.twig

@@ -8,11 +8,13 @@
         </div>
         <div class="list-group mb-3">
             {% for quiz in season.quizzes %}
-                <a class="list-group-item list-group-item-action{% if season.activeQuiz == quiz %} active{% endif %}"
+                <a class="list-group-item list-group-item-action d-flex align-items-center gap-2{% if season.activeQuiz == quiz %} active{% endif %}"
                    href="{{ path('tvdt_backoffice_quiz', {seasonCode: season.seasonCode, quiz: quiz.id}) }}">
                     {{ quiz.name }}
-                    {% if quiz.isFinalized %}
+                    {% if season.activeQuiz == quiz %}
-                        <span class="badge text-bg-success">{{ 'Finalized'|trans }}</span>
+                        <span class="badge text-bg-light ms-auto">{{ 'Active'|trans }}</span>
+                    {% elseif quiz.isFinalized %}
+                        <span class="badge text-bg-success ms-auto">{{ 'Ready'|trans }}</span>
                     {% endif %}
                 </a>
             {% else %}

templates/backoffice/settings/index.html.twig

@@ -0,0 +1,102 @@
+{% extends 'backoffice/base.html.twig' %}
+
+{% block title %}{{ parent() }}{{ 'Settings'|trans }}{% endblock %}
+
+{% block breadcrumbs %}
+    <nav aria-label="breadcrumb" class="mb-3">
+        <ol class="breadcrumb">
+            <li class="breadcrumb-item"><a href="{{ path('tvdt_backoffice_index') }}">{{ 'Home'|trans }}</a></li>
+            <li class="breadcrumb-item active" aria-current="page">{{ 'Settings'|trans }}</li>
+        </ol>
+    </nav>
+{% endblock %}
+
+{% block body %}
+    <div class="row">
+        <div class="col-lg-6 col-12">
+            <h2 class="mb-4">{{ 'Settings'|trans }}</h2>
+
+            <section class="mb-5">
+                <h4>{{ 'Language'|trans }}</h4>
+                <form action="{{ path('tvdt_backoffice_settings_language') }}" method="POST">
+                    <input type="hidden" name="_token" value="{{ csrf_token('settings_language') }}">
+                    <div class="mb-3">
+                        <label class="form-label" for="settings-language">{{ 'Language'|trans }}</label>
+                        <select class="form-select" id="settings-language" name="language">
+                            <option value="nl" selected>Nederlands</option>
+                        </select>
+                    </div>
+                    <button type="submit" class="btn btn-primary">{{ 'Save'|trans }}</button>
+                </form>
+            </section>
+
+            <section class="mb-5">
+                <h4>{{ 'Change password'|trans }}</h4>
+                {{ form(passwordForm, {action: path('tvdt_backoffice_settings_password')}) }}
+            </section>
+
+            <section class="mb-5">
+                <h4>{{ 'Change email'|trans }}</h4>
+                <p class="mb-1">
+                    <strong>{{ 'Current email address:'|trans }}</strong> {{ app.user.userIdentifier }}
+                    {% if app.user.isVerified %}
+                        <span class="badge text-bg-success">{{ 'Confirmed'|trans }}</span>
+                    {% else %}
+                        <span class="badge text-bg-warning">{{ 'Not confirmed'|trans }}</span>
+                        <form class="d-inline" action="{{ path('tvdt_backoffice_settings_resend_confirmation') }}" method="POST">
+                            <input type="hidden" name="_token" value="{{ csrf_token('resend_confirmation') }}">
+                            <button type="submit" class="btn btn-link btn-sm p-0 align-baseline">
+                                {{ 'Resend confirmation email'|trans }}
+                            </button>
+                        </form>
+                    {% endif %}
+                </p>
+                <p>{{ 'After changing your email address you will receive a new confirmation email.'|trans }}</p>
+                {{ form(emailForm, {action: path('tvdt_backoffice_settings_email')}) }}
+            </section>
+
+            <section class="mb-5">
+                <h4>{{ 'Your data'|trans }}</h4>
+                <p>{{ 'Download an archive of everything stored under your account: your profile, the seasons you own, their quizzes, results and candidates.'|trans }}</p>
+                {% if not app.user.isVerified %}
+                    <p class="text-warning">{{ 'Confirm your email address to enable this feature.'|trans }}</p>
+                {% endif %}
+                <a class="btn btn-primary" href="{{ path('tvdt_backoffice_settings_download_data') }}">{{ 'Download data'|trans }}</a>
+            </section>
+
+            <section class="mb-5">
+                <h4 class="text-danger">{{ 'Danger zone'|trans }}</h4>
+                <p>{{ 'Deleting your account also deletes every season you are the only owner of. This cannot be undone.'|trans }}</p>
+                <button type="button" class="btn btn-danger" data-bs-toggle="modal" data-bs-target="#deleteAccountModal">
+                    {{ 'Delete account...'|trans }}
+                </button>
+            </section>
+        </div>
+    </div>
+
+    <div class="modal fade" id="deleteAccountModal" data-bs-backdrop="static"
+         tabindex="-1"
+         aria-labelledby="deleteAccountModalLabel" aria-hidden="true">
+        <div class="modal-dialog">
+            <div class="modal-content">
+                <form action="{{ path('tvdt_backoffice_settings_delete') }}" method="POST">
+                    <div class="modal-header">
+                        <h1 class="modal-title fs-5" id="deleteAccountModalLabel">{{ 'Delete account'|trans }}</h1>
+                        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                    </div>
+                    <div class="modal-body">
+                        <p>{{ 'This deletes your account and every season you are the only owner of. Enter your password to confirm.'|trans }}</p>
+                        <input type="hidden" name="_token" value="{{ csrf_token('delete_account') }}">
+                        <label class="form-label" for="delete-account-password">{{ 'Current password'|trans }}</label>
+                        <input type="password" class="form-control" id="delete-account-password"
+                               name="password" required autocomplete="current-password">
+                    </div>
+                    <div class="modal-footer">
+                        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'Cancel'|trans }}</button>
+                        <button type="submit" class="btn btn-danger">{{ 'Delete account'|trans }}</button>
+                    </div>
+                </form>
+            </div>
+        </div>
+    </div>
+{% endblock %}

templates/emails/layout.html.twig

@@ -0,0 +1,168 @@
+{% apply inline_css %}
+{% apply inky_to_html %}
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{% block title %}Tijd voor de test{% endblock %}</title>
+    <style>
+        body, table, td { font-family: Arial, Helvetica, sans-serif; }
+        body {
+            margin: 0;
+            padding: 0;
+            width: 100% !important;
+            background-color: #f2f4f1;
+            color: #22281f;
+        }
+        table { border-collapse: collapse; }
+        img { border: 0; }
+        a { color: #2d7a1f; }
+
+        .body-table { width: 100%; background-color: #f2f4f1; }
+
+        .container { width: 100%; max-width: 580px; }
+
+        .header > tbody > tr > th { padding: 28px 24px 20px 24px; text-align: center; }
+
+        .brand-table { margin: 0 auto; }
+        .square-cell { width: 18px; }
+        .square {
+            width: 18px !important;
+            height: 18px !important;
+            max-width: 18px;
+            min-width: 18px;
+            max-height: 18px;
+            min-height: 18px;
+            font-size: 0;
+            line-height: 1px;
+            border-radius: 4px;
+            background-color: #6abf4b;
+        }
+        .square-gap { width: 10px; font-size: 0; line-height: 1px; }
+        .brand {
+            font-size: 20px;
+            font-weight: bold;
+            letter-spacing: 0.5px;
+            color: #17321a;
+            white-space: nowrap;
+        }
+
+        .content-wrapper { background-color: #f2f4f1; }
+        .content-wrapper > tbody > tr > th { padding: 24px 28px; }
+
+        .card {
+            background-color: #ffffff;
+            border-radius: 8px;
+            border: 1px solid #e1e6dd;
+        }
+        .card td.card-inner { padding: 32px; }
+
+        h1.heading {
+            margin: 0 0 16px 0;
+            font-size: 21px;
+            line-height: 1.3;
+            color: #17321a;
+        }
+
+        p.text {
+            margin: 0 0 16px 0;
+            font-size: 15px;
+            line-height: 1.6;
+            color: #3a4239;
+        }
+        p.text:last-child { margin-bottom: 0; }
+
+        .button { margin: 8px auto 12px auto; width: auto !important; }
+        .button table { width: auto; margin: 0 auto; }
+        .button td { border-radius: 5px; background: #2d7a1f; }
+        .button a {
+            background: #2d7a1f;
+            color: #ffffff !important;
+            border-radius: 5px;
+            display: inline-block;
+            padding: 12px 26px;
+            font-size: 15px;
+            font-weight: bold;
+            text-decoration: none;
+            border: 1px solid #2d7a1f;
+        }
+
+        .h-line th { border-bottom: 1px solid #e1e6dd; height: 1px; font-size: 0; line-height: 0; }
+
+        .footer > tbody > tr > th { padding: 24px 28px 32px 28px; text-align: center; }
+        .footer p {
+            margin: 0;
+            font-size: 12px;
+            line-height: 1.6;
+            color: #8b9186;
+        }
+
+        .preheader {
+            display: none !important;
+            visibility: hidden;
+            opacity: 0;
+            color: transparent;
+            height: 0;
+            width: 0;
+            font-size: 1px;
+            line-height: 1px;
+            max-height: 0;
+            max-width: 0;
+            overflow: hidden;
+            mso-hide: all;
+        }
+    </style>
+</head>
+<body>
+<span class="preheader">{% block preheader %}{% endblock %}</span>
+<table class="body-table" role="presentation">
+    <tr>
+        <td align="center">
+            <container>
+                <row class="header">
+                    <columns small="12" large="12" no-expander="true">
+                        <table class="brand-table" role="presentation" align="center">
+                            <tr>
+                                <td class="square-cell" valign="middle">
+                                    <table role="presentation" width="18" height="18" style="width: 18px !important; height: 18px !important; max-width: 18px; min-width: 18px;">
+                                        <tr style="height: 18px !important;">
+                                            <td class="square" width="18" height="18" style="width: 18px !important; height: 18px !important; max-width: 18px; min-width: 18px; max-height: 18px; min-height: 18px;">&nbsp;</td>
+                                        </tr>
+                                    </table>
+                                </td>
+                                <td class="square-gap">&nbsp;</td>
+                                <td class="brand" valign="middle">Tijd voor de test</td>
+                            </tr>
+                        </table>
+                    </columns>
+                </row>
+
+                <row class="content-wrapper">
+                    <columns small="12" large="12" class="content" no-expander="true">
+                        <table class="card" role="presentation" width="100%">
+                            <tr>
+                                <td class="card-inner">
+                                    <h1 class="heading">{% block heading %}{% endblock %}</h1>
+                                    {% block body %}{% endblock %}
+                                </td>
+                            </tr>
+                        </table>
+                    </columns>
+                </row>
+
+                <row class="footer">
+                    <columns small="12" large="12" no-expander="true">
+                        <h-line></h-line>
+                        <spacer size="16"></spacer>
+                        {% block footer_extra %}{% endblock %}
+                    </columns>
+                </row>
+            </container>
+        </td>
+    </tr>
+</table>
+</body>
+</html>
+{% endapply %}
+{% endapply %}

templates/quiz/base.html.twig

@@ -1,3 +1,13 @@
 {% extends 'base.html.twig' %}
 {% block importmap %}{{ importmap('quiz') }}{% endblock %}
 {% block nav %}{{ include('quiz/nav.html.twig') }}{% endblock %}
+{% block main %}
+    <div data-controller="fullscreen">
+        <button type="button"
+                class="fullscreen-btn"
+                data-action="fullscreen#toggle"
+                aria-label="{{ 'Fullscreen'|trans }}"
+                title="{{ 'Fullscreen'|trans }}">⛶</button>
+        {{ parent() }}
+    </div>
+{% endblock %}

templates/quiz/nav.html.twig

@@ -4,7 +4,7 @@
             <a href="{{ path('tvdt_backoffice_index') }}" class="btn btn-outline-secondary btn-sm">
                 {{ 'Backoffice'|trans }}
             </a>
-            <a href="{{ path('tvdt_login_logout') }}" class="btn btn-outline-secondary btn-sm">
+            <a href="{{ path('tvdt_login_logout', {target: app.request.pathInfo}) }}" class="btn btn-outline-secondary btn-sm">
                 {{ 'Logout'|trans }}
             </a>
         {% else %}

templates/reset_password/check_email.html.twig

@@ -0,0 +1,16 @@
+{% extends 'backoffice/base.html.twig' %}
+
+{% block title %}E-mail verstuurd{% endblock %}
+
+{% block body %}
+    <h3 class="mb-3">{{ 'Check your email'|trans }}</h3>
+
+    <p>
+        {{ 'If an account matching your email exists, then an email was just sent that contains a link that you can use to reset your password.'|trans }}
+        {{ 'This link will expire in %count%.'|trans({'%count%': resetToken.expirationMessageKey|trans(resetToken.expirationMessageData, 'ResetPasswordBundle')}) }}
+    </p>
+    <p>
+        {{ 'If you don\'t receive an email please check your spam folder or'|trans }}
+        <a href="{{ path('tvdt_forgot_password_request') }}">{{ 'try again'|trans }}</a>.
+    </p>
+{% endblock %}