chore(main): Release v9.27.0-rc.1

[github-actions]

🤖 I have created a release beep boop

9.27.0-rc.1 (2026-10-06)

Features

• auth: route the GET /api/v1/auth login to server-nestjs (cef4b7c)
• nginx-strangler: router la connexion /api/v1/auth vers server-nestjs (2e04658)
• nginx-strangler: router les stages vers server-nestjs (703baff)
• server-nestjs: add Sécurité Plateforme admin role (e1e6074), closes #2792
• server-nestjs: migrate stages (febeee4)

Bug Fixes

• admin-token: coerce contract expirationDate to Date at the service boundary (53e2616)
• admin-token: drop invalid guard metadata specs (dfcaef1)
• admin-token: optional withRevoked, service-level expiration check, module wiring (dfabc49), closes #1889
• admin-token: update fixture import after inlining (601f1e3)
• project: reject already archived projects (b17a159), closes #2757
• server-nestjs: provide UserPermissionService to StageModule (9ba8cda)
• server-nestjs: resolve multi-path auditor groups in GitLab mapping (bf68401), closes #2792
• server-nestjs: wire AuthModule into StageModule (2052fe8)
• server: backport role backfill migrations to the apps/server tree (c585483), closes #2812
• server: tighten role backfill anti-join to the role level (9eefb75)
• stage: drop invalid guard metadata specs and never casts (4d048d7)
• stage: drop the remaining guard metadata spec (45024aa)
• stage: restrict UserGuard to the protected routes (ae3ded5)
• stage: validate stage params as UUIDs before Prisma (ff8a96e)
• user: emit canonical AdminRoleEventPayload and type controller inputs (88f80c8)
• user: emit canonical AdminRoleEventPayload and type controller inputs (dd8e247)
• user: legacy 400 on unknown admin role, matching take:5, hook union semantics (ccc6db7)
• user: legacy 400 on unknown admin role, matching take:5, hook union semantics (d87dfae)
• user: purge dead create path and lock legacy parity (d5e0ec9)
• user: purge dead create path and lock legacy parity (4faf39e)
• user: restrict UserGuard to list and patch routes (a14eb1f)
• user: use the projectMembers relation key in memberOfIds filter (1fc04ab)
• user: use the projectMembers relation key in memberOfIds filter (84b7758)
• vault: avoid double slash in KV list path for Vault 2.0 (5eeccba)
• zone: accept null log projectId and validate zone UUID params (1062929)

Miscellaneous Chores

• admin-token: drop tooling tag from test comment (750fdb4)
• refine GitHub issue templates (b5d418e), closes #2239
• update GitHub issue and MR templates (f356cab), closes #2239
• user: drop section divider comments (9d487dc)
• user: drop section divider comments (aafa6c1)

Refactoring

• admin-token: accept owner overrides in makeAdminToken (b203914)
• admin-token: align queries types with Record naming (c8fc77f)
• admin-token: assemble exposed token in controller (87a7aef)
• admin-token: extract makeAdminTokenOwner from makeAdminToken (dea84e3)
• admin-token: extract makeAdminTokenOwner from makeAdminToken (50a322d)
• admin-token: extract status filter into helper (5320207)
• admin-token: inline listed-token fixture at its single call site (e9804b6)
• admin-token: inline transaction client type (680806f)
• admin-token: move permissions mapping to controller (740938d)
• admin-token: name the token row fixture type (64612d6)
• admin-token: rename AdminTokenRow to AdminTokenRecordWithHash (7af2fee)
• admin-token: rename record type to AdminToken (d160220)
• admin-token: rename test factory to makeAdminToken (1ca89ea)
• admin-token: share spec factories in testing utils, drop ReturnType aliases (d4964f2)
• admin-token: simplify makeAdminTokenRecord overrides to Partial (78ebc6a)
• admin-token: split row and selected-payload token fixtures (668c42d)
• client: type request bodies via shared contract aliases (5729b71)
• shared: drop duplicate CreateAdminTokenBody export in favor of contract alias (cadd8e2)
• sonarqube: use DeepMockProxy instead of ReturnType alias (7efc86b)
• stage: aligner le module sur les remarques de revue (519e87c), closes #2493
• stage: drop redundant Query import aliases (d256868)
• stage: englober les écritures multi-requêtes dans une transaction (f26117b), closes #2493
• stage: migrate module from server (1de9ff6)
• stage: move record mappers to controller, service returns records (fc7923e)
• stage: remove unused StageRecord import (73b6932)
• stage: return records from service, map to contract in controller (5461b77)
• stage: reuse cluster and environment test factories (e80e46d)
• stage: reuse makeUser for the owner fixture (00eebae)
• user: batch AND filters into single pushes (0cd239c)
• user: move the letters filter inside its guard (1788a22)
• user: realigner structure et style du module (8d222f2), closes #2738
• user: realigner structure et style du module (358dbbf), closes #2738
• user: remove reflection-only permissions metadata check (efaa652)
• user: remove reflection-only permissions metadata check (d500398)
• user: retirer l'alias AllUsersQuery au profit du schéma (12f4b22), closes #1889
• user: retirer l'alias AllUsersQuery au profit du schéma (40025ca), closes #1889
• user: strangler offload routes to server-nestjs (37b9a19)
• zone: drop event-helper comment (58285b3)
• zone: map records to contract in controller (529c44a)
• zone: name the update body schema in shared (c296f95)
• zone: name the zone record type in service specs (9002da9)

---

This PR was generated with Release Please. See documentation.

[StephaneTrebel]

Le manifeste, les quatre versions de package et le changelog sont cohérents avec la plage v9.27.0-rc..v9.27.0-rc.1 et les commits livrés. CI verte, aucun fil ouvert ; cette MR générée ne porte pas de ledger DoD direct.

[StephaneTrebel]

Le manifeste, les quatre versions de package et le changelog sont cohérents avec la plage v9.27.0-rc..v9.27.0-rc.1, qui contient les cinq commits listés. CI verte et aucun fil ouvert ; cette MR générée ne porte pas de ledger DoD direct.

[StephaneTrebel]

Le manifeste, les quatre versions de package et le changelog sont cohérents avec les sept commits entre v9.27.0-rc et le parent de cette MR. Branche à jour et contrôles disponibles au vert ; aucun ledger DoD direct pour cette MR générée.

[StephaneTrebel]

Le manifeste, les quatre versions de package et le changelog sont cohérents avec la plage v9.27.0-rc...v9.27.0-rc.1 et le HEAD courant de main. Les contrôles disponibles sont au vert et cette MR générée ne porte pas de ledger DoD direct.

[StephaneTrebel]

Le manifeste, les quatre versions de package et le changelog sont cohérents avec la plage v9.27.0-rc...v9.27.0-rc.1 et les commits livrés. Aucun fil n’est ouvert et tous les contrôles disponibles sur cette MR générée sont au vert.