fix(ical): fiabiliser le parsing Pronote 2026

.env.example

@@ -50,7 +50,11 @@ XMPP_HOST=example.com
 XMPP_PORT=5222
 XMPP_TO=parent@example.com
 XMPP_RESOURCE=pronote-sync
-XMPP_USE_TLS=true
+# Mode TLS : "starttls" (port 5222, défaut), "direct" (port 5223) ou "disabled" (localhost uniquement)
+XMPP_TLS_MODE=starttls
+# XMPP_USE_TLS=true/false est obsolète mais encore supporté (alias de XMPP_TLS_MODE)
+XMPP_CONNECT_TIMEOUT=15
+XMPP_CLEANUP_TIMEOUT=10
 XMPP_TIMEOUT=30
 
 # --- IA (optionnelle) ---

.secrets.baseline

@@ -139,9 +139,8 @@
         "type": "Hex High Entropy String",
         "filename": "GUIDE_DEV_PYTHON.md",
         "hashed_secret": "90bd1b48e958257948487b90bee080ba5ed00caa",
-        "is_verified": true,
-        "line_number": 5085,
-        "is_secret": false
+        "is_verified": false,
+        "line_number": 5117
       }
     ],
     "tests/unit/test_caldav_gateway.py": [
@@ -175,7 +174,16 @@
         "is_verified": false,
         "line_number": 28
       }
+    ],
+    "tests/unit/test_xmpp_channel.py": [
+      {
+        "type": "Secret Keyword",
+        "filename": "tests/unit/test_xmpp_channel.py",
+        "hashed_secret": "b01bcded8826562355b3e32a8b31e214ff533511",
+        "is_verified": false,
+        "line_number": 1011
+      }
     ]
   },
-  "generated_at": "2026-09-11T09:57:08Z"
+  "generated_at": "2026-09-12T11:33:28Z"
 }

GUIDE_DEV_PYTHON.md

@@ -275,7 +275,8 @@ Le projet utilise **`pydantic-settings`** pour valider et charger la configurati
 
 > ⚠️ **Décision d'implémentation** :
 > `XMPP_RECIPIENT` a été renommé en `XMPP_TO` dans l'implémentation (aligné avec §10.2.1).
-> Des variables XMPP supplémentaires ont été ajoutées : `XMPP_ENABLED`, `XMPP_HOST`, `XMPP_PORT`, `XMPP_RESOURCE`, `XMPP_USE_TLS`, `XMPP_TIMEOUT`.
+> Des variables XMPP supplémentaires ont été ajoutées : `XMPP_ENABLED`, `XMPP_HOST`, `XMPP_PORT`, `XMPP_RESOURCE`, `XMPP_TLS_MODE`, `XMPP_TIMEOUT`, `XMPP_CONNECT_TIMEOUT`, `XMPP_CLEANUP_TIMEOUT`.
+> `XMPP_USE_TLS` reste supporté mais est **obsolète** (remplacé par `XMPP_TLS_MODE`).
 > Une section `BLOG_ENABLED` et `BLOG_RSS_URL` a été ajoutée dans `.env.example`.
 
 Les variables Pronote sont obligatoires selon les sources activées :
@@ -1892,6 +1893,20 @@ def generate_deterministic_uid(
 
 #### 5.1.6 Parsing complet du flux iCal (`sources/pronote/ical.py`)
 
+Le parseur de production accepte les variantes contrôlées des libellés et des
+balises `strong` générées par Pronote. Il distingue les catégories `Congés` /
+`Vacances` (`HOLIDAY`) des catégories `Jour(s) férié(s)` (`PUBLIC_HOLIDAY`),
+conserve la borne `DTEND` comme date exclusive et reconnaît les statuts
+annulé, déplacé ou modifié. Les sections de devoirs conservent un HTML
+nettoyé (scripts, styles et attributs exécutables supprimés) ainsi qu'un texte
+lisible. La déduplication utilise la date, la matière, les enseignants et le
+texte normalisé : une copie du même devoir est fusionnée, tandis qu'un devoir
+homonyme d'une autre matière ou d'un autre enseignant est conservé.
+
+Le champ `Partie(s) de classe` est conservé dans `Lesson.class_part` et dans
+la description iCalendar sérialisée. Les catégories ou sections inconnues ne
+doivent pas être interprétées comme des vacances, une annulation ou un devoir.
+
 ```python
 List, Optional, Tuple
 from datetime import datetime, date
@@ -4066,7 +4081,9 @@ Si le besoin évolue (ex: **plusieurs destinataires**), les étapes suivantes so
 | `XMPP_PORT`                | Port XMPP (5222 pour STARTTLS, 5223 pour TLS direct).                           | `5222`               | `int`             | ❌ Non           |
 | `XMPP_TO`                  | Destinataire unique (ex: `parent@exemple.org`).                             | `None`                | `str`             | ✅ Oui           |
 | `XMPP_RESOURCE`            | Ressource XMPP (ex: `pronote-sync`).                                         | `"pronote-sync"`     | `str`             | ❌ Non           |
-| `XMPP_USE_TLS`             | Utiliser TLS pour la connexion.                                              | `True`                | `bool`            | ❌ Non           |
+| `XMPP_TLS_MODE`            | Mode TLS : `starttls` (défaut), `direct` ou `disabled` (localhost uniquement). | `"starttls"`          | `Literal`         | ❌ Non           |
+| `XMPP_CONNECT_TIMEOUT`     | Timeout de connexion (secondes).                                              | `15`                  | `float`           | ❌ Non           |
+| `XMPP_CLEANUP_TIMEOUT`     | Timeout de nettoyage (secondes).                                              | `10`                  | `float`           | ❌ Non           |
 | `XMPP_TIMEOUT`             | Timeout de connexion (secondes).                                             | `30`                 | `int`             | ❌ Non           |
 
 **⚠️ Notes** :
@@ -4074,6 +4091,7 @@ Si le besoin évolue (ex: **plusieurs destinataires**), les étapes suivantes so
 - **Pas de variables PubSub** : `XMPP_PUBSUB_NODE`, `XMPP_ROOM`, `XMPP_SUBSCRIBERS` **ne doivent pas être introduites** pour l'instant.
 - **Sécurité** : `XMPP_JID`, `XMPP_PASSWORD` et `XMPP_TO` **ne doivent jamais apparaître** dans les logs, erreurs ou fixtures.
 - **Standardisation** : `XMPP_TO` est mappé sur le champ `to` dans le modèle Pydantic.
+- **`XMPP_USE_TLS` obsolète** : remplacée par `XMPP_TLS_MODE` (`starttls`, `direct` ou `disabled`) ; `XMPP_USE_TLS=true` → `direct` et `XMPP_USE_TLS=false` → `starttls`, avec un `DeprecationWarning`.
 
 #### 10.2.2 Exemple de configuration dans `.env`
 
@@ -4086,13 +4104,19 @@ XMPP_HOST=exemple.org
 XMPP_PORT=5222
 XMPP_TO=parent@exemple.org
 XMPP_RESOURCE=pronote-digest
-XMPP_USE_TLS=true
+# XMPP_TLS_MODE : "starttls" (défaut), "direct" (port 5223) ou "disabled" (localhost uniquement)
+XMPP_TLS_MODE=starttls
+# XMPP_USE_TLS=true/false est obsolète mais encore supporté (alias de XMPP_TLS_MODE)
+XMPP_CONNECT_TIMEOUT=15
+XMPP_CLEANUP_TIMEOUT=10
 XMPP_TIMEOUT=30
 ```
 
 #### 10.2.3 Modèle Pydantic pour la configuration XMPP
 
 ```python
+from typing import Literal
+
 from pydantic import SecretStr, Field
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
@@ -4118,14 +4142,22 @@ class XmppSettings(BaseSettings):
     port: int = Field(default=5222, ge=1, le=65535)
     to: str | None = None
     resource: str = "pronote-sync"
-    use_tls: bool = True
-    timeout: int = Field(default=30, gt=0)
+    tls_mode: Literal["direct", "starttls", "disabled"] = "starttls"
+    use_tls: bool | None = Field(
+        default=None,
+        deprecated="Utiliser tls_mode à la place (XMPP_USE_TLS obsolète).",
+    )
+    timeout: float = Field(default=30, gt=0)
+    connect_timeout: float = Field(default=15, gt=0)
+    cleanup_timeout: float = Field(default=10, gt=0)
 ```
 
 > **⚠️ Mapping TLS** :
-> - `use_tls=True` → **TLS direct** (port 5223, `enable_direct_tls=True`, `enable_starttls=False`).
-> - `use_tls=False` → **STARTTLS** (port 5222, `enable_starttls=True`, `enable_direct_tls=False`).
-> La validation refuse `use_tls=False` si `host` n'est pas un hôte de boucle locale (`localhost`, `127.0.0.1`, `::1`).
+> - `tls_mode="starttls"` (défaut) → **STARTTLS** (port 5222, `enable_starttls=True`, `enable_direct_tls=False`).
+> - `tls_mode="direct"` → **TLS direct** (port 5223, `enable_direct_tls=True`, `enable_starttls=False`).
+> - `tls_mode="disabled"` → TLS désactivé ; **uniquement** autorisé sur un hôte de boucle locale (`localhost`, `127.0.0.1`, `::1`).
+> - `XMPP_USE_TLS` (`use_tls`) est **obsolète** : `use_tls=True` → `tls_mode="direct"` et
+>   `use_tls=False` → `tls_mode="starttls"` (avec `DeprecationWarning`).
 
 ---
 

README.LLM.md

@@ -71,7 +71,8 @@ The following variables can be safely pre-configured in `/etc/pronote-sync/prono
   - `THEORETICAL_WEEK_ANCHOR_DATE`, `THEORETICAL_WEEK_ANCHOR_TYPE`
 
 - **XMPP:**
-  - `XMPP_ENABLED`, `XMPP_HOST`, `XMPP_PORT`, `XMPP_USE_TLS`, `XMPP_TIMEOUT`, `XMPP_RESOURCE`
+  - `XMPP_ENABLED`, `XMPP_HOST`, `XMPP_PORT`, `XMPP_TLS_MODE`, `XMPP_TIMEOUT`, `XMPP_CONNECT_TIMEOUT`, `XMPP_CLEANUP_TIMEOUT`, `XMPP_RESOURCE`
+  - `XMPP_USE_TLS` is deprecated but still supported (aliased to `XMPP_TLS_MODE`)
 
 - **AI:**
   - `AI_ENABLED`, `AI_PROVIDER`, `AI_BASE_URL`, `AI_MODEL`, `AI_ALLOW_INSECURE_HTTP`

docs/fixtures-pronote.md

@@ -0,0 +1,16 @@
+# Corpus de fixtures Pronote
+
+Le corpus versionné de `tests/fixtures/` est limité à des exemples iCalendar
+minimaux et anonymisés. Il est rejouable sans connexion Pronote et sert à
+vérifier les modèles métier finaux, pas seulement l'absence d'exception.
+
+Chaque fichier `*.ics` de variante possède un manifeste JSON homonyme. Le
+manifeste indique la source, la version connue (ou `unknown`), les scénarios
+couverts et les invariants à préserver. Les réponses API Pronote ne sont pas
+stockées tant qu'elles ne peuvent pas être réduites sans conserver de données
+personnelles ou de secret.
+
+Avant d'ajouter un export : supprimer les URL, jetons, identifiants, noms,
+établissement et contenu personnel ; réduire le document aux propriétés
+nécessaires ; exécuter `scripts/check_secrets.py` ; puis ajouter un test qui
+vérifie les modèles `Lesson`, `Homework` et `SchoolEvent` obtenus.

pronote_sync/channels/xmpp.py

@@ -36,6 +36,24 @@ logger = logging.getLogger(__name__)
 __all__ = ["XmppChannel", "SyncXmppChannel", "XmppMessage"]
 
 
+async def _cancel_pending(
+    *futures: asyncio.Future[bool],
+) -> None:
+    """Annule les futures/tâches encore en attente et supprime le bruit.
+
+    À appeler avant chaque retour anticipé de :meth:`XmppChannel.send_async`
+    afin qu'aucune tentative de connexion ne survive au retour de la méthode.
+
+    :param futures: Futures ou tâches à annuler (les déjà terminées sont
+        ignorées pour la cancellation mais attendues pour purger l'attente).
+    :rtype: None
+    """
+    for future in futures:
+        if not future.done():
+            future.cancel()
+    await asyncio.gather(*futures, return_exceptions=True)
+
+
 def _secret_values(settings: XmppSettings) -> tuple[SecretStr | str, ...]:
     """Rassemble les secrets du canal XMPP pour le masquage des logs.
 
@@ -220,11 +238,14 @@ class XmppChannel:
         """Exécute le flux asynchrone d'envoi XMPP (U2).
 
         Connecte le client ``slixmpp`` avec un hôte et un port explicites,
-        configure TLS avant la connexion, puis attend l'un des événements
-        ``session_start``, ``failed_auth`` ou ``disconnected`` sous un
-        timeout unique avant d'envoyer un message direct ``chat`` au
+        configure TLS avant la connexion selon ``tls_mode`` (``direct``,
+        ``starttls`` ou ``disabled``), attend la connexion sous
+        ``connect_timeout`` puis l'un des événements ``session_start``,
+        ``failed_auth``, ``connection_failed`` ou ``disconnected`` sous
+        ``timeout`` avant d'envoyer un message direct ``chat`` au
         destinataire configuré. La déconnexion est garantie par un bloc
-        ``try/finally``. Aucun secret n'est journalisé (SEC-XMPP-02).
+        ``try/finally`` borné par ``cleanup_timeout``. Aucun secret n'est
+        journalisé (SEC-XMPP-02).
 
         :param message: Message final à envoyer.
         :return: ``True`` si l'envoi a réussi (ou a été simulé en dry-run),
@@ -244,55 +265,132 @@ class XmppChannel:
             logger.warning("Destinataire XMPP manquant.")
             return False
 
-        # Create typed client
-        client = ClientXMPP(
-            jid_str,
-            self.settings.password.get_secret_value() if self.settings.password else "",
-        )
-
-        # Configure TLS BEFORE connect
-        if self.settings.use_tls:
-            # TLS direct (port 5223 typically)
-            client.enable_direct_tls = True
-            client.enable_starttls = False
-        else:
-            # STARTTLS (port 5222 typically)
-            client.enable_starttls = True
-            client.enable_direct_tls = False
-
-        # Register handlers
+        # Client typed lazily: the construction is done inside the try block so that
+        # any error is caught and converted to ``False`` (channel contract: never raise)
+        client: ClientXMPP | None = None
         session_future: asyncio.Future[bool] = asyncio.get_event_loop().create_future()
+        failure_kind = "disconnected"
+        # Declared before the ``try`` so the exception handlers (CancelledError and
+        # Exception) can cancel any task still pending from ``asyncio.wait()``
+        connect_future: asyncio.Future[bool] | None = None
+        session_task: asyncio.Future[bool] | None = None
 
         def on_session_start(event: object) -> None:
             if not session_future.done():
                 session_future.set_result(True)
 
         def on_failed_auth(event: object) -> None:
+            nonlocal failure_kind
             if not session_future.done():
+                failure_kind = "failed_auth"
+                session_future.set_result(False)
+
+        def on_connection_failed(event: object) -> None:
+            nonlocal failure_kind
+            if not session_future.done():
+                failure_kind = "connection_failed"
                 session_future.set_result(False)
 
         def on_disconnected(event: object) -> None:
             if not session_future.done():
                 session_future.set_result(False)
 
-        client.add_event_handler("session_start", on_session_start)
-        client.add_event_handler("failed_auth", on_failed_auth)
-        client.add_event_handler("disconnected", on_disconnected)
-
         try:
+            # Create typed client
+            client = ClientXMPP(
+                jid_str,
+                self.settings.password.get_secret_value() if self.settings.password else "",
+            )
+
+            # Configure TLS BEFORE connect (canonical tls_mode)
+            match self.settings.tls_mode:
+                case "direct":
+                    client.enable_direct_tls = True
+                    client.enable_starttls = False
+                case "starttls":
+                    client.enable_direct_tls = False
+                    client.enable_starttls = True
+                case "disabled":
+                    client.enable_direct_tls = False
+                    client.enable_starttls = False
+
+            # Register handlers
+            client.add_event_handler("session_start", on_session_start)
+            client.add_event_handler("failed_auth", on_failed_auth)
+            client.add_event_handler("connection_failed", on_connection_failed)
+            client.add_event_handler("disconnected", on_disconnected)
+
             # Connect with explicit host and port
-            connect_future = client.connect(self.settings.host, self.settings.port)
-            await connect_future  # connect() returns a Future, not a coroutine
+            connect_future = asyncio.ensure_future(
+                client.connect(self.settings.host, self.settings.port)
+            )
 
-            # Wait for one of the three events under a single timeout
-            try:
-                success = await asyncio.wait_for(session_future, timeout=self.settings.timeout)
-            except TimeoutError:
-                logger.warning("Délai d'attente de session XMPP dépassé.")
-                return False
+            # Wrap the session future in a task so that cancelling pending tasks
+            # during the concurrent wait never cancels ``session_future`` itself
+            async def _await_session() -> bool:
+                return await session_future
 
-            if not success:
-                logger.warning("Échec d'authentification ou déconnexion XMPP.")
+            session_task = asyncio.ensure_future(_await_session())
+
+            # Wait for the connection and the session event concurrently, bounded by
+            # connect_timeout as the global time limit: a ``connection_failed`` event
+            # can thus trigger an early return before the connect timeout expires
+            done, _pending = await asyncio.wait(
+                {connect_future, session_task},
+                timeout=self.settings.connect_timeout,
+                return_when=asyncio.FIRST_COMPLETED,
+            )
+
+            if session_task in done:
+                if not session_future.result():
+                    # ``connection_failed``/``failed_auth``/``disconnected`` fired
+                    # before the connection was resolved: immediate failure (fail fast)
+                    if failure_kind == "connection_failed":
+                        logger.warning("Échec de connexion réseau XMPP.")
+                    else:
+                        logger.warning("Échec d'authentification ou déconnexion XMPP.")
+                    await _cancel_pending(connect_future, session_task)
+                    return False
+                # ``session_start`` fired: the connection succeeded even if the
+                # connect future is still pending; proceed to send the message
+                await _cancel_pending(connect_future, session_task)
+            elif connect_future in done:
+                # The connection resolved: surface a connect error (redacted) if any
+                if not connect_future.cancelled():
+                    connect_exc = connect_future.exception()
+                    if connect_exc is not None and isinstance(connect_exc, Exception):
+                        logger.warning(
+                            "Échec de connexion XMPP : %s",
+                            redact_exception(
+                                connect_exc,
+                                extra_secrets=_secret_values(self.settings),
+                            ),
+                        )
+                        await _cancel_pending(connect_future, session_task)
+                        return False
+
+                # Connection established: wait for a session event under ``timeout``
+                try:
+                    success = await asyncio.wait_for(
+                        asyncio.shield(session_future), timeout=self.settings.timeout
+                    )
+                except TimeoutError:
+                    logger.warning("Délai d'attente de session XMPP dépassé.")
+                    await _cancel_pending(connect_future, session_task)
+                    return False
+                if not success:
+                    if failure_kind == "connection_failed":
+                        logger.warning("Échec de connexion réseau XMPP.")
+                    else:
+                        logger.warning("Échec d'authentification ou déconnexion XMPP.")
+                    await _cancel_pending(connect_future, session_task)
+                    return False
+            else:
+                # connect_timeout expired: cancel everything and fail fast
+                logger.warning(
+                    "Délai de connexion XMPP dépassé (%ss).", self.settings.connect_timeout
+                )
+                await _cancel_pending(connect_future, session_task)
                 return False
 
             # Send the message
@@ -300,19 +398,39 @@ class XmppChannel:
             client.send_message(mto=JID(self.settings.to), mbody=formatted, mtype="chat")
             return True
 
+        except asyncio.CancelledError:
+            # Contrat du canal : toujours retourner un booléen, même en cas
+            # d'annulation de la tâche appelante (cleanup exécuté par le finally).
+            logger.debug("Envoi XMPP annulé avant la fin de l'opération.")
+            pending = [f for f in (connect_future, session_task) if f is not None]
+            if pending:
+                await _cancel_pending(*pending)
+            return False
         except Exception as exc:
-            redacted = redact_exception(exc)
+            redacted = redact_exception(exc, extra_secrets=_secret_values(self.settings))
             extra = _secret_values(self.settings)
             logger.warning("Erreur XMPP: %s", redact_secrets(redacted, extra_secrets=extra))
+            pending = [f for f in (connect_future, session_task) if f is not None]
+            if pending:
+                await _cancel_pending(*pending)
             return False
         finally:
-            try:
-                disconnect_future = client.disconnect()
-                await disconnect_future
-            except Exception as cleanup_exc:
-                logger.debug(
-                    "Erreur lors de la déconnexion XMPP: %s", redact_exception(cleanup_exc)
-                )
+            if client is not None:
+                try:
+                    disconnect_future = client.disconnect()
+                    await asyncio.wait_for(disconnect_future, timeout=self.settings.cleanup_timeout)
+                except asyncio.CancelledError:
+                    logger.debug("Déconnexion XMPP annulée.")
+                except TimeoutError:
+                    logger.debug(
+                        "Délai de déconnexion XMPP dépassé (%ss), abandon.",
+                        self.settings.cleanup_timeout,
+                    )
+                except Exception as cleanup_exc:
+                    logger.debug(
+                        "Erreur lors de la déconnexion XMPP : %s",
+                        redact_exception(cleanup_exc, extra_secrets=_secret_values(self.settings)),
+                    )
 
 
 class SyncXmppChannel:
@@ -363,7 +481,7 @@ class SyncXmppChannel:
         try:
             return asyncio.run(self._channel.send_async(message))
         except Exception as exc:
-            redacted = redact_exception(exc)
+            redacted = redact_exception(exc, extra_secrets=_secret_values(self.settings))
             redacted = redact_secrets(redacted, extra_secrets=_secret_values(self.settings))
             logger.warning("XMPP : erreur lors de l'envoi synchrone : %s", redacted)
             return False

pronote_sync/config/settings.py

@@ -8,6 +8,7 @@ depuis les variables d'environnement (préfixées par groupe) et le fichier
 
 from __future__ import annotations
 
+import warnings
 from datetime import date
 from typing import Literal
 from urllib.parse import urlparse
@@ -18,6 +19,7 @@ from pydantic import (
     ValidationInfo,
     field_serializer,
     field_validator,
+    model_validator,
 )
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
@@ -158,10 +160,16 @@ class XmppSettings(BaseSettings):
     Contraintes de champs : ``port`` est borné entre 1 et 65535 et ``timeout``
     doit être strictement positif.
 
-    Politique TLS : la désactivation de TLS (``use_tls`` à ``False``) n'est
-    autorisée que sur un hôte de boucle locale (``localhost``, ``127.0.0.1``,
-    ``::1``). Dans tout autre cas, une erreur de validation est levée,
-    indépendamment de l'état du champ ``enabled``.
+    Politique TLS : le mode ``tls_mode`` détermine la négociation TLS
+    (``direct``, ``starttls`` ou ``disabled``). Le mode ``disabled`` n'est
+    autorisé que sur un hôte de boucle locale (``localhost``, ``127.0.0.1``,
+    ``::1``) ; ``starttls`` et ``direct`` sont permis pour tous les hôtes.
+
+    Compatibilité : le champ historique ``use_tls`` (booléen) est un alias
+    obsolète ; ``use_tls=True`` mappe vers ``tls_mode="direct"`` et
+    ``use_tls=False`` vers ``tls_mode="starttls"``, avec un
+    :pyexc:`DeprecationWarning`. La valeur brute fournie reste lisible via
+    ``use_tls`` (``None`` si non fournie).
     """
 
     model_config = SettingsConfigDict(
@@ -178,33 +186,61 @@ class XmppSettings(BaseSettings):
     port: int = Field(default=5222, ge=1, le=65535)
     to: str | None = None
     resource: str = "pronote-sync"
-    use_tls: bool = True
-    timeout: int = Field(default=30, gt=0)
+    tls_mode: Literal["direct", "starttls", "disabled"] = "starttls"
+    use_tls: bool | None = Field(
+        default=None,
+        deprecated="Utiliser tls_mode à la place (XMPP_USE_TLS obsolète).",
+    )
+    timeout: float = Field(default=30, gt=0)
+    connect_timeout: float = Field(default=15, gt=0)
+    cleanup_timeout: float = Field(default=10, gt=0)
 
-    @field_validator("use_tls")
+    @model_validator(mode="before")
     @classmethod
-    def _validate_tls_policy(cls, v: bool, info: ValidationInfo) -> bool:
-        """Refuse la désactivation de TLS hors des hôtes de boucle locale.
+    def _migrate_use_tls(cls, data: object) -> object:
+        """Mappe l'alias obsolète ``use_tls`` vers le mode canonique ``tls_mode``.
 
-        La règle s'applique quel que soit l'état du champ ``enabled``. Le
-        message d'erreur ne contient aucune valeur sensible (``jid``,
+        ``use_tls=True`` devient ``tls_mode="direct"`` et ``use_tls=False``
+        devient ``tls_mode="starttls"`` ; un :pyexc:`DeprecationWarning` est
+        émis à chaque usage explicite de l'alias. ``tls_mode`` fourni
+        explicitement prend le pas sur l'alias.
+
+        :param data: Données d'entrée du modèle (dict ou autre).
+        :return: Données d'entrée avec ``tls_mode`` dérivé de ``use_tls``.
+        :rtype: object
+        """
+        if not isinstance(data, dict) or "use_tls" not in data:
+            return data
+        warnings.warn(
+            "XMPP_USE_TLS est obsolète : utiliser XMPP_TLS_MODE "
+            "('direct', 'starttls' ou 'disabled').",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        if data.get("tls_mode") is None:
+            data["tls_mode"] = "direct" if data["use_tls"] else "starttls"
+        return data
+
+    @model_validator(mode="after")
+    def _validate_tls_policy(self) -> XmppSettings:
+        """Refuse le mode ``disabled`` hors des hôtes de boucle locale.
+
+        La règle s'applique quel que soit l'état du champ ``enabled``. Les
+        modes ``starttls`` et ``direct`` sont autorisés pour tous les hôtes.
+        Le message d'erreur ne contient aucune valeur sensible (``jid``,
         ``password``, ``to``).
 
-        :param v: Valeur du champ ``use_tls`` à valider.
-        :param info: Contexte de validation (accès aux autres champs).
-        :return: La valeur validée inchangée.
-        :rtype: bool
-        :raises ValueError: Si ``use_tls`` est ``False`` et que ``host``
+        :return: L'instance validée inchangée.
+        :rtype: XmppSettings
+        :raises ValueError: Si ``tls_mode`` est ``disabled`` et que ``host``
             n'est pas un hôte de boucle locale.
         """
-        if v is False:
-            host = info.data.get("host", "")
-            if host not in _XMPP_LOOPBACK_HOSTS:
-                raise ValueError(
-                    "TLS désactivé n'est autorisé que sur les hôtes de loopback "
-                    "(localhost, 127.0.0.1, ::1)."
-                ) from None
-        return v
+        if self.tls_mode == "disabled" and self.host not in _XMPP_LOOPBACK_HOSTS:
+            raise ValueError(
+                "TLS désactivé n'est autorisé que sur les hôtes de loopback "
+                "(localhost, 127.0.0.1, ::1)."
+            ) from None
+        return self
 
 
 class AISettings(BaseSettings):

pronote_sync/models/agenda.py

@@ -52,6 +52,7 @@ class Lesson(BaseModel):
     teachers: tuple[str, ...] = Field(default=(), description="Liste des professeurs")
     rooms: tuple[str, ...] = Field(default=(), description="Liste des salles")
     group: str | None = Field(None, description="Groupe (ex: Classe entière)")
+    class_part: str | None = None
     status: LessonStatus = Field(default=LessonStatus.NORMAL, description="Statut du cours")
     content: str | None = Field(None, description="Contenu pédagogique")
     homework_blocks: tuple[HomeworkBlock, ...] = Field(

pronote_sync/sources/pronote/ical.py

@@ -14,13 +14,15 @@ from __future__ import annotations
 
 import hashlib
 import re
+import unicodedata
 import urllib.parse
 from datetime import date, datetime
 from html import unescape
 from pathlib import Path
-from typing import TypedDict
+from typing import NamedTuple, TypedDict
 
 import requests
+from bs4 import BeautifulSoup
 from icalendar import Calendar
 
 from ...models.agenda import (
@@ -34,21 +36,13 @@ from ...models.homework import Homework
 from ...utils.redaction import redact_exception, redact_url
 from ...utils.uid import generate_deterministic_uid, normalize_pronote_uid
 
-_HEADER_LABEL_PATTERN = re.compile(r"\b(Matière|Professeurs?|Salles?|Groupe)\s*:\s*")
+_HEADER_LABEL_PATTERN = re.compile(
+    r"(?P<label>Mati(?:ère|ere)|Professeur(?:s|\(s\))?|Salle(?:s|\(s\))?"
+    r"|Groupe|Partie(?:s|\(s\))?\s+de\s+classe)\s*:\s*",
+    re.IGNORECASE,
+)
 _CALNAME_PATTERN = re.compile(r"^X-WR-CALNAME(?:;[^:]*)?:([^\r\n]*)", re.MULTILINE)
-_TAG_PATTERN = re.compile(r"<[^>]+>")
-_CONTENT_PATTERN = re.compile(
-    r"<strong>Contenu pédagogique\s*:\s*</strong>(.*?)(?=<strong>|</div>\s*$|\Z)",
-    re.DOTALL,
-)
-_DUE_PATTERN = re.compile(
-    r"<strong>Pour le (\d{2}/\d{2}/\d{4})\s*:\s*</strong>(.*?)(?=<strong>|</div>\s*$|\Z)",
-    re.DOTALL,
-)
-_ASSIGNED_PATTERN = re.compile(
-    r"<strong>Donné le (\d{2}/\d{2}/\d{4})\s*:\s*</strong>(.*?)(?=<strong>|</div>\s*$|\Z)",
-    re.DOTALL,
-)
+_STRONG_PATTERN = re.compile(r"<strong\b[^>]*>(?P<label>.*?)</strong>", re.IGNORECASE | re.DOTALL)
 
 _HEADERS = {
     "accept": "text/calendar",
@@ -63,6 +57,15 @@ class HeaderInfo(TypedDict):
     teachers: list[str]
     rooms: list[str]
     group: str | None
+    class_part: str | None
+
+
+class ParsedHomeworkBlock(NamedTuple):
+    """Bloc de devoir parsé avec son texte nettoyé et son HTML sûr."""
+
+    date: date
+    text: str
+    html: str
 
 
 def fetch_ical(url: str, timeout: int = 20) -> str:
@@ -156,11 +159,11 @@ def split_header_and_body(description: str) -> tuple[str, str]:
     :return: Tuple ``(en-tête, corps)`` ; le corps est vide si aucun ``<strong>``.
     :rtype: tuple[str, str]
     """
-    strong_start = description.find("<strong>")
-    if strong_start == -1:
+    strong_match = _STRONG_PATTERN.search(description)
+    if strong_match is None:
         return description.strip(), ""
-    header = description[:strong_start].strip()
-    body = description[strong_start:]
+    header = description[: strong_match.start()].strip()
+    body = description[strong_match.start() :]
     return header, body
 
 
@@ -168,7 +171,7 @@ def parse_header(header: str) -> HeaderInfo:
     """Parse l'en-tête texte pour extraire les métadonnées du cours.
 
     Les labels reconnus sont : ``Matière :``, ``Professeur(s) :``,
-    ``Salle(s) :`` et ``Groupe :``. La recherche se fait par position
+    ``Salle(s) :``, ``Groupe :`` et ``Partie(s) de classe :``. La recherche se fait par position
     des labels, ce qui supporte aussi bien un en-tête multi-lignes
     qu'un en-tête dont les lignes sont jointes sur une seule ligne.
 
@@ -176,14 +179,20 @@ def parse_header(header: str) -> HeaderInfo:
     :return: Dictionnaire typé avec les champs subject, teachers, rooms, group.
     :rtype: HeaderInfo
     """
-    info: HeaderInfo = {"subject": "", "teachers": [], "rooms": [], "group": None}
+    info: HeaderInfo = {
+        "subject": "",
+        "teachers": [],
+        "rooms": [],
+        "group": None,
+        "class_part": None,
+    }
     matches = list(_HEADER_LABEL_PATTERN.finditer(header))
     for index, match in enumerate(matches):
         value_start = match.end()
         value_end = matches[index + 1].start() if index + 1 < len(matches) else len(header)
         value = unescape(header[value_start:value_end].strip())
-        label = match.group(1).lower()
-        if label == "matière":
+        label = _normalize_label(match.group("label")).replace("(s)", "s")
+        if label == "matiere":
             info["subject"] = value
         elif label in ("professeur", "professeurs"):
             info["teachers"] = [part.strip() for part in value.split(",") if part.strip()]
@@ -191,9 +200,44 @@ def parse_header(header: str) -> HeaderInfo:
             info["rooms"] = [part.strip() for part in value.split(",") if part.strip()]
         elif label == "groupe":
             info["group"] = value
+        elif label in ("partie de classe", "parties de classe"):
+            info["class_part"] = value
     return info
 
 
+def _normalize_label(value: str) -> str:
+    """Normalise un libellé iCal pour comparer des variantes contrôlées.
+
+    :param value: Libellé à normaliser.
+    :return: Libellé minuscule sans accents et avec des espaces unifiés.
+    :rtype: str
+    """
+    decomposed = unicodedata.normalize("NFKD", value)
+    without_accents = "".join(char for char in decomposed if not unicodedata.combining(char))
+    return re.sub(r"\s+", " ", without_accents).strip().lower()
+
+
+def _sanitize_html(fragment: str) -> str:
+    """Nettoie un fragment HTML de description sans exécuter de contenu.
+
+    :param fragment: Fragment HTML extrait d'une section de devoir.
+    :return: HTML conservé sans scripts, styles ni attributs exécutables.
+    :rtype: str
+    """
+    soup = BeautifulSoup(fragment, "html.parser")
+    for tag in soup.find_all(("script", "style")):
+        tag.decompose()
+    for tag in soup.find_all(True):
+        for attribute in list(tag.attrs):
+            lowered = attribute.lower()
+            value = tag.attrs[attribute]
+            if lowered.startswith("on") or (
+                lowered in ("href", "src") and str(value).lower().strip().startswith("javascript:")
+            ):
+                del tag.attrs[attribute]
+    return soup.decode_contents().strip()
+
+
 def _strip_html(text: str) -> str:
     """Retire les balises HTML d'un texte et nettoie les espaces.
 
@@ -201,8 +245,10 @@ def _strip_html(text: str) -> str:
     :return: Texte brut sans balises, entités HTML décodées.
     :rtype: str
     """
-    cleaned = _TAG_PATTERN.sub("", text)
-    return unescape(cleaned).strip()
+    soup = BeautifulSoup(text, "html.parser")
+    for tag in soup.find_all(("script", "style")):
+        tag.decompose()
+    return " ".join(unescape(soup.get_text(" ", strip=True)).split())
 
 
 def _parse_french_date(value: str) -> date | None:
@@ -218,44 +264,57 @@ def _parse_french_date(value: str) -> date | None:
         return None
 
 
-def parse_body(body: str) -> tuple[str | None, list[tuple[date, str]], list[tuple[date, str]]]:
+def parse_body(
+    body: str,
+) -> tuple[str | None, list[ParsedHomeworkBlock], list[ParsedHomeworkBlock]]:
     """Parse le corps HTML pour extraire contenu pédagogique et devoirs.
 
     Le contenu est extrait de la section ``<strong>Contenu pédagogique :</strong>``.
     Les devoirs à faire sont extraits des sections ``<strong>Pour le JJ/MM/AAAA :</strong>``
-    (liste de tuples ``(date, texte)`` dans l'ordre du flux) et les devoirs donnés
-    des sections ``<strong>Donné le JJ/MM/AAAA :</strong>`` (liste de tuples
-    ``(date, texte)``). Les listes préservent tous les blocs, même lorsque plusieurs
-    sections partagent la même date.
+    et les devoirs donnés des sections ``<strong>Donné le JJ/MM/AAAA :</strong>``.
+    Les listes préservent tous les blocs, même lorsque plusieurs sections partagent
+    la même date, avec le texte nettoyé et le HTML sûr de chaque bloc.
 
     :param body: Corps HTML (à partir du premier ``<strong>``).
     :return: Tuple ``(contenu pédagogique, devoirs dus, devoirs donnés)``.
-    :rtype: tuple[str | None, list[tuple[date, str]], list[tuple[date, str]]]
+    :rtype: tuple[str | None, list[ParsedHomeworkBlock], list[ParsedHomeworkBlock]]
     """
     content: str | None = None
-    due_blocks: list[tuple[date, str]] = []
-    assigned_blocks: list[tuple[date, str]] = []
+    due_blocks: list[ParsedHomeworkBlock] = []
+    assigned_blocks: list[ParsedHomeworkBlock] = []
 
-    content_match = _CONTENT_PATTERN.search(body)
-    if content_match is not None:
-        content = _strip_html(content_match.group(1))
+    matches = list(_STRONG_PATTERN.finditer(body))
+    for index, match in enumerate(matches):
+        next_start = matches[index + 1].start() if index + 1 < len(matches) else len(body)
+        heading = _strip_html(match.group("label")).rstrip(":").strip()
+        fragment = body[match.end() : next_start]
+        safe_html = _sanitize_html(fragment)
+        text = _strip_html(fragment)
 
-    for match in _DUE_PATTERN.finditer(body):
-        due_date = _parse_french_date(match.group(1))
-        if due_date is not None:
-            due_blocks.append((due_date, _strip_html(match.group(2))))
+        normalized_heading = _normalize_label(heading)
+        if normalized_heading == "contenu pedagogique":
+            content = text
+            continue
 
-    for match in _ASSIGNED_PATTERN.finditer(body):
-        assigned_date = _parse_french_date(match.group(1))
-        if assigned_date is not None:
-            assigned_blocks.append((assigned_date, _strip_html(match.group(2))))
+        due_match = re.fullmatch(r"Pour\s+le\s+(\d{2}/\d{2}/\d{4})", heading, re.IGNORECASE)
+        assigned_match = re.fullmatch(
+            r"Donne\s+le\s+(\d{2}/\d{2}/\d{4})", normalized_heading, re.IGNORECASE
+        )
+        if due_match is not None:
+            due_date = _parse_french_date(due_match.group(1))
+            if due_date is not None:
+                due_blocks.append(ParsedHomeworkBlock(due_date, text, safe_html))
+        elif assigned_match is not None:
+            assigned_date = _parse_french_date(assigned_match.group(1))
+            if assigned_date is not None:
+                assigned_blocks.append(ParsedHomeworkBlock(assigned_date, text, safe_html))
 
     return content, due_blocks, assigned_blocks
 
 
 def parse_homework_blocks(
-    due_blocks: list[tuple[date, str]],
-    assigned_blocks: list[tuple[date, str]],
+    due_blocks: list[ParsedHomeworkBlock],
+    assigned_blocks: list[ParsedHomeworkBlock],
 ) -> tuple[HomeworkBlock, ...]:
     """Construit les :class:`HomeworkBlock` depuis les listes de devoirs.
 
@@ -269,10 +328,12 @@ def parse_homework_blocks(
     :rtype: tuple[HomeworkBlock, ...]
     """
     blocks: list[HomeworkBlock] = []
-    for due_date, text in due_blocks:
-        blocks.append(HomeworkBlock(kind="due", date=due_date, text=text, html=text))
-    for assigned_date, text in assigned_blocks:
-        blocks.append(HomeworkBlock(kind="assigned", date=assigned_date, text=text, html=text))
+    for block in due_blocks:
+        blocks.append(HomeworkBlock(kind="due", date=block.date, text=block.text, html=block.html))
+    for block in assigned_blocks:
+        blocks.append(
+            HomeworkBlock(kind="assigned", date=block.date, text=block.text, html=block.html)
+        )
     return tuple(blocks)
 
 
@@ -286,24 +347,31 @@ def normalize_homework_text(text: str) -> str:
     :return: Texte normalisé.
     :rtype: str
     """
-    normalized = re.sub(r"\s+", " ", text)
-    normalized = _TAG_PATTERN.sub("", normalized)
-    return normalized.strip().lower()
+    return _strip_html(text).casefold()
 
 
-def generate_homework_id(due_on: date, normalized_text: str) -> str:
+def generate_homework_id(
+    due_on: date,
+    normalized_text: str,
+    subject: str = "",
+    teachers: tuple[str, ...] = (),
+) -> str:
     """Génère un ID stable pour un devoir.
 
-    L'ID est la clé ``AAAA-MM-JJ|texte_normalisé`` hachée en SHA-1 dont
+    L'ID est la clé ``AAAA-MM-JJ|matière|enseignants|texte_normalisé`` hachée en SHA-1 dont
     on garde les 12 premiers caractères hexadécimaux. Le hachage n'est
     pas utilisé à des fins de sécurité (``usedforsecurity=False``).
 
     :param due_on: Date d'échéance du devoir.
     :param normalized_text: Texte normalisé du devoir.
+    :param subject: Matière du devoir, utile pour distinguer les homonymes.
+    :param teachers: Enseignants du devoir, triés pour garantir la stabilité.
     :return: ID stable (12 caractères hexadécimaux).
     :rtype: str
     """
-    payload = f"{due_on.isoformat()}|{normalized_text}".encode()
+    payload = (
+        f"{due_on.isoformat()}|{subject}|{','.join(sorted(teachers))}|{normalized_text}".encode()
+    )
     return hashlib.sha1(payload, usedforsecurity=False).hexdigest()[:12]
 
 
@@ -313,7 +381,7 @@ def collect_homeworks(lessons: list[Lesson], target_date: date) -> list[Homework
     Passe 1 : les blocs ``due`` (devoirs à faire pour ``target_date``)
     de tous les cours. Passe 2 : les blocs ``assigned`` (devoirs donnés
     le jour cible) des cours du jour ``target_date``. La déduplication
-    se fait par texte normalisé (premier venu, premier servi) et le
+    se fait par texte, matière et enseignants normalisés (premier venu, premier servi) et le
     résultat est trié par matière puis texte.
 
     :param lessons: Liste de tous les cours (VEVENT) parsés.
@@ -321,15 +389,22 @@ def collect_homeworks(lessons: list[Lesson], target_date: date) -> list[Homework
     :return: Liste unique de devoirs, triée par matière puis texte.
     :rtype: list[Homework]
     """
-    by_text: dict[str, Homework] = {}
+    by_context: dict[tuple[str, tuple[str, ...], str], Homework] = {}
 
     for lesson in lessons:
         for block in lesson.homework_blocks:
             if block.kind == "due" and block.date == target_date:
-                key = normalize_homework_text(block.text)
-                if key not in by_text:
-                    by_text[key] = Homework(
-                        id=generate_homework_id(target_date, key),
+                normalized_text = normalize_homework_text(block.text)
+                key = (
+                    lesson.subject.casefold(),
+                    tuple(teacher.casefold() for teacher in lesson.teachers),
+                    normalized_text,
+                )
+                if key not in by_context:
+                    by_context[key] = Homework(
+                        id=generate_homework_id(
+                            target_date, normalized_text, lesson.subject, lesson.teachers
+                        ),
                         subject=lesson.subject,
                         teachers=lesson.teachers,
                         assigned_on=lesson.start.date(),
@@ -343,10 +418,17 @@ def collect_homeworks(lessons: list[Lesson], target_date: date) -> list[Homework
             continue
         for block in lesson.homework_blocks:
             if block.kind == "assigned":
-                key = normalize_homework_text(block.text)
-                if key not in by_text:
-                    by_text[key] = Homework(
-                        id=generate_homework_id(target_date, key),
+                normalized_text = normalize_homework_text(block.text)
+                key = (
+                    lesson.subject.casefold(),
+                    tuple(teacher.casefold() for teacher in lesson.teachers),
+                    normalized_text,
+                )
+                if key not in by_context:
+                    by_context[key] = Homework(
+                        id=generate_homework_id(
+                            target_date, normalized_text, lesson.subject, lesson.teachers
+                        ),
                         subject=lesson.subject,
                         teachers=lesson.teachers,
                         assigned_on=block.date,
@@ -355,7 +437,7 @@ def collect_homeworks(lessons: list[Lesson], target_date: date) -> list[Homework
                         html=block.html,
                     )
 
-    return sorted(by_text.values(), key=lambda hw: (hw.subject.lower(), hw.text.lower()))
+    return sorted(by_context.values(), key=lambda hw: (hw.subject.lower(), hw.text.lower()))
 
 
 def parse_ical(raw_ical: str) -> tuple[list[Lesson], list[Homework], list[SchoolEvent]]:
@@ -399,15 +481,28 @@ def parse_ical(raw_ical: str) -> tuple[list[Lesson], list[Homework], list[School
         else:
             categories = [str(category) for category in categories_obj.cats]
 
-        # Événements de type vacances/congés (tout le jour).
-        if any(cat in ("Congés", "Vacances") for cat in categories):
+        normalized_categories = [_normalize_label(category) for category in categories]
+        holiday_kind: SchoolEventKind | None = None
+        if any(
+            category in ("conges", "vacances", "vacances scolaires")
+            for category in normalized_categories
+        ):
+            holiday_kind = SchoolEventKind.HOLIDAY
+        elif any(
+            category in ("jour ferie", "jours feries", "ferie", "feries")
+            for category in normalized_categories
+        ):
+            holiday_kind = SchoolEventKind.PUBLIC_HOLIDAY
+
+        # Événements de type vacances/congés/jours fériés (tout le jour).
+        if holiday_kind is not None:
             from_date = start.date() if isinstance(start, datetime) else start
             to_date = end.date() if isinstance(end, datetime) else end
             summary = component.get("summary")
             label = str(summary) if summary is not None else ""
             school_events.append(
                 SchoolEvent(
-                    kind=SchoolEventKind.HOLIDAY,
+                    kind=holiday_kind,
                     label=label,
                     from_date=from_date,
                     to_date=to_date,
@@ -422,9 +517,15 @@ def parse_ical(raw_ical: str) -> tuple[list[Lesson], list[Homework], list[School
 
         status_obj = component.get("status")
         status_value = str(status_obj).strip().upper() if status_obj is not None else ""
-        if status_value == "CANCELLED" or "Cours - Cours annulé" in categories:
+        normalized_status_categories = set(normalized_categories)
+        if status_value == "CANCELLED" or any(
+            "annul" in category for category in normalized_status_categories
+        ):
             status = LessonStatus.CANCELLED
-        elif "Cours - Cours déplacé" in categories:
+        elif any(
+            any(token in category for token in ("deplac", "changement de salle", "modifi"))
+            for category in normalized_status_categories
+        ):
             status = LessonStatus.MOVED
         else:
             status = LessonStatus.NORMAL
@@ -458,6 +559,7 @@ def parse_ical(raw_ical: str) -> tuple[list[Lesson], list[Homework], list[School
                 teachers=tuple(lesson_data["teachers"]),
                 rooms=tuple(lesson_data["rooms"]),
                 group=lesson_data["group"],
+                class_part=lesson_data["class_part"],
                 status=status,
                 content=content,
                 homework_blocks=homework_blocks,

pronote_sync/sync/serialization.py

@@ -61,6 +61,10 @@ def lesson_to_vevent(lesson: Lesson) -> Event:
         parts.append(f"Professeur(s): {', '.join(lesson.teachers)}")
     if lesson.rooms:
         parts.append(f"Salle(s): {', '.join(lesson.rooms)}")
+    if lesson.group:
+        parts.append(f"Groupe: {lesson.group}")
+    if lesson.class_part:
+        parts.append(f"Partie(s) de classe: {lesson.class_part}")
     if lesson.content:
         parts.append(f"Contenu: {lesson.content}")
     event.add("description", "\n".join(parts))

tests/fixtures/pronote-variants.ics

@@ -0,0 +1,53 @@
+BEGIN:VCALENDAR
+VERSION:2.0
+PRODID:-//pronote-sync tests//FR
+X-WR-CALNAME:Fixture anonymisée
+BEGIN:VEVENT
+UID:variant-normal
+DTSTART:20260910T080000Z
+DTEND:20260910T090000Z
+SUMMARY:Mathématiques
+CATEGORIES:Cours
+DESCRIPTION:<div>Matière : Mathématiques Professeur(s) : Enseignant A Salle(s) : 101 Groupe : Classe entière Partie(s) de classe : Groupe 1 <strong data-section="content">Contenu pédagogique :</strong><p>Leçon &amp; exemple</p><strong>Pour le 15/09/2026 :</strong><p>Lire le chapitre</p><strong>Donné le 10/09/2026 :</strong><p>Lire le chapitre</p></div>
+END:VEVENT
+BEGIN:VEVENT
+UID:variant-duplicate
+DTSTART:20260910T100000Z
+DTEND:20260910T110000Z
+SUMMARY:Mathématiques
+CATEGORIES:Cours
+DESCRIPTION:<div>Matière : Mathématiques Professeur(s) : Enseignant A Salle(s) : 102 <strong>Pour le 15/09/2026 :</strong><p>Lire le chapitre</p></div>
+END:VEVENT
+BEGIN:VEVENT
+UID:variant-same-text-other-context
+DTSTART:20260910T120000Z
+DTEND:20260910T130000Z
+SUMMARY:Sciences
+CATEGORIES:Cours
+DESCRIPTION:<div>Matière : Sciences Professeur(s) : Enseignant B Salle(s) : 103 <strong>Pour le 15/09/2026 :</strong><p>Lire le chapitre</p></div>
+END:VEVENT
+BEGIN:VEVENT
+UID:variant-moved
+DTSTART:20260911T080000Z
+DTEND:20260911T090000Z
+SUMMARY:Mathématiques
+CATEGORIES:Cours - Cours modifié
+DESCRIPTION:<div>Matière : Mathématiques Professeur : Enseignant A Salle : 204</div>
+END:VEVENT
+BEGIN:VEVENT
+UID:variant-public-holiday
+DTSTART;VALUE=DATE:20260914
+DTEND;VALUE=DATE:20260915
+SUMMARY:Journée fériée anonymisée
+CATEGORIES:Jours fériés
+DESCRIPTION:Journée sans cours.
+END:VEVENT
+BEGIN:VEVENT
+UID:variant-holiday
+DTSTART;VALUE=DATE:20261020
+DTEND;VALUE=DATE:20261022
+SUMMARY:Vacances anonymisées
+CATEGORIES:Congés
+DESCRIPTION:Période de vacances.
+END:VEVENT
+END:VCALENDAR

tests/fixtures/pronote-variants.manifest.json

@@ -0,0 +1,19 @@
+{
+  "version": "fixture-1",
+  "source": "ical",
+  "pronote_version": "2026-unknown",
+  "anonymized": true,
+  "scenarios": {
+    "normal_and_headers": "variant-normal",
+    "duplicate_homework_same_context": ["variant-normal", "variant-duplicate"],
+    "same_text_distinct_context": "variant-same-text-other-context",
+    "moved_lesson": "variant-moved",
+    "public_holiday": "variant-public-holiday",
+    "holiday_exclusive_end": "variant-holiday"
+  },
+  "invariants": [
+    "Aucune valeur d'authentification ou identité réelle n'est présente.",
+    "Les bornes de date d'un événement scolaire sont début inclusif et fin exclusive.",
+    "Les devoirs sont vérifiés après parsing dans les modèles métier finaux."
+  ]
+}

tests/integration/test_xmpp_integration.py

@@ -67,7 +67,7 @@ class FakeClientXMPP:
         :param handler: Fonction gestionnaire.
         :raises: AssertionError si l'événement n'est pas supporté.
         """
-        if name not in ("session_start", "failed_auth", "disconnected"):
+        if name not in ("session_start", "failed_auth", "connection_failed", "disconnected"):
             raise AssertionError(f"Unsupported event: {name}")
         self.handlers.setdefault(name, []).append(handler)
 

tests/unit/test_ical.py

@@ -294,8 +294,8 @@ def test_collect_homeworks_dedup() -> None:
         id="lesson2",
         start=datetime(2026, 9, 10, 10, 0),
         end=datetime(2026, 9, 10, 11, 0),
-        subject="Physique",
-        teachers=("M. Martin",),
+        subject="Math",
+        teachers=("M. Dupont",),
         rooms=("205",),
         group=None,
         status=LessonStatus.NORMAL,
@@ -343,8 +343,8 @@ def test_collect_homeworks_id_stability() -> None:
         id="lesson2",
         start=datetime(2026, 9, 10, 10, 0),
         end=datetime(2026, 9, 10, 11, 0),
-        subject="Physique",
-        teachers=("M. Martin",),
+        subject="Math",
+        teachers=("M. Dupont",),
         rooms=("205",),
         group=None,
         status=LessonStatus.NORMAL,
@@ -361,7 +361,87 @@ def test_collect_homeworks_id_stability() -> None:
 
     homeworks = collect_homeworks([lesson1, lesson2], target_date=date(2026, 9, 10))
     assert len(homeworks) == 1
-    assert homeworks[0].id == generate_homework_id(date(2026, 9, 10), "devoir commun")
+    assert homeworks[0].id == generate_homework_id(
+        date(2026, 9, 10), "devoir commun", "Math", ("M. Dupont",)
+    )
+
+
+def test_collect_homeworks_keeps_distinct_subjects() -> None:
+    """Deux matières différentes conservent deux devoirs homonymes.
+
+    :return: None
+    """
+    lesson = Lesson(
+        id="lesson1",
+        start=datetime(2026, 9, 10, 8, 0),
+        end=datetime(2026, 9, 10, 9, 0),
+        subject="Math",
+        teachers=("M. Dupont",),
+        group=None,
+        content=None,
+        homework_blocks=(
+            HomeworkBlock(
+                kind="due",
+                date=date(2026, 9, 10),
+                text="Devoir commun",
+                html="<p>Devoir commun</p>",
+            ),
+        ),
+    )
+    other_lesson = lesson.model_copy(
+        update={"id": "lesson2", "subject": "Physique", "teachers": ("M. Martin",)}
+    )
+
+    homeworks = collect_homeworks([lesson, other_lesson], target_date=date(2026, 9, 10))
+
+    assert len(homeworks) == 2
+    assert {homework.subject for homework in homeworks} == {"Math", "Physique"}
+
+
+def test_parse_body_accepts_html_variants_and_sanitizes() -> None:
+    """Les attributs HTML, les espaces et le contenu actif sont traités correctement.
+
+    :return: None
+    """
+    body = (
+        '<strong class="label"> Contenu pédagogique : </strong><p>Leçon &amp; exemple</p>'
+        '<strong data-kind="homework"> Pour le 10/09/2026 : </strong>'
+        '<p onclick="evil()">Lire <em>le chapitre</em></p><script>alert(1)</script>'
+        "<strong> Donné le 05/09/2026 : </strong><p>Noter &amp; relire</p>"
+    )
+
+    content, due_blocks, assigned_blocks = parse_body(body)
+
+    assert content == "Leçon & exemple"
+    assert due_blocks[0].date == date(2026, 9, 10)
+    assert due_blocks[0].text == "Lire le chapitre"
+    assert "<em>le chapitre</em>" in due_blocks[0].html
+    assert "onclick" not in due_blocks[0].html
+    assert "script" not in due_blocks[0].html.lower()
+    assert assigned_blocks[0].date == date(2026, 9, 5)
+
+
+def test_parse_anonymized_variants_fixture() -> None:
+    """Vérifie le corpus iCal anonymisé sur les statuts et le contexte des devoirs.
+
+    :return: None
+    """
+    fixture_path = Path(__file__).parent.parent / "fixtures" / "pronote-variants.ics"
+    lessons, _, school_events = parse_ical(fixture_path.read_text(encoding="utf-8"))
+
+    assert lessons[0].class_part == "Groupe 1"
+    assert lessons[0].homework_blocks[0].html == "<p>Lire le chapitre</p>"
+    assert any(lesson.status == LessonStatus.MOVED for lesson in lessons)
+    assert any(event.kind.value == "public_holiday" for event in school_events)
+    assert any(
+        event.from_date == date(2026, 10, 20) and event.to_date == date(2026, 10, 22)
+        for event in school_events
+    )
+
+    homeworks = collect_homeworks(lessons, target_date=date(2026, 9, 15))
+
+    assert len(homeworks) == 2
+    assert {homework.subject for homework in homeworks} == {"Mathématiques", "Sciences"}
 
 
 def test_collect_homeworks_sorted() -> None:

tests/unit/test_xmpp_channel.py

@@ -17,7 +17,7 @@ from unittest.mock import patch
 import pytest
 from pydantic import SecretStr
 
-from pronote_sync.channels.xmpp import XmppChannel, XmppMessage
+from pronote_sync.channels.xmpp import SyncXmppChannel, XmppChannel, XmppMessage
 from pronote_sync.config.settings import XmppSettings
 from pronote_sync.models.agenda import Lesson, TheoreticalLesson
 from pronote_sync.models.blog import BlogArticle, ExternalInfo
@@ -48,11 +48,15 @@ class FakeClientXMPP:
         self._should_disconnect_early = False
         self._host_used: str | None = None
         self._port_used: int | None = None
+        # New modes for realistic failure simulation
+        self._connect_mode: str = "ok"  # "ok", "pending", "connection_failed"
+        self._disconnect_mode: str = "ok"  # "ok", "pending"
+        self._fire_connection_failed: bool = False
 
     def add_event_handler(
         self, name: str, pointer: Callable[..., object], disposable: bool = False
     ) -> None:
-        if name not in ("session_start", "failed_auth", "disconnected"):
+        if name not in ("session_start", "failed_auth", "connection_failed", "disconnected"):
             raise AssertionError(f"Unsupported event: {name}")
         self.handlers.setdefault(name, []).append(pointer)
 
@@ -63,10 +67,24 @@ class FakeClientXMPP:
         self.connected = True
         self._host_used = host
         self._port_used = port
-        # Schedule event handlers to fire after connect returns
-        loop.call_soon(self._fire_events)
-        future.set_result(True)
-        return future
+
+        if self._connect_mode == "pending":
+            # Never resolves - simulates connection timeout
+            return future
+        elif self._connect_mode == "connection_failed":
+            # Resolves connect future but fires connection_failed event
+            loop.call_soon(self._fire_connection_failed_event)
+            future.set_result(True)
+            return future
+        else:
+            # Schedule event handlers to fire after connect returns
+            loop.call_soon(self._fire_events)
+            future.set_result(True)
+            return future
+
+    def _fire_connection_failed_event(self) -> None:
+        """Fire connection_failed event for testing."""
+        self._fire("connection_failed")
 
     def _fire_events(self) -> None:
         if self._should_disconnect_early:
@@ -86,8 +104,13 @@ class FakeClientXMPP:
         loop = asyncio.get_event_loop()
         future: asyncio.Future[bool] = loop.create_future()
         self.disconnected = True
-        future.set_result(True)
-        return future
+
+        if self._disconnect_mode == "pending":
+            # Never resolves - simulates cleanup timeout
+            return future
+        else:
+            future.set_result(True)
+            return future
 
     def send_message(
         self, mto: object, mbody: str | None = None, mtype: str | None = None, **kwargs: object
@@ -681,6 +704,339 @@ class TestXmppChannelSend:
             jid_arg = call_args.args[0]
             assert jid_arg == "bot@example.com/myresource"
 
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    @pytest.mark.asyncio
+    async def test_connect_timeout_returns_false(self, caplog: pytest.LogCaptureFixture) -> None:
+        """Test que connect_timeout retourne False quand connect() ne résout pas.
+
+        :param caplog: Fixture pytest pour capturer les logs.
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="starttls",
+            connect_timeout=0.05,
+            timeout=30,
+            cleanup_timeout=0.01,
+        )
+
+        class PendingConnectClient(FakeClientXMPP):
+            def __init__(self, jid: str, password: str) -> None:
+                super().__init__(jid, password)
+                self._connect_mode = "pending"
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=PendingConnectClient):
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            result = await channel.send_async(msg)
+            assert result is False
+            # Vérifier que le log contient "connexion"
+            logs = caplog.text
+            assert "connexion" in logs.lower()
+
+    @pytest.mark.asyncio
+    async def test_cancelled_error_cancels_pending_tasks(self) -> None:
+        """Test que l'annulation de send_async annule les tâches encore en attente.
+
+        Un ``connect()`` qui ne résout jamais et une annulation de la tâche
+        appelante doivent entraîner la cancellation de la future de connexion
+        (idempotence de ``_cancel_pending`` sur les chemins d'exception).
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="starttls",
+            connect_timeout=15,
+            timeout=30,
+            cleanup_timeout=0.01,
+        )
+
+        class PendingConnectClient(FakeClientXMPP):
+            """Client dont ``connect()`` retourne une future jamais résolue."""
+
+            def __init__(self, jid: str, password: str) -> None:
+                super().__init__(jid, password)
+                self._connect_mode = "pending"
+                self.connect_future: asyncio.Future[bool] | None = None
+
+            def connect(
+                self, host: str | None = None, port: int | None = None
+            ) -> asyncio.Future[bool]:
+                future = super().connect(host, port)
+                self.connect_future = future
+                return future
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=PendingConnectClient):
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            client = PendingConnectClient("bot@example.com", "secret123")
+            with patch("pronote_sync.channels.xmpp.ClientXMPP", new=lambda j, p: client):
+                task = asyncio.ensure_future(channel.send_async(msg))
+                # Laisse asyncio.wait démarrer et la future de connexion rester en attente
+                await asyncio.sleep(0.05)
+                task.cancel()
+                result = await task
+                assert result is False
+                assert client.connect_future is not None
+                assert client.connect_future.cancelled()
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    @pytest.mark.asyncio
+    async def test_connection_failed_event_returns_false(
+        self, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        """Test que connection_failed event retourne False rapidement.
+
+        :param caplog: Fixture pytest pour capturer les logs.
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="starttls",
+            connect_timeout=15,
+            timeout=30,
+            cleanup_timeout=0.01,
+        )
+
+        class ConnectionFailedClient(FakeClientXMPP):
+            def __init__(self, jid: str, password: str) -> None:
+                super().__init__(jid, password)
+                self._connect_mode = "connection_failed"
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=ConnectionFailedClient):
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            result = await channel.send_async(msg)
+            assert result is False
+            # Vérifier que le log contient une mention d'échec réseau
+            logs = caplog.text
+            assert "réseau" in logs.lower() or "connexion" in logs.lower()
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    @pytest.mark.asyncio
+    async def test_cleanup_timeout_does_not_hang(self, caplog: pytest.LogCaptureFixture) -> None:
+        """Test que cleanup_timeout ne bloque pas quand disconnect() ne résout pas.
+
+        :param caplog: Fixture pytest pour capturer les logs.
+        """
+        import logging
+
+        caplog.set_level(logging.DEBUG)
+
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="starttls",
+            connect_timeout=0.05,
+            timeout=30,
+            cleanup_timeout=0.01,
+        )
+
+        class HangingDisconnectClient(FakeClientXMPP):
+            def __init__(self, jid: str, password: str) -> None:
+                super().__init__(jid, password)
+                self._disconnect_mode = "pending"
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=HangingDisconnectClient):
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            # Should complete quickly despite hanging disconnect
+            result = await asyncio.wait_for(channel.send_async(msg), timeout=0.5)
+            assert result is True
+            # Vérifier que le log contient une mention de timeout de nettoyage
+            logs = caplog.text
+            assert "déconnexion" in logs.lower()
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    @pytest.mark.asyncio
+    async def test_tls_mode_direct_config(self) -> None:
+        """Test que tls_mode='direct' configure enable_direct_tls=True et enable_starttls=False.
+
+        :return: None
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="direct",
+            timeout=30,
+        )
+
+        class InspectClient(FakeClientXMPP):
+            def __init__(self, jid: str, password: str) -> None:
+                super().__init__(jid, password)
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP") as mock_cls:
+            mock_cls.return_value = InspectClient("bot@example.com", "secret123")
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            await channel.send_async(msg)
+            client_instance = mock_cls.return_value
+            assert client_instance.enable_direct_tls is True
+            assert client_instance.enable_starttls is False
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    @pytest.mark.asyncio
+    async def test_tls_mode_starttls_config(self) -> None:
+        """Test que tls_mode='starttls' configure enable_starttls=True et enable_direct_tls=False.
+
+        :return: None
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="starttls",
+            timeout=30,
+        )
+
+        class InspectClient(FakeClientXMPP):
+            def __init__(self, jid: str, password: str) -> None:
+                super().__init__(jid, password)
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP") as mock_cls:
+            mock_cls.return_value = InspectClient("bot@example.com", "secret123")
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            await channel.send_async(msg)
+            client_instance = mock_cls.return_value
+            assert client_instance.enable_starttls is True
+            assert client_instance.enable_direct_tls is False
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    @pytest.mark.asyncio
+    async def test_tls_mode_disabled_config(self) -> None:
+        """Test que tls_mode='disabled' avec host='127.0.0.1' configure TLS désactivé.
+
+        :return: None
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="127.0.0.1",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="disabled",
+            timeout=30,
+        )
+
+        class InspectClient(FakeClientXMPP):
+            def __init__(self, jid: str, password: str) -> None:
+                super().__init__(jid, password)
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP") as mock_cls:
+            mock_cls.return_value = InspectClient("bot@example.com", "secret123")
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            await channel.send_async(msg)
+            client_instance = mock_cls.return_value
+            assert client_instance.enable_direct_tls is False
+            assert client_instance.enable_starttls is False
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    @pytest.mark.asyncio
+    async def test_no_secret_leak_in_connection_failure_log(
+        self, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        """Test qu'aucun secret ne fuit dans les logs en cas d'échec de connexion.
+
+        :param caplog: Fixture pytest pour capturer les logs.
+        """
+        sentinel_password = "SECRET_PASSWORD_XMPP_12345"  # pragma: allowlist secret
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr(sentinel_password),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="starttls",
+            timeout=30,
+        )
+
+        class ConnectionFailedClient(FakeClientXMPP):
+            def __init__(self, jid: str, password: str) -> None:
+                super().__init__(jid, password)
+                self._connect_mode = "connection_failed"
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=ConnectionFailedClient):
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            await channel.send_async(msg)
+
+        # Vérifier que le mot de passe sentinelle n'apparaît pas dans les logs
+        logs = caplog.text
+        assert sentinel_password not in logs
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    @pytest.mark.asyncio
+    async def test_no_secret_leak_in_connect_timeout_log(
+        self, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        """Test qu'aucun secret ne fuit dans les logs en cas de timeout de connexion.
+
+        :param caplog: Fixture pytest pour capturer les logs.
+        """
+        sentinel_password = "SECRET_PASSWORD_XMPP_12345"
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr(sentinel_password),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="starttls",
+            connect_timeout=0.05,
+            timeout=30,
+            cleanup_timeout=0.01,
+        )
+
+        class PendingConnectClient(FakeClientXMPP):
+            def __init__(self, jid: str, password: str) -> None:
+                super().__init__(jid, password)
+                self._connect_mode = "pending"
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=PendingConnectClient):
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            await channel.send_async(msg)
+
+        # Vérifier que le mot de passe sentinelle n'apparaît pas dans les logs
+        logs = caplog.text
+        assert sentinel_password not in logs
+
     @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
     @pytest.mark.asyncio
     async def test_send_async_tls_direct_config(self) -> None:
@@ -816,6 +1172,328 @@ class TestXmppChannelSend:
             result = await channel.send_async(msg)
             assert result is True
 
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    @pytest.mark.asyncio
+    async def test_send_async_connect_raises_exception_returns_false(self) -> None:
+        """Test que connect() levant une exception retourne False.
+
+        :return: None
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="starttls",
+            timeout=30,
+        )
+
+        class ConnectExceptionClient(FakeClientXMPP):
+            def connect(
+                self, host: str | None = None, port: int | None = None
+            ) -> asyncio.Future[bool]:
+                raise ConnectionError("Network unreachable")
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=ConnectExceptionClient):
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            result = await channel.send_async(msg)
+            assert result is False
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    @pytest.mark.asyncio
+    async def test_send_async_connect_future_error_returns_false(
+        self, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        """Test que la future de connect() résolue avec une exception retourne False.
+
+        Le message d'erreur doit être expurgé et ne pas contenir les secrets.
+
+        :param caplog: Fixture pytest pour capturer les logs.
+        """
+        sentinel_password = "SECRET_PASSWORD_XMPP_CONNECT_FUT"  # pragma: allowlist secret
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr(sentinel_password),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="starttls",
+            timeout=30,
+        )
+
+        class ConnectFutureErrorClient(FakeClientXMPP):
+            def connect(
+                self, host: str | None = None, port: int | None = None
+            ) -> asyncio.Future[bool]:
+                loop = asyncio.get_event_loop()
+                future: asyncio.Future[bool] = loop.create_future()
+                future.set_exception(ConnectionError("Network unreachable"))
+                return future
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=ConnectFutureErrorClient):
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            result = await channel.send_async(msg)
+            assert result is False
+            assert "Échec de connexion XMPP" in caplog.text
+            assert sentinel_password not in caplog.text
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    @pytest.mark.asyncio
+    async def test_send_async_session_failure_after_connect_returns_false(
+        self, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        """Test qu'un échec de session après connexion résolue retourne False.
+
+        Le connect future est résolu avec succès, puis l'événement
+        ``failed_auth`` arrive pendant l'attente de session.
+
+        :param caplog: Fixture pytest pour capturer les logs.
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="starttls",
+            timeout=5,
+            cleanup_timeout=0.01,
+        )
+
+        class LateAuthFailClient(FakeClientXMPP):
+            def connect(
+                self, host: str | None = None, port: int | None = None
+            ) -> asyncio.Future[bool]:
+                loop = asyncio.get_event_loop()
+                future: asyncio.Future[bool] = loop.create_future()
+                self.connected = True
+                self._host_used = host
+                self._port_used = port
+                loop.call_later(0.01, lambda: self._fire("failed_auth"))
+                future.set_result(True)
+                return future
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=LateAuthFailClient):
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            result = await channel.send_async(msg)
+            assert result is False
+            assert "authentification" in caplog.text.lower()
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    @pytest.mark.asyncio
+    async def test_send_async_cancelled_returns_false(
+        self, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        """Test que l'annulation de la tâche retourne False sans lever.
+
+        Le contrat du canal impose un retour booléen : ``CancelledError`` doit
+        être interceptée et convertie en ``False``.
+
+        :param caplog: Fixture pytest pour capturer les logs.
+        """
+        import logging
+
+        caplog.set_level(logging.DEBUG)
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            tls_mode="starttls",
+            connect_timeout=15,
+            timeout=30,
+            cleanup_timeout=0.01,
+        )
+
+        class PendingConnectClient(FakeClientXMPP):
+            def __init__(self, jid: str, password: str) -> None:
+                super().__init__(jid, password)
+                self._connect_mode = "pending"
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=PendingConnectClient):
+            channel = XmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            task = asyncio.ensure_future(channel.send_async(msg))
+            await asyncio.sleep(0.001)
+            task.cancel()
+            result = await asyncio.wait_for(task, timeout=1.0)
+            assert result is False
+            assert "annulé" in caplog.text.lower()
+
+
+class TestSecretValues:
+    """Tests pour la fonction _secret_values."""
+
+    def test_secret_values_with_all_secrets(self) -> None:
+        """Test que _secret_values retourne tous les secrets.
+
+        :return: None
+        """
+        from pronote_sync.channels.xmpp import _secret_values
+
+        settings = XmppSettings(
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            to="parent@example.com",
+        )
+        secrets = _secret_values(settings)
+        assert len(secrets) == 3
+        assert "bot@example.com" in secrets
+        assert settings.password in secrets
+        assert "parent@example.com" in secrets
+
+    def test_secret_values_with_none_values(self) -> None:
+        """Test que _secret_values filtre les valeurs None.
+
+        :return: None
+        """
+        from pronote_sync.channels.xmpp import _secret_values
+
+        settings = XmppSettings(
+            jid=None,
+            password=None,
+            to=None,
+        )
+        secrets = _secret_values(settings)
+        assert len(secrets) == 0
+
+    def test_secret_values_with_some_none(self) -> None:
+        """Test que _secret_values gère les valeurs partiellement None.
+
+        :return: None
+        """
+        from pronote_sync.channels.xmpp import _secret_values
+
+        settings = XmppSettings(
+            jid="bot@example.com",
+            password=None,
+            to="parent@example.com",
+        )
+        secrets = _secret_values(settings)
+        assert len(secrets) == 2
+        assert "bot@example.com" in secrets
+        assert "parent@example.com" in secrets
+
+
+class TestSyncXmppChannel:
+    """Tests unitaires pour la classe SyncXmppChannel."""
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    def test_sync_send_dry_run_returns_true(self) -> None:
+        """Test que SyncXmppChannel en dry_run retourne True.
+
+        :return: None
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            use_tls=True,
+            timeout=30,
+        )
+        channel = SyncXmppChannel(settings, dry_run=True)
+        msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+        result = channel.send(msg)
+        assert result is True
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    def test_sync_send_success_returns_true(self) -> None:
+        """Test que SyncXmppChannel.send retourne True en cas de succès.
+
+        :return: None
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            use_tls=True,
+            timeout=30,
+        )
+        channel = SyncXmppChannel(settings, dry_run=False)
+        msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+        result = channel.send(msg)
+        assert result is True
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    def test_sync_send_exception_returns_false(self) -> None:
+        """Test que SyncXmppChannel.send retourne False en cas d'exception.
+
+        :return: None
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            use_tls=True,
+            timeout=30,
+        )
+
+        class ErrorClient(FakeClientXMPP):
+            def connect(
+                self, host: str | None = None, port: int | None = None
+            ) -> asyncio.Future[bool]:
+                raise RuntimeError("Connection failed")
+
+        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=ErrorClient):
+            channel = SyncXmppChannel(settings, dry_run=False)
+            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+            result = channel.send(msg)
+            assert result is False
+
+    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
+    def test_sync_send_asyncio_run_error_returns_false(
+        self, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        """Test que send retourne False si asyncio.run lève une exception.
+
+        :param caplog: Fixture pytest pour capturer les logs.
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("secret123"),
+            host="xmpp.example.com",
+            port=5222,
+            to="parent@example.com",
+            resource="pronote-sync",
+            use_tls=True,
+            timeout=30,
+        )
+        channel = SyncXmppChannel(settings, dry_run=False)
+        msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
+        with patch(
+            "pronote_sync.channels.xmpp.asyncio.run",
+            side_effect=RuntimeError("Boucle événementielle indisponible"),
+        ):
+            result = channel.send(msg)
+        assert result is False
+        assert "erreur" in caplog.text.lower()
+
 
 class TestXmppChannelSecurity:
     """Tests de sécurité pour XmppChannel (non-fuite de secrets).

tests/unit/test_xmpp_settings.py

@@ -99,19 +99,52 @@ class TestTimeoutConstraints:
 class TestTlsPolicy:
     """Tests de la politique TLS pour le champ use_tls."""
 
-    def test_use_tls_false_with_remote_host_rejected(self) -> None:
-        """Vérifie que use_tls=False avec un hôte distant est rejeté.
+    def test_tls_disabled_with_remote_host_rejected(self) -> None:
+        """Vérifie que tls_mode="disabled" avec un hôte distant est rejeté.
 
-        :raises ValidationError: Si use_tls=False et host n'est pas une boucle locale.
+        :raises ValidationError: Si tls_mode="disabled" et host n'est pas une boucle locale.
         """
         with pytest.raises(ValidationError) as exc_info:
-            XmppSettings(use_tls=False, host="talk.example.com")
-        assert "use_tls" in str(exc_info.value).lower() or "tls" in str(exc_info.value).lower()
+            XmppSettings(tls_mode="disabled", host="talk.example.com")
+        assert "tls" in str(exc_info.value).lower()
 
-    def test_use_tls_false_with_remote_host_rejected_when_enabled(self) -> None:
+    def test_tls_disabled_with_remote_host_rejected_when_enabled(self) -> None:
         """Vérifie que la politique TLS s'applique même quand le canal est activé."""
         with pytest.raises(ValidationError):
-            XmppSettings(enabled=True, use_tls=False, host="talk.example.com")
+            XmppSettings(enabled=True, tls_mode="disabled", host="talk.example.com")
+
+    def test_use_tls_false_maps_to_starttls(self) -> None:
+        """Vérifie que l'alias obsolète use_tls=False mappe vers tls_mode='starttls'.
+
+        :return: Vérifie le mapping et l'émission d'un DeprecationWarning.
+        :rtype: None
+        """
+        with pytest.warns(DeprecationWarning):
+            settings = XmppSettings(use_tls=False, host="talk.example.com")
+        assert settings.tls_mode == "starttls"
+        assert settings.host == "talk.example.com"
+
+    def test_use_tls_true_maps_to_direct(self) -> None:
+        """Vérifie que l'alias obsolète use_tls=True mappe vers tls_mode='direct'.
+
+        :return: Vérifie le mapping et l'émission d'un DeprecationWarning.
+        :rtype: None
+        """
+        with pytest.warns(DeprecationWarning):
+            settings = XmppSettings(use_tls=True, host="talk.example.com")
+        assert settings.tls_mode == "direct"
+        assert settings.host == "talk.example.com"
+
+    def test_default_tls_mode_is_starttls(self) -> None:
+        """Vérifie que tls_mode vaut 'starttls' par défaut avec les timeouts par défaut.
+
+        :return: Vérifie tls_mode='starttls', connect_timeout=15, cleanup_timeout=10.
+        :rtype: None
+        """
+        settings = XmppSettings()
+        assert settings.tls_mode == "starttls"
+        assert settings.connect_timeout == 15
+        assert settings.cleanup_timeout == 10
 
     def test_use_tls_false_with_localhost_allowed(self) -> None:
         """Vérifie que use_tls=False avec localhost est autorisé.
@@ -120,7 +153,7 @@ class TestTlsPolicy:
         :rtype: None
         """
         settings = XmppSettings(use_tls=False, host="localhost")
-        assert settings.use_tls is False
+        assert settings.tls_mode == "starttls"
         assert settings.host == "localhost"
 
     def test_use_tls_false_with_127_allowed(self) -> None:
@@ -130,7 +163,7 @@ class TestTlsPolicy:
         :rtype: None
         """
         settings = XmppSettings(use_tls=False, host="127.0.0.1")
-        assert settings.use_tls is False
+        assert settings.tls_mode == "starttls"
         assert settings.host == "127.0.0.1"
 
     def test_use_tls_false_with_ipv6_loopback_allowed(self) -> None:
@@ -140,7 +173,7 @@ class TestTlsPolicy:
         :rtype: None
         """
         settings = XmppSettings(use_tls=False, host="::1")
-        assert settings.use_tls is False
+        assert settings.tls_mode == "starttls"
         assert settings.host == "::1"
 
     def test_use_tls_true_with_remote_host_allowed(self) -> None:
@@ -150,7 +183,7 @@ class TestTlsPolicy:
         :rtype: None
         """
         settings = XmppSettings(use_tls=True, host="talk.example.com")
-        assert settings.use_tls is True
+        assert settings.tls_mode == "direct"
         assert settings.host == "talk.example.com"
 
     def test_use_tls_true_with_empty_host_allowed(self) -> None:
@@ -160,7 +193,7 @@ class TestTlsPolicy:
         :rtype: None
         """
         settings = XmppSettings(use_tls=True, host="")
-        assert settings.use_tls is True
+        assert settings.tls_mode == "direct"
         assert settings.host == ""
 
 
@@ -173,7 +206,7 @@ class TestNoSecretInErrorMessages:
         Crée une instance avec des valeurs sensibles et vérifie que l'erreur de validation
         ne contient pas ces valeurs dans son message.
 
-        :raises ValidationError: Si use_tls=False avec un hôte non-local.
+        :raises ValidationError: Si tls_mode="disabled" avec un hôte non-local.
         :return: Vérifie que le message d'erreur ne contient pas les secrets.
         :rtype: None
         """
@@ -184,7 +217,7 @@ class TestNoSecretInErrorMessages:
 
         with pytest.raises(ValidationError) as exc_info:
             XmppSettings(
-                use_tls=False,
+                tls_mode="disabled",
                 host="talk.example.com",
                 jid=sentinel_jid,
                 password=sentinel_password,
@@ -197,3 +230,72 @@ class TestNoSecretInErrorMessages:
         assert "test_password_123" not in error_message
         assert "test_to@example.com" not in error_message
         assert "secret" not in error_message
+
+
+class TestXmppSettingsTlsMode:
+    """Tests supplémentaires pour les validateurs de XmppSettings."""
+
+    def test_use_tls_true_maps_to_direct_with_warning(self) -> None:
+        """Vérifie que use_tls=True mappe vers tls_mode='direct' avec DeprecationWarning.
+
+        :return: Vérifie le mapping et l'émission d'un DeprecationWarning.
+        :rtype: None
+        """
+        with pytest.warns(DeprecationWarning):
+            settings = XmppSettings(use_tls=True, host="talk.example.com")
+        assert settings.tls_mode == "direct"
+
+    def test_use_tls_false_maps_to_starttls_with_warning(self) -> None:
+        """Vérifie que use_tls=False mappe vers tls_mode='starttls' avec DeprecationWarning.
+
+        :return: Vérifie le mapping et l'émission d'un DeprecationWarning.
+        :rtype: None
+        """
+        with pytest.warns(DeprecationWarning):
+            settings = XmppSettings(use_tls=False, host="talk.example.com")
+        assert settings.tls_mode == "starttls"
+
+    def test_tls_mode_disabled_rejected_for_remote(self) -> None:
+        """Vérifie que tls_mode='disabled' avec un hôte distant est rejeté.
+
+        :raises ValidationError: Si tls_mode="disabled" et host n'est pas une boucle locale.
+        """
+        with pytest.raises(ValidationError) as exc_info:
+            XmppSettings(tls_mode="disabled", host="example.com")
+        assert "tls" in str(exc_info.value).lower()
+
+    def test_tls_mode_disabled_allowed_for_loopback(self) -> None:
+        """Vérifie que tls_mode='disabled' avec host='127.0.0.1' est valide.
+
+        :return: Vérifie que XmppSettings(tls_mode='disabled', host='127.0.0.1') est valide.
+        :rtype: None
+        """
+        settings = XmppSettings(tls_mode="disabled", host="127.0.0.1")
+        assert settings.tls_mode == "disabled"
+        assert settings.host == "127.0.0.1"
+
+    def test_connect_timeout_must_be_positive(self) -> None:
+        """Vérifie que connect_timeout doit être strictement positif.
+
+        :raises ValidationError: Si connect_timeout <= 0.
+        """
+        with pytest.raises(ValidationError) as exc_info:
+            XmppSettings(connect_timeout=0)
+        assert "connect_timeout" in str(exc_info.value).lower()
+
+        with pytest.raises(ValidationError) as exc_info:
+            XmppSettings(connect_timeout=-1)
+        assert "connect_timeout" in str(exc_info.value).lower()
+
+    def test_cleanup_timeout_must_be_positive(self) -> None:
+        """Vérifie que cleanup_timeout doit être strictement positif.
+
+        :raises ValidationError: Si cleanup_timeout <= 0.
+        """
+        with pytest.raises(ValidationError) as exc_info:
+            XmppSettings(cleanup_timeout=0)
+        assert "cleanup_timeout" in str(exc_info.value).lower()
+
+        with pytest.raises(ValidationError) as exc_info:
+            XmppSettings(cleanup_timeout=-1)
+        assert "cleanup_timeout" in str(exc_info.value).lower()