fix(clients): resolve file import dialog error and SSE 401

File import (Bug 1):
- CrmAIAssistant had its own <input type="file"> that called onFileUpload
onChange, which then called .click() on #crm-file-upload — a second
programmatic file dialog triggered from an onChange handler. Chrome 126+
blocks this as it lacks a direct "user activation".
- Fix: replace the embedded <input> with <label htmlFor="crm-file-upload">
so the click routes directly to FileImporter's input. Remove the
now-unused onFileUpload prop entirely.

SSE 401 (Bug 2):
- EventSource (browser API) cannot send custom headers — the JWT token
never reached the server, causing a 401 on every SSE connection.
- Fix: pass the token as ?token= query param in the EventSource URL
(MainLayout + CrmConversationalDashboard).
- Backend: verifyJwt now injects the query param token into the
Authorization header before calling jwtVerify(), so no route changes
are needed.

apps/admin/src/components/crm/CrmAIAssistant.tsx

@@ -13,7 +13,6 @@ interface CrmAIAssistantProps {
     isUploading: boolean;
     isGenerating: boolean;
     isDragging: boolean;
-    onFileUpload: () => void;
     onDragOver: (e: React.DragEvent) => void;
     onDragLeave: () => void;
     onDrop: (e: React.DragEvent) => void;
@@ -41,7 +40,6 @@ export default function CrmAIAssistant({
     isUploading,
     isGenerating,
     isDragging,
-    onFileUpload,
     onDragOver,
     onDragLeave,
     onDrop,
@@ -107,14 +105,8 @@ export default function CrmAIAssistant({
                                 <h3 className="text-lg font-black text-slate-900">Glissez-déposez ici</h3>
                                 <p className="text-sm text-slate-400 mt-2 mb-8 font-medium">Fichiers .xlsx, .xls ou .csv</p>
                                 
-                                <label className="bg-slate-900 text-white px-8 py-4 rounded-2xl font-bold text-sm cursor-pointer hover:bg-slate-800 transition shadow-xl shadow-slate-200 active:scale-95">
+                                <label htmlFor="crm-file-upload" className="bg-slate-900 text-white px-8 py-4 rounded-2xl font-bold text-sm cursor-pointer hover:bg-slate-800 transition shadow-xl shadow-slate-200 active:scale-95">
                                     Parcourir mes fichiers
-                                    <input 
-                                        type="file" 
-                                        className="hidden" 
-                                        accept=".xlsx,.xls,.csv" 
-                                        onChange={() => onFileUpload()}
-                                    />
                                 </label>
                             </div>
                         )}

apps/admin/src/components/layouts/MainLayout.tsx

@@ -30,7 +30,7 @@ function useAdminChatPage(): AdminChatPage | null {
 
 export default function MainLayout({ children, isSuperAdmin, orgs }: MainLayoutProps) {
     const { t } = useTranslation();
-    const { logout, user } = useAuth();
+    const { logout, user, token } = useAuth();
     const { selectedOrgId, setSelectedOrgId, currentOrg } = useTenant();
     const [sidebarOpen, setSidebarOpen] = useState(false);
     const [unreadCount, setUnreadCount] = useState(0);
@@ -50,9 +50,9 @@ export default function MainLayout({ children, isSuperAdmin, orgs }: MainLayoutP
 
     // SSE — track new inbound messages for the notification badge
     useEffect(() => {
-        if (!selectedOrgId) return;
+        if (!selectedOrgId || !token) return;
         const apiBase = import.meta.env.VITE_API_URL || '';
-        const es = new EventSource(`${apiBase}/v1/organizations/${selectedOrgId}/stream`);
+        const es = new EventSource(`${apiBase}/v1/organizations/${selectedOrgId}/stream?token=${encodeURIComponent(token)}`);
         esRef.current = es;
         es.addEventListener('message', (event) => {
             try {
@@ -68,7 +68,7 @@ export default function MainLayout({ children, isSuperAdmin, orgs }: MainLayoutP
         });
         es.onerror = () => es.close();
         return () => { es.close(); esRef.current = null; };
-    }, [selectedOrgId]);
+    }, [selectedOrgId, token]);
 
     const navItems = [
         { to: '/',                  label: t('nav.home'),          icon: <BarChart2 className="w-4 h-4" />,                        end: true },

apps/admin/src/pages/CrmConversationalDashboard.tsx

@@ -68,7 +68,7 @@ export default function CrmConversationalDashboard() {
     useEffect(() => {
         if (!selectedOrgId || !token) return;
         const apiBase = import.meta.env.VITE_API_URL || '';
-        const url = `${apiBase}/v1/organizations/${selectedOrgId}/stream`;
+        const url = `${apiBase}/v1/organizations/${selectedOrgId}/stream?token=${encodeURIComponent(token)}`;
         const es = new EventSource(url);
         es.addEventListener('message', (event) => {
             try {
@@ -198,7 +198,6 @@ export default function CrmConversationalDashboard() {
                             isUploading={isUploading}
                             isGenerating={isGenerating}
                             isDragging={isDragging}
-                            onFileUpload={() => document.getElementById('crm-file-upload')?.click()}
                             onDragOver={(e) => { e.preventDefault(); setIsDragging(true); }}
                             onDragLeave={() => setIsDragging(false)}
                             onDrop={(e) => {

apps/api/src/middleware/verifyJwt.ts

@@ -6,9 +6,14 @@ import { FastifyRequest, FastifyReply } from 'fastify';
  */
 export const verifyJwt = async (request: FastifyRequest, reply: FastifyReply) => {
     try {
+        // EventSource (SSE) cannot send custom headers — accept JWT as ?token= query param fallback
+        const queryToken = (request.query as Record<string, string>)?.token;
+        if (queryToken && !request.headers.authorization) {
+            request.headers.authorization = `Bearer ${queryToken}`;
+        }
         await request.jwtVerify();
     } catch (err) {
         reply.code(401).send({ error: 'Unauthorized', message: 'Invalid or missing token' });
-        throw err; // Stop further execution in the hook chain
+        throw err;
     }
 };