Merge immortal/main into audit branch

app/routes/users/availability.py

@@ -141,41 +141,41 @@ def add_disponibility():
 @json_endpoint
 @login_required
 def add_disponibilities_bulk():
-    """Add multiple disponibility blocks at once."""
+    """Replace the current player's disponibility blocks atomically."""
     data = request.get_json(silent=True) or {}
     accepted, rejected = _load_slots(data.get('slots'))
 
+    if rejected:
+        return jsonify(
+            {
+                'error': 'Invalid slots; nothing was changed.',
+                'rejected': rejected,
+            }
+        ), 400
+
+    PlayerDisponibility.query.filter_by(player_id=current_user.id).delete()
+
     created = []
     for slot in accepted:
         start_time = slot['start_time']
-        existing = PlayerDisponibility.query.filter_by(
+        disponibility = PlayerDisponibility(
             player_id=current_user.id,
             day_of_week=slot['day_of_week'],
             start_time=start_time,
-        ).first()
-        if not existing:
-            disponibility = PlayerDisponibility(
-                player_id=current_user.id,
-                day_of_week=slot['day_of_week'],
-                start_time=start_time,
-                end_time=slot_end(start_time),
-            )
-            db.session.add(disponibility)
-            db.session.flush()
-            created.append(
-                {
-                    'id': disponibility.id,
-                    'day_of_week': disponibility.day_of_week,
-                    'day_name': day_name(disponibility.day_of_week),
-                    'start_time': disponibility.start_time.strftime('%H:%M'),
-                }
-            )
+            end_time=slot_end(start_time),
+        )
+        db.session.add(disponibility)
+        db.session.flush()
+        created.append(
+            {
+                'id': disponibility.id,
+                'day_of_week': disponibility.day_of_week,
+                'day_name': day_name(disponibility.day_of_week),
+                'start_time': disponibility.start_time.strftime('%H:%M'),
+            }
+        )
     db.session.commit()
-    # `rejected` is reported rather than swallowed. What was accepted is
-    # still saved — dropping a whole batch because one cell was malformed
-    # would be its own kind of surprise — but the client can now tell the
-    # difference between "nine slots saved" and "ten sent, nine saved".
-    return jsonify({'success': True, 'created': created, 'rejected': rejected})
+    return jsonify({'success': True, 'created': created, 'rejected': []})
 
 
 @users_bp.route('/disponibilities/clear', methods=['POST'])

app/templates/pages/profile.html

@@ -193,9 +193,6 @@
                 <p class="text-muted">{{ _('Loading...') }}</p>
             </div>
             <div class="form-actions">
-                <button type="button" class="btn btn-primary" data-action="save-disponibilities">
-                    <i class="fas fa-save"></i> {{ _('Save Disponibilities') }}
-                </button>
                 <button type="button" class="btn btn-secondary" data-action="clear-disponibilities">
                     <i class="fas fa-trash"></i> {{ _('Clear All') }}
                 </button>
@@ -369,7 +366,7 @@ function saveCoachAvailability() {
             const msg = document.createElement('div');
             msg.className = 'alert alert-success';
             msg.style.marginTop = '10px';
-            msg.innerHTML = '<i class="fas fa-check"></i> Availability saved!';
+            msg.innerHTML = '<span><i class="fas fa-check"></i> Availability saved!</span>';
             document.getElementById('availability-grid').appendChild(msg);
             setTimeout(() => msg.remove(), 3000);
         }
@@ -571,7 +568,7 @@ function saveDisponibilities() {
             var msg = document.createElement('div');
             msg.className = 'alert alert-success';
             msg.style.marginTop = '10px';
-            msg.innerHTML = '<i class="fas fa-check"></i> Disponibilities saved successfully!';
+            msg.innerHTML = '<span><i class="fas fa-check"></i> Disponibilities saved successfully!</span>';
             document.getElementById('disponibilities-grid').appendChild(msg);
             setTimeout(function() { msg.remove(); }, 3000);
         }
@@ -610,7 +607,6 @@ document.addEventListener('DOMContentLoaded', function() {
 // dispatched by the delegated listener in main.js. This replaces inline
 // onclick attributes, which no CSP nonce is able to authorise.
 registerActions({
-    'save-disponibilities': saveDisponibilities,
     'clear-disponibilities': clearDisponibilities,
     'clear-availability': clearAllAvailability,
 });