From 09453199b8edeaf3af9f0fd53c66eb3273ee7b7b Mon Sep 17 00:00:00 2001
From: GGThed <mafiaggia@outlook.com>
Date: Fri, 7 Aug 2026 20:51:07 -0400
Subject: [PATCH] refactor(csp): migrer dix gabarits vers les comportements
 declaratifs

OPS-010, suite. 76 gestionnaires en ligne -> 52, dans 5 gabarits au lieu de
15. Le cliquet de tests/test_csp.py est abaisse en consequence.

Six motifs recurrents, generalises dans main.js plutot que traites un a un
  data-action        clic, resolu par un ecouteur delegue
  data-change        changement -- attribut distinct du clic, sans quoi un
                     <select> declencherait son gestionnaire des le clic
                     qui l'ouvre
  data-confirm       confirmation avant un envoi destructeur, en
                     remplacement de onsubmit="return confirm(...)". Le
                     texte reste dans le markup, donc traduisible.
  data-navigate      navigation sur selection, {value} etant encode
  remove-element     suppression d'un ancetre designe par data-remove
  history-back       retour arriere

registerActions()
  Les fonctions propres a une page vivent dans son bloc de script et ne
  peuvent donc pas figurer dans la table globale. Chaque page declare les
  siennes, l'ecouteur delegue reste unique.

Cas particulier, coach_availability
  Le gestionnaire y etait construit dans une chaine JavaScript, au moment
  de generer la grille de creneaux. Le markup portait deja data-day et
  data-time : toggleSlot lit desormais ses arguments depuis l'element, ce
  qui supprime a la fois l'attribut en ligne et la concatenation.

Gabarits migres : my_teams, register, users, view_user, one_on_one,
coach_availability, profile, team_matches, notes, contracts.

Restent, par ordre decroissant : match_form 13, calendar 11, teams 11,
evaluate_player 9, view_tryout 8.

Syntaxe JavaScript de chaque bloc modifie verifiee par node --check.

A noter : la traduction de ces dix gabarits reste a faire. Seules les deux
chaines devenues visibles dans le markup au cours de cette migration -- les
messages de confirmation de suppression -- sont balisees et traduites.

192 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 app/static/js/main.js                       |  70 +++++++++++++++++++-
 app/templates/pages/coach_availability.html |  18 +++--
 app/templates/pages/contracts.html          |  18 +++--
 app/templates/pages/my_teams.html           |   9 ++-
 app/templates/pages/notes.html              |  18 +++--
 app/templates/pages/one_on_one.html         |  12 +++-
 app/templates/pages/profile.html            |  15 ++++-
 app/templates/pages/register.html           |   9 ++-
 app/templates/pages/team_matches.html       |  15 +++--
 app/templates/pages/users.html              |   2 +-
 app/templates/pages/view_user.html          |   2 +-
 app/translations/en/LC_MESSAGES/messages.mo | Bin 5578 -> 5728 bytes
 app/translations/en/LC_MESSAGES/messages.po |  11 ++-
 app/translations/fr/LC_MESSAGES/messages.mo | Bin 5958 -> 6123 bytes
 app/translations/fr/LC_MESSAGES/messages.po |  11 ++-
 tests/test_csp.py                           |  10 ---
 16 files changed, 180 insertions(+), 40 deletions(-)

diff --git a/app/static/js/main.js b/app/static/js/main.js
index dcd17d2..6c51c6b 100644
--- a/app/static/js/main.js
+++ b/app/static/js/main.js
@@ -481,15 +481,79 @@ const DATA_ACTIONS = {
         event.preventDefault();
         history.back();
     },
+    // Removes the nearest ancestor matching data-remove, or the parent.
+    'remove-element': function (element) {
+        const selector = element.getAttribute('data-remove');
+        const target = selector ? element.closest(selector) : element.parentElement;
+        if (target) {
+            target.remove();
+        }
+    },
 };
 
-document.addEventListener('click', function (event) {
-    const trigger = event.target.closest('[data-action]');
+/**
+ * Register behaviours defined by a single page.
+ *
+ * Page-local functions live in that page's script block, so they cannot be
+ * listed in DATA_ACTIONS above. Each page declares its own:
+ *
+ *     registerActions({ 'clear-availability': clearAllAvailability });
+ *
+ * @param {Object} map - action name to handler(element, event).
+ */
+function registerActions(map) {
+    Object.assign(DATA_ACTIONS, map);
+}
+
+function dispatchAction(attribute, event) {
+    const trigger = event.target.closest('[' + attribute + ']');
     if (!trigger) {
         return;
     }
-    const handler = DATA_ACTIONS[trigger.getAttribute('data-action')];
+    const handler = DATA_ACTIONS[trigger.getAttribute(attribute)];
     if (handler) {
         handler(trigger, event);
     }
+}
+
+document.addEventListener('click', function (event) {
+    dispatchAction('data-action', event);
+});
+
+// Separate attribute rather than one shared with click: a <select> would
+// otherwise fire its handler on the click that opens it.
+document.addEventListener('change', function (event) {
+    dispatchAction('data-change', event);
+});
+
+/**
+ * Confirmation before a destructive submit.
+ *
+ *     <form data-confirm="Delete this match?">
+ *
+ * Replaces onsubmit="return confirm(...)", and keeps the wording in the
+ * markup where it can be translated.
+ */
+document.addEventListener('submit', function (event) {
+    const form = event.target.closest('[data-confirm]');
+    if (form && !window.confirm(form.getAttribute('data-confirm'))) {
+        event.preventDefault();
+    }
+});
+
+/**
+ * Navigate on selection.
+ *
+ *     <select data-navigate="/team-matches/{value}/create">
+ *
+ * {value} is replaced by the chosen option, URL-encoded. An empty
+ * selection navigates nowhere.
+ */
+document.addEventListener('change', function (event) {
+    const select = event.target.closest('[data-navigate]');
+    if (!select || !select.value) {
+        return;
+    }
+    window.location.href = select.getAttribute('data-navigate')
+        .replace('{value}', encodeURIComponent(select.value));
 });
diff --git a/app/templates/pages/coach_availability.html b/app/templates/pages/coach_availability.html
index 7cd24f8..b70939b 100644
--- a/app/templates/pages/coach_availability.html
+++ b/app/templates/pages/coach_availability.html
@@ -15,7 +15,7 @@
         </div>
         
         <div class="form-actions mt-4">
-            <button type="button" class="btn btn-secondary" onclick="clearAllAvailability()">
+            <button type="button" class="btn btn-secondary" data-action="clear-availability">
                 <i class="fas fa-trash"></i> Clear All
             </button>
         </div>
@@ -134,7 +134,7 @@ function renderGrid() {
         TIME_SLOTS.forEach(slot => {
             const isSelected = selectedSlots[dayIndex] && selectedSlots[dayIndex].includes(slot.time);
             const cssClass = isSelected ? 'time-slot selected' : 'time-slot';
-            html += '<div class="' + cssClass + '" data-day="' + dayIndex + '" data-time="' + slot.time + '" onclick="toggleSlot(' + dayIndex + ', \'' + slot.time + '\', this)">' + slot.display + '</div>';
+            html += '<div class="' + cssClass + '" data-day="' + dayIndex + '" data-time="' + slot.time + '" data-action="toggle-slot">' + slot.display + '</div>';
         });
         
         html += '</div>';
@@ -143,7 +143,9 @@ function renderGrid() {
     grid.innerHTML = html;
 }
 
-function toggleSlot(dayOfWeek, timeStr, element) {
+function toggleSlot(element) {
+    const dayOfWeek = Number(element.getAttribute('data-day'));
+    const timeStr = element.getAttribute('data-time');
     if (!selectedSlots[dayOfWeek]) {
         selectedSlots[dayOfWeek] = [];
     }
@@ -203,7 +205,7 @@ function flash(message, type) {
     const flashContainer = document.querySelector('.flash-messages');
     const alert = document.createElement('div');
     alert.className = 'alert alert-' + type + ' alert-dismissible';
-    alert.innerHTML = '<span>' + message + '</span><button type="button" class="alert-close" onclick="this.parentElement.remove()">&times;</button>';
+    alert.innerHTML = '<span>' + message + '</span><button type="button" class="alert-close" data-action="remove-element">&times;</button>';
     flashContainer.appendChild(alert);
 }
 
@@ -215,5 +217,13 @@ document.addEventListener('click', function(e) {
         saveTimeout = setTimeout(saveAvailability, 1000);
     }
 });
+
+// Behaviours are declared in the markup with data-action / data-change and
+// dispatched by the delegated listener in main.js. This replaces inline
+// onclick attributes, which no CSP nonce is able to authorise.
+registerActions({
+    'clear-availability': clearAllAvailability,
+    'toggle-slot': toggleSlot,
+});
 </script>
 {% endblock %}
\ No newline at end of file
diff --git a/app/templates/pages/contracts.html b/app/templates/pages/contracts.html
index 088607e..befddcf 100644
--- a/app/templates/pages/contracts.html
+++ b/app/templates/pages/contracts.html
@@ -55,7 +55,7 @@
                                 </a>
                                 {% endif %}
                                 {% if current_user.role == 'player' and contract.status == 'pending' %}
-                                <button class="btn btn-sm btn-warning" onclick="showUploadSignedForm({{ contract.id }})" title="Upload Signed Contract">
+                                <button class="btn btn-sm btn-warning" data-action="show-upload-signed" data-contract-id="{{ contract.id }}" title="Upload Signed Contract">
                                     <i class="fas fa-upload"></i> Return Signed
                                 </button>
                                 {% endif %}
@@ -83,11 +83,11 @@
 {% if current_user.role == 'player' %}
 <!-- Upload Signed Contract Modal -->
 <div id="uploadSignedModal" class="modal hidden">
-    <div class="modal-backdrop" onclick="hideUploadSignedForm()"></div>
+    <div class="modal-backdrop" data-action="hide-upload-signed"></div>
     <div class="modal-content">
         <div class="modal-header">
             <h3>Upload Signed Contract</h3>
-            <button class="modal-close" onclick="hideUploadSignedForm()">&times;</button>
+            <button class="modal-close" data-action="hide-upload-signed">&times;</button>
         </div>
         <div class="modal-body">
             <form id="uploadSignedForm" method="POST" enctype="multipart/form-data" class="form">
@@ -98,7 +98,7 @@
                     <small class="form-text text-muted">Accepted formats: PDF, DOC, DOCX, JPG, PNG</small>
                 </div>
                 <div class="form-actions">
-                    <button type="button" class="btn btn-secondary" onclick="hideUploadSignedForm()">Cancel</button>
+                    <button type="button" class="btn btn-secondary" data-action="hide-upload-signed">Cancel</button>
                     <button type="submit" class="btn btn-primary">Upload Signed Contract</button>
                 </div>
             </form>
@@ -116,5 +116,15 @@ function showUploadSignedForm(contractId) {
 function hideUploadSignedForm() {
     document.getElementById('uploadSignedModal').classList.add('hidden');
 }
+
+// Behaviours are declared in the markup with data-action / data-change and
+// dispatched by the delegated listener in main.js. This replaces inline
+// onclick attributes, which no CSP nonce is able to authorise.
+registerActions({
+    'show-upload-signed': function (element) {
+        showUploadSignedForm(element.getAttribute('data-contract-id'));
+    },
+    'hide-upload-signed': hideUploadSignedForm,
+});
 </script>
 {% endblock %}
\ No newline at end of file
diff --git a/app/templates/pages/my_teams.html b/app/templates/pages/my_teams.html
index c47276f..509f981 100644
--- a/app/templates/pages/my_teams.html
+++ b/app/templates/pages/my_teams.html
@@ -137,7 +137,7 @@
                                 <button class="btn btn-sm {% if mdata.is_confirmed %}btn-success{% else %}btn-outline{% endif %} presence-toggle-btn"
                                         data-match-id="{{ tm.id }}"
                                         data-participant-id="{{ mdata.participant_id }}"
-                                        onclick="togglePresence(this)">
+                                        data-action="toggle-presence">
                                     {% if mdata.is_confirmed %}✅ Confirmed{% else %}Confirm{% endif %}
                                 </button>
                                 {% else %}
@@ -198,6 +198,13 @@ function togglePresence(btn) {
         console.error('Error:', error);
     });
 }
+
+// Behaviours are declared in the markup with data-action / data-change and
+// dispatched by the delegated listener in main.js. This replaces inline
+// onclick attributes, which no CSP nonce is able to authorise.
+registerActions({
+    'toggle-presence': togglePresence,
+});
 </script>
 
 <style>
diff --git a/app/templates/pages/notes.html b/app/templates/pages/notes.html
index 3365a2c..c1edd1b 100644
--- a/app/templates/pages/notes.html
+++ b/app/templates/pages/notes.html
@@ -151,7 +151,7 @@
                                     <i class="fas fa-check"></i> Accept
                                 </button>
                             </form>
-                            <button type="button" class="btn btn-sm btn-danger" onclick="showRejectModal({{ req.id }})" title="Refuse">
+                            <button type="button" class="btn btn-sm btn-danger" data-action="show-reject-modal" data-request-id="{{ req.id }}" title="Refuse">
                                 <i class="fas fa-times"></i> Refuse
                             </button>
                             {% elif req.status == 'rejected' and req.coach_rejection_message %}
@@ -171,11 +171,11 @@
 
 <!-- Reject Modal -->
 <div id="rejectModal" class="modal" style="display:none;">
-    <div class="modal-overlay" onclick="hideRejectModal()"></div>
+    <div class="modal-overlay" data-action="hide-reject-modal"></div>
     <div class="modal-content">
         <div class="modal-header">
             <h4><i class="fas fa-times-circle"></i> Reject One on One Request</h4>
-            <button type="button" class="modal-close" onclick="hideRejectModal()">&times;</button>
+            <button type="button" class="modal-close" data-action="hide-reject-modal">&times;</button>
         </div>
         <form id="rejectForm" method="POST" action="">
             <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
@@ -186,7 +186,7 @@
                 </div>
             </div>
             <div class="modal-footer">
-                <button type="button" class="btn btn-secondary" onclick="hideRejectModal()">Cancel</button>
+                <button type="button" class="btn btn-secondary" data-action="hide-reject-modal">Cancel</button>
                 <button type="submit" class="btn btn-danger">Reject Request</button>
             </div>
         </form>
@@ -272,5 +272,15 @@ function hideRejectModal() {
     document.getElementById('rejectModal').style.display = 'none';
     document.getElementById('rejection_reason').value = '';
 }
+
+// Behaviours are declared in the markup with data-action / data-change and
+// dispatched by the delegated listener in main.js. This replaces inline
+// onclick attributes, which no CSP nonce is able to authorise.
+registerActions({
+    'show-reject-modal': function (element) {
+        showRejectModal(element.getAttribute('data-request-id'));
+    },
+    'hide-reject-modal': hideRejectModal,
+});
 </script>
 {% endblock %}
\ No newline at end of file
diff --git a/app/templates/pages/one_on_one.html b/app/templates/pages/one_on_one.html
index 6f2f097..5b58f3d 100644
--- a/app/templates/pages/one_on_one.html
+++ b/app/templates/pages/one_on_one.html
@@ -130,7 +130,7 @@
                 <div class="form-row">
                     <div class="form-group">
                         <label for="date">Select Date</label>
-                        <select name="date" id="date" class="form-select" onchange="updateTimeSlots()" required>
+                        <select name="date" id="date" class="form-select" data-change="update-time-slots" required>
                             {% for d in dates %}
                             <option value="{{ d.value }}" data-day="{{ d.day_of_week }}">{{ d.display }}</option>
                             {% endfor %}
@@ -138,7 +138,7 @@
                     </div>
                     <div class="form-group">
                         <label for="start_time">Start Time</label>
-                        <select name="start_time" id="start_time" class="form-select" onchange="updateEndTimeOptions()" required>
+                        <select name="start_time" id="start_time" class="form-select" data-change="update-end-times" required>
                             <option value="">-- Select Date First --</option>
                         </select>
                     </div>
@@ -305,5 +305,13 @@ function updateEndTimeOptions() {
         }
     });
 }
+
+// Behaviours are declared in the markup with data-action / data-change and
+// dispatched by the delegated listener in main.js. This replaces inline
+// onclick attributes, which no CSP nonce is able to authorise.
+registerActions({
+    'update-time-slots': updateTimeSlots,
+    'update-end-times': updateEndTimeOptions,
+});
 </script>
 {% endblock %}
\ No newline at end of file
diff --git a/app/templates/pages/profile.html b/app/templates/pages/profile.html
index 2c9fef1..17c3a8e 100644
--- a/app/templates/pages/profile.html
+++ b/app/templates/pages/profile.html
@@ -193,10 +193,10 @@
                 <p class="text-muted">Loading...</p>
             </div>
             <div class="form-actions">
-                <button type="button" class="btn btn-primary" onclick="saveDisponibilities()">
+                <button type="button" class="btn btn-primary" data-action="save-disponibilities">
                     <i class="fas fa-save"></i> Save Disponibilities
                 </button>
-                <button type="button" class="btn btn-secondary" onclick="clearDisponibilities()">
+                <button type="button" class="btn btn-secondary" data-action="clear-disponibilities">
                     <i class="fas fa-trash"></i> Clear All
                 </button>
             </div>
@@ -216,7 +216,7 @@
                 <p class="text-muted">Loading availability grid...</p>
             </div>
             <div class="form-actions mt-3">
-                <button type="button" class="btn btn-secondary" onclick="clearAllAvailability()">
+                <button type="button" class="btn btn-secondary" data-action="clear-availability">
                     <i class="fas fa-trash"></i> Clear All
                 </button>
             </div>
@@ -599,6 +599,15 @@ function clearDisponibilities() {
 document.addEventListener('DOMContentLoaded', function() {
     renderDisponibilityGrid();
 });
+
+// Behaviours are declared in the markup with data-action / data-change and
+// dispatched by the delegated listener in main.js. This replaces inline
+// onclick attributes, which no CSP nonce is able to authorise.
+registerActions({
+    'save-disponibilities': saveDisponibilities,
+    'clear-disponibilities': clearDisponibilities,
+    'clear-availability': clearAllAvailability,
+});
 </script>
 {% endif %}
 {% endblock %}
\ No newline at end of file
diff --git a/app/templates/pages/register.html b/app/templates/pages/register.html
index 8c5478a..e6cdabd 100644
--- a/app/templates/pages/register.html
+++ b/app/templates/pages/register.html
@@ -93,7 +93,7 @@
             <label class="checkbox-label">
                 <input type="checkbox" name="games" value="{{ game }}"
                        {% if is_checked %}checked{% endif %}
-                       onchange="toggleGamertagInput(this)">
+                       data-change="toggle-gamertag">
                 <span>{{ game }}</span>
             </label>
             {% endfor %}
@@ -172,6 +172,13 @@ document.addEventListener('DOMContentLoaded', function() {
         toggleGamertagInput(checkbox);
     });
 });
+
+// Behaviours are declared in the markup with data-action / data-change and
+// dispatched by the delegated listener in main.js. This replaces inline
+// onclick attributes, which no CSP nonce is able to authorise.
+registerActions({
+    'toggle-gamertag': toggleGamertagInput,
+});
 </script>
 
 <style>
diff --git a/app/templates/pages/team_matches.html b/app/templates/pages/team_matches.html
index 956ccba..15d03ba 100644
--- a/app/templates/pages/team_matches.html
+++ b/app/templates/pages/team_matches.html
@@ -6,7 +6,7 @@
 {% block header_actions %}
 {% if teams %}
 <div class="header-actions">
-    <select id="teamSelect" class="form-select" style="width:200px;" onchange="window.location.href='/team-matches/' + this.value + '/create'">
+    <select id="teamSelect" class="form-select" style="width:200px;" data-navigate="/team-matches/{value}/create">
         <option value="">+ Schedule Match</option>
         {% for t in teams %}
         <option value="{{ t.id }}">{{ t.name }}</option>
@@ -97,7 +97,7 @@
                     <a href="{{ url_for('team_matches.edit_match', match_id=m.id) }}" class="btn btn-sm btn-outline" title="Edit Match">
                         <i class="fas fa-edit"></i>
                     </a>
-                    <form method="POST" action="{{ url_for('team_matches.delete_match', match_id=m.id) }}" class="inline-form" onsubmit="return confirm('Delete this match?')">
+                    <form method="POST" action="{{ url_for('team_matches.delete_match', match_id=m.id) }}" class="inline-form" data-confirm="{{ _('Delete this match?') }}">
                         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                         <button type="submit" class="btn btn-sm btn-danger" title="Delete Match">
                             <i class="fas fa-trash"></i>
@@ -111,7 +111,7 @@
                     <button class="btn btn-sm {% if p.is_confirmed %}btn-success{% else %}btn-outline{% endif %} presence-toggle-btn"
                             data-match-id="{{ m.id }}"
                             data-participant-id="{{ p.id }}"
-                            onclick="togglePresence(this)">
+                            data-action="toggle-presence">
                         {% if p.is_confirmed %}✅ Confirmed{% else %}Confirm{% endif %}
                     </button>
                     {% endif %}
@@ -132,7 +132,7 @@
             <p class="text-muted">Regular season matches have not been scheduled yet.</p>
             {% if teams %}
             <div class="mt-3">
-                <select id="teamSelectEmpty" class="form-select" style="width:220px; display:inline;" onchange="window.location.href='/team-matches/' + this.value + '/create'">
+                <select id="teamSelectEmpty" class="form-select" style="width:220px; display:inline;" data-navigate="/team-matches/{value}/create">
                     <option value="">-- Schedule a Match --</option>
                     {% for t in teams %}
                     <option value="{{ t.id }}">{{ t.name }}</option>
@@ -175,6 +175,13 @@ function togglePresence(btn) {
         console.error('Error:', error);
     });
 }
+
+// Behaviours are declared in the markup with data-action / data-change and
+// dispatched by the delegated listener in main.js. This replaces inline
+// onclick attributes, which no CSP nonce is able to authorise.
+registerActions({
+    'toggle-presence': togglePresence,
+});
 </script>
 
 <style>
diff --git a/app/templates/pages/users.html b/app/templates/pages/users.html
index c46c098..4f6383d 100644
--- a/app/templates/pages/users.html
+++ b/app/templates/pages/users.html
@@ -50,7 +50,7 @@
                                 <i class="fas fa-edit"></i> Edit
                             </a>
                             {% if u.id != current_user.id %}
-                            <form method="POST" action="{{ url_for('users.delete_user', user_id=u.id) }}" class="inline-form" onsubmit="return confirm('Delete {{ u.username }}? This cannot be undone.');">
+                            <form method="POST" action="{{ url_for('users.delete_user', user_id=u.id) }}" class="inline-form" data-confirm="{{ _('Delete %(name)s? This cannot be undone.', name=u.username) }}">
                                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                                 <button type="submit" class="btn btn-sm btn-danger">
                                     <i class="fas fa-trash"></i>
diff --git a/app/templates/pages/view_user.html b/app/templates/pages/view_user.html
index 4119b3b..bc83299 100644
--- a/app/templates/pages/view_user.html
+++ b/app/templates/pages/view_user.html
@@ -1,7 +1,7 @@
 {% extends "layouts/base.html" %}
 {% block title %}{{ profile_user.username }} - TryoutPro{% endblock %}
 {% block page_title %}{{ profile_user.username }}{% endblock %}
-{% block breadcrumb %}<span class="breadcrumb">Home / <a href="#" onclick="history.back()">Back</a> / {{ profile_user.username }}</span>{% endblock %}
+{% block breadcrumb %}<span class="breadcrumb">Home / <a href="#" data-action="history-back">Back</a> / {{ profile_user.username }}</span>{% endblock %}
 
 {% block content %}
 <div class="card mb-4">
diff --git a/app/translations/en/LC_MESSAGES/messages.mo b/app/translations/en/LC_MESSAGES/messages.mo
index 6b2c918fbbfc925e768ede71cc0b4e7bec70bcb8..17ac341499edd2355fe1d165efc2a27fd6f0845b 100644
GIT binary patch
delta 1283
zcmbu--%C?*7{~EvVsqN8{LwNrn8q@lWey^v(F$@HltP4Ima*)VmYz{gBrrx$H_3vM
z=pyeV=%ONAS0RBx1X2`UbX8&((M?_jNp{owlLz_(8fWMA{hssv@jT!2%taTQS{BL+
z?-{=&{~G>B3e@}e8!I$hPxl&DVD8Srifk#3Sss+(d)$a$a5FCB1}s}+wgu}@;}75&
z?7$v;ia{*#o2|u77{IN_D{I1HjCsbfo_^AASu3aE@}L&4V;rZj7Z<S^6GdiRmgW}1
zQB;7pQJFmQoIwTf0X6RvMleV;+c1VavTlrGDv({xIL8Ano8qR3A7c`yaS#4NVzCy|
zP^PV(ZOAJ-h9%hJc^;M6Wn70hP~#?00Z*b%@>!OKB7TXAYz_x;9(CjiR_(;o*o{xH
z4vUziPt%ADwSB1hZK#coVik5_HKuU{$5AKeBa1G~R?~>lxPo_mW)D$C(n{Ehv>g@c
zDO8PI^!j67{}!rdCQ%DdqXK)2O5ihU{%=&x6tlQ$W&qhLYp-b#l+B|eUqF3=Z>Y?c
zJeRSazK_*)v<;}5iKA+!7gaM4uo+iSC(=mNs+kxnz{9A-`u@uIAEluH#!(aRql)GY
zs%Vx_3stgf6l+i!x1$2?MFo5TRWn1Vnt6_@neRxZ_QO-VYhEdqu)l@Wz*=OCH6f>E
z3Dm$2<gydobd;A+0bfN0b`u9NhdS~V?8K_d)tc!?)yym8Q0yz}WPjp*EueI?Q2<pm
zWvHTQ#1TxQj&253G#@dBJ3{%Bh3|ZOok1t#gd^MC)R5CKoCqK99~chzrCc|i37>Vs
oBksAh>+G~ctK%|yJCw@w^(XQX|AfC__pbbl;8MYVEfewo0Z;3W>;M1&

delta 1135
zcmYMyUr1A77{~Ev$9d9pGv{VWGqPwPlcp=E3ojakND!kSN0j{`uZAKDGAQWiL~n{h
zvAPlQN(dsV-E^6E5=bP}t_&lu1`-9aiy->`*a64c`8@C8yytzM_kDJHJ|;8YBEe_I
z?;`&=|9(fK{ol=?SqsBqY{M}O;S9Fo(}lh^FGjG=gAOd?A^e4%=+xIH9LL*?PvZ@I
zg3VaLCahuu*12Yc){Ko9@r`2_;{^8OAl||`*E~xR?DF6MM!B_P9F@=+ROXj`@1ho*
zLd~1OQ}`AWSVk`U$1RC2S*gG@D#1Z+O7IE}V6MS4J4dj>19GshsLHl|E68P4ZU<3i
z$tH|oJBG0v_1<|@!Wq<7UqdB)50%(Bj$#3|!@C|qmcZew*YPTzz*nfF_=LP-JE#v-
zPz(LWBls7OVw6>;uoty+YdC}-FpY<)YB6AT3DpzZWT!;EJpyGKpbRxd3u@fuk5i~E
z%%DD;LnStWs-TE^e-+guuTeb`W)<yZ9?8K9sKjScNAMUa%(KN>V9Tf`Swl6+2C7Nw
zSuKSls2x~B^~f?Rp%SW+P2caR1^=Mt1*l3r(ueAi9O^p{G0FNiPoN6lp)%Y+W%wD@
zBxO{O9OJ;%BSWalhJEv>c?IM&Y})q`a@likY>K@^z4soK@H&QA-@Xti;~%KZe&Q%r
zQCmF1+gU84dSnaLBR$dDQDjj)atAd(k6LIF)gup3J+g%AkvFKFOHg%KO>%)CjW1%Q
X`@zjXspu}a&e?P+7TR+doOJ&KAtYy-

diff --git a/app/translations/en/LC_MESSAGES/messages.po b/app/translations/en/LC_MESSAGES/messages.po
index 05233a6..dac305c 100644
--- a/app/translations/en/LC_MESSAGES/messages.po
+++ b/app/translations/en/LC_MESSAGES/messages.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: team-tryouts VERSION\n"
 "Report-Msgid-Bugs-To: EMAIL@ADDRESS\n"
-"POT-Creation-Date: 2026-08-07 20:42-0400\n"
+"POT-Creation-Date: 2026-08-07 20:50-0400\n"
 "PO-Revision-Date: 2026-08-07 20:22-0400\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language: en\n"
@@ -316,3 +316,12 @@ msgstr "Don't have an account?"
 msgid "Register here"
 msgstr "Register here"
 
+#: app/templates/pages/team_matches.html:100
+msgid "Delete this match?"
+msgstr "Delete this match?"
+
+#: app/templates/pages/users.html:53
+#, python-format
+msgid "Delete %(name)s? This cannot be undone."
+msgstr "Delete %(name)s? This cannot be undone."
+
diff --git a/app/translations/fr/LC_MESSAGES/messages.mo b/app/translations/fr/LC_MESSAGES/messages.mo
index 0365579ca0f61e7e0e7ae815f12bf00090f464a1..da0e2c5a6e30e2b1364a2b7a34dc0ee59637fe59 100644
GIT binary patch
delta 1298
zcmYMzOGs2v7{Kw*N8=+Osg;@)S7mzm7;{S0w5BkH!nDi;Q<HJJ;?Q`<X08R14pEy3
z1DS*fcM?75Aq_-C1z|+Es0dmF5w&SiyIMr6`hR%IVdnnMIrp4%zwbMDUU`1h)PBxS
zoe@55{MPepPuAY@=Ul2tF5L+%z^UoI1+i=zFBr(fx3~tsVln>4RhYLzWCNC=&fkNB
z*nxd`AG0viC9)C=F&)d1TT+D?=yhzy&Gg$`5|exy76YYt9-DCvkK-4tL0_5(UkP(r
zi)T;+yn>p^Eyt&*0lY(9_X*vYMKqhxiwsFGR-!*Wwv_P{1AJwUi$;7G+wdXQ;~yjz
zsU;1~w860zxg}kgiG7a4sEM7z9K47+FOC}UENUg^V>C44=cth_VhG=(mfXj#oj8EK
zcn`}kjYWDi706U+LS5gA`k;eYggsb-VI0THsFh11iyn-X(D2fT;B=D64J@QzPuRM!
z6E%~QsHLC8)i{ItfIFz~%mV7hAD#X$)FaK{jiV`*=*OKngtN#uCV#nVNpeX?OIVIt
zY7c5Ab;uOijXSUdHGm6PiPx|RUt&M%n_LG2sQbiG6S<Bx_z3mi@eNCPzNC;INsAk|
zqZg}i7<EA$b)yB;02Wa*{p*Yu6TKdRfn8XE2XF#)-`A)Ce?YC+chvbQ3}*6t$)>@W
z6rq-^3Q0yfP&XJvjW~onQ!b&-pLOof<5~L8uo@dUkHa{ONAWRk#2n5~kG2}M(yh3Q
z_dyQPpc>MT`ggH#9bUyre1Q5gdRTo7+pz_2CVErfBsH2L(>4wF7Rx_sZjJhk?vY^B
z2>2~4Y#T$SF>aj*Tc$_$EzPs_?x^1mjQA36SKO6cw=MA`t1)H&k@2yyNO07Q{NKv(
s87-#G-u{3c3|od7wT)mTvT*yf8HommLTtLcC}1w_YWNaAbGy_20Y^lYXaE2J

delta 1134
zcmYMzOGs2v9LMp$*Xe4GljF?zs3y}yAvDKEqnDeZ2O@~5Xrwk_Z4?R@B~gJl1F04j
zLj<m(MHEp4F+tI)+4R^{AY_C+pjk~|^kNo4^!?F5!<qB>pF8)S^Z%c7=S%EqTjE2=
zch&gp<{RbP<!JQ(Gv+g^V0Zw-coYLTi<NjewK?on5oEZq8W%B$-*6o|EB-xDj|UmI
z;V53ha?GJ0^H_?-t{I_~<4Oz_jA8@hX6(XlOyZntp2Y~VTqwZ^T{T8g33Z?{?=3iv
zT5uZm+$=WXeQd@>q}d<37Ieu<1;$YccGD@re%y=uN<Fi!1lPDg4)z9B+53Vyq*<P>
z3{{r&V+gBp6>db`w+)qW0=3mcsDuxr5}U#!cmlP<S&yKPz+u+?IDi}QF6t;=A-C8k
z)C4)yLf^3#f8$z=u*x*Hqjv5l4&xJyV+~cMip+YjhVc^F={fHwfhq}7hPJ*DBe(;#
zKp$!gCr}g56vp$YGrfm2drdcvAMp?-c=Kp>gHAj00Lj&!qjq`$Da5mP1T_0h*MdKA
zC$6XbF&xD$_z3mjGAi?57{f|lWxf3gR6<GA5uU*gyojxsLEXQMnx~GcJ6YeF2vpe!
z>WAZ~EkBI|IEOv>7Bz7r<!Fc6Q9HB;b$=37;RMp`7@ZP2hvaIvQO`d{CHxFStZ!KY
zn&s(qgP++?VJ&XLE7*@29KtZ?QHPVLvpkPl_&Rdjb_Xfa9-{soFK`Wh#ThK)ob~cu
iz`zK>ErMO>q)+-@7NyU+Dc9+Yr>g?ni_`PL!IHl@>1p2p

diff --git a/app/translations/fr/LC_MESSAGES/messages.po b/app/translations/fr/LC_MESSAGES/messages.po
index 76776ec..37ae8fa 100644
--- a/app/translations/fr/LC_MESSAGES/messages.po
+++ b/app/translations/fr/LC_MESSAGES/messages.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: team-tryouts VERSION\n"
 "Report-Msgid-Bugs-To: EMAIL@ADDRESS\n"
-"POT-Creation-Date: 2026-08-07 20:42-0400\n"
+"POT-Creation-Date: 2026-08-07 20:50-0400\n"
 "PO-Revision-Date: 2026-08-07 20:22-0400\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language: fr\n"
@@ -316,3 +316,12 @@ msgstr "Vous n'avez pas de compte ?"
 msgid "Register here"
 msgstr "Inscrivez-vous ici"
 
+#: app/templates/pages/team_matches.html:100
+msgid "Delete this match?"
+msgstr "Supprimer ce match ?"
+
+#: app/templates/pages/users.html:53
+#, python-format
+msgid "Delete %(name)s? This cannot be undone."
+msgstr "Supprimer %(name)s ? Cette action est irréversible."
+
diff --git a/tests/test_csp.py b/tests/test_csp.py
index b8bdfc1..4e20cbb 100644
--- a/tests/test_csp.py
+++ b/tests/test_csp.py
@@ -40,16 +40,6 @@ HANDLER_BUDGET = {
     'pages/teams.html': 11,
     'pages/evaluate_player.html': 9,
     'pages/view_tryout.html': 8,
-    'pages/contracts.html': 4,
-    'pages/notes.html': 4,
-    'pages/team_matches.html': 4,
-    'pages/coach_availability.html': 3,
-    'pages/profile.html': 3,
-    'pages/one_on_one.html': 2,
-    'pages/my_teams.html': 1,
-    'pages/register.html': 1,
-    'pages/users.html': 1,
-    'pages/view_user.html': 1,
 }
 
 #: What the ratchet is counting down to.