fix(audit): fermer les frontieres restantes

app/routes/auth.py

@@ -18,6 +18,7 @@ from flask_login import current_user, login_required, login_user, logout_user
 from marshmallow import ValidationError
 
 from app.extensions import check_password, db, hash_password, limiter
+from app.forms import form_gamertags
 from app.i18n import LOCALE_SESSION_KEY
 from app.logging_config import log_auth_event
 from app.models import ESPORT_GAMES, Player, User
@@ -393,6 +394,13 @@ def register():
         full_name = validated['full_name']
         phone = validated.get('phone')
         selected_games = validated.get('games', [])
+        try:
+            submitted_gamertags = form_gamertags(selected_games)
+        except ValidationError as err:
+            for field, messages in err.messages.items():
+                for msg in messages:
+                    flash(_('%(field)s: %(msg)s', field=field, msg=msg), 'danger')
+            return _rerender_registration(form_data)
         # The OAuth identity is server-side state. It used to be copied into
         # hidden inputs and read back from request.form, which let anyone
         # replace the verified Discord account before submitting (SEC-AUTH-005).
@@ -445,16 +453,14 @@ def register():
         # Create UserGamertag records for each selected game
         from app.models import UserGamertag
 
-        for game in selected_games:
-            field_name = f'gamertag_{game}'
-            gamertag_value = request.form.get(field_name, '').strip()
-            if gamertag_value:
-                gamertag = UserGamertag(
-                    user_id=user.id,
-                    game=game,
-                    gamertag=gamertag_value,
-                )
-                db.session.add(gamertag)
+        for game, gamertag_data in submitted_gamertags.items():
+            gamertag = UserGamertag(
+                user_id=user.id,
+                game=game,
+                gamertag=gamertag_data['gamertag'],
+                platform=gamertag_data['platform'],
+            )
+            db.session.add(gamertag)
         db.session.commit()
 
         # Clear Discord OAuth data from session after successful registration