From 15bfebf4fcb584bfc9649ed87a34a990e269e9f7 Mon Sep 17 00:00:00 2001
From: GGThed <mafiaggia@outlook.com>
Date: Fri, 7 Aug 2026 20:44:16 -0400
Subject: [PATCH] feat(csp): infrastructure de sortie de unsafe-inline, et
 couche partagee migree
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SEC-WEB-001 / OPS-010. script-src porte toujours 'unsafe-inline' : c'est
pour cela que le XSS stocke de SEC-XSS-001 s'executait au lieu d'etre
bloque. Le retirer n'est pas un changement d'une ligne.

Ce qui bloque reellement
  Un nonce autorise des elements <script> ; il ne peut rien pour un
  attribut onclick="...". Mesure faite : 76 gestionnaires en ligne repartis
  dans 15 gabarits. Tant qu'il en reste un, la politique ne peut pas etre
  durcie.

  Piege supplementaire, documente dans build_csp() : en CSP niveau 3, un
  navigateur ignore 'unsafe-inline' des qu'un nonce est present. Emettre
  les deux ne serait donc pas une transition douce -- ce serait couper
  d'un coup tous les scripts en ligne et tous les onclick, et uniquement
  sur les navigateurs recents. La bascule doit etre atomique, d'ou un
  drapeau unique : CSP_ALLOW_INLINE_SCRIPT.

Infrastructure posee
  build_csp() assemble l'en-tete selon le drapeau. Un nonce est genere par
  requete et n'est emis que lorsque l'inline est interdit. Les 15 blocs
  <script> portent deja nonce="{{ csp_nonce }}", inerte aujourd'hui : la
  bascule finale sera un changement de configuration, pas de gabarits.

Couche partagee migree en premier
  base.html et macros.html sont rendus sur absolument toutes les pages. Six
  gestionnaires retires, remplaces par des attributs data-action et un
  ecouteur delegue unique dans main.js. La delegation plutot qu'un
  ecouteur par widget : le contenu injecte dynamiquement herite du
  comportement sans re-attachement.

Un cliquet plutot qu'une promesse
  tests/test_csp.py fixe un budget par gabarit qui ne peut que baisser.
  Ajouter un gestionnaire en ligne fait echouer la suite ; en retirer sans
  mettre le budget a jour aussi, ce qui force a enregistrer la progression
  dans le diff. A zero, il ne reste qu'a basculer le drapeau.

  Le cliquet a d'ailleurs corrige mon propre relevé : mon grep initial
  comptait 83 gestionnaires, la mesure exacte en donne 76 -- le motif ne
  verifiait pas l'espace avant l'attribut.

style-src conserve 'unsafe-inline' : les attributs style="" sont partout et
ne constituent pas un vecteur XSS a eux seuls. Migration distincte.

192 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 app/app.py                                  |  80 ++++++++--
 app/static/js/main.js                       |  58 +++++++-
 app/templates/layouts/base.html             |  11 +-
 app/templates/layouts/macros.html           |   5 +-
 app/templates/pages/calendar.html           |   2 +-
 app/templates/pages/coach_availability.html |   2 +-
 app/templates/pages/contracts.html          |   2 +-
 app/templates/pages/edit_profile.html       |   2 +-
 app/templates/pages/edit_user.html          |   2 +-
 app/templates/pages/match_form.html         |   2 +-
 app/templates/pages/my_teams.html           |   2 +-
 app/templates/pages/notes.html              |   2 +-
 app/templates/pages/one_on_one.html         |   2 +-
 app/templates/pages/profile.html            |   4 +-
 app/templates/pages/register.html           |   2 +-
 app/templates/pages/team_matches.html       |   2 +-
 app/templates/pages/teams.html              |   2 +-
 app/templates/pages/view_tryout.html        |   2 +-
 app/translations/en/LC_MESSAGES/messages.mo | Bin 5468 -> 5578 bytes
 app/translations/en/LC_MESSAGES/messages.po |  16 +-
 app/translations/fr/LC_MESSAGES/messages.mo | Bin 5841 -> 5958 bytes
 app/translations/fr/LC_MESSAGES/messages.po |  16 +-
 tests/test_csp.py                           | 156 ++++++++++++++++++++
 23 files changed, 335 insertions(+), 37 deletions(-)
 create mode 100644 tests/test_csp.py

diff --git a/app/app.py b/app/app.py
index 8c02398..2baf768 100644
--- a/app/app.py
+++ b/app/app.py
@@ -5,7 +5,9 @@ the Flask application instance with comprehensive security hardening.
 """
 
 import os
-from flask import Flask, request, redirect, jsonify, render_template, url_for
+import secrets
+
+from flask import Flask, g, request, redirect, jsonify, render_template, url_for
 from flask_cors import CORS
 from app.extensions import db, login_manager, csrf, limiter, babel
 from sqlalchemy import text
@@ -33,6 +35,52 @@ def nl2br(value):
     return ''
 
 
+def build_csp(*, allow_inline_script, nonce=None):
+    """Assemble the Content-Security-Policy header.
+
+    Two mutually exclusive modes, and they really are exclusive.
+
+    Under CSP level 3, a browser that understands nonces **ignores
+    'unsafe-inline' entirely as soon as a nonce is present**. Emitting both
+    would therefore not be a gentle transition: it would drop every inline
+    script and every onclick attribute at once, in modern browsers only.
+    The switch has to be atomic, which is why one flag drives it.
+
+    While allow_inline_script is true no nonce is emitted at all, so adding
+    nonce="{{ csp_nonce }}" to a template ahead of the switch is harmless.
+
+    Flipping the flag requires every inline event handler to be gone first.
+    A nonce cannot authorise an onclick attribute — nonces apply to script
+    elements, never to handler attributes. See tests/test_csp.py, which
+    tracks how many are left.
+
+    Args:
+        allow_inline_script: Keep 'unsafe-inline' in script-src.
+        nonce: Per-request nonce, used only when inline script is not allowed.
+
+    Returns:
+        str: The header value.
+    """
+    if allow_inline_script:
+        script_src = "'self' 'unsafe-inline' https://cdn.jsdelivr.net"
+    else:
+        script_src = f"'self' 'nonce-{nonce}' https://cdn.jsdelivr.net"
+
+    return '; '.join([
+        "default-src 'self'",
+        f'script-src {script_src}',
+        # style-src is a separate migration: inline style="" attributes are
+        # spread across the templates and are not an XSS vector on their own.
+        "style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net",
+        "font-src 'self' https://cdnjs.cloudflare.com",
+        "img-src 'self' data: https://cdn.discordapp.com",
+        "connect-src 'self'",
+        "frame-ancestors 'none'",
+        "base-uri 'self'",
+        "form-action 'self'",
+    ])
+
+
 def create_app(config=None):
     """Create and configure the Flask application.
 
@@ -70,6 +118,12 @@ def create_app(config=None):
     app.config['CORS_ALLOWED_ORIGINS'] = os.getenv('CORS_ALLOWED_ORIGINS', '')
     app.config['FORCE_HTTPS'] = os.getenv('FORCE_HTTPS', 'true').lower() == 'true'
 
+    # Still true: 76 inline event handlers remain across the templates, and
+    # no nonce can authorise those. Flip once tests/test_csp.py reports zero.
+    app.config['CSP_ALLOW_INLINE_SCRIPT'] = (
+        os.getenv('CSP_ALLOW_INLINE_SCRIPT', 'true').lower() == 'true'
+    )
+
     # Internationalisation. French is the site's primary language.
     app.config['BABEL_DEFAULT_LOCALE'] = i18n.DEFAULT_LOCALE
     app.config['BABEL_TRANSLATION_DIRECTORIES'] = os.path.join(
@@ -140,6 +194,17 @@ def create_app(config=None):
 
     # Exposed to every template so the language switcher can render itself
     # without each view having to pass the list along.
+    @app.before_request
+    def generate_csp_nonce():
+        # Only meaningful once inline script is disallowed; generated
+        # unconditionally so templates can carry nonce="" beforehand.
+        g.csp_nonce = secrets.token_urlsafe(16)
+
+    @app.context_processor
+    def inject_csp_nonce():
+        return {'csp_nonce': '' if app.config['CSP_ALLOW_INLINE_SCRIPT']
+                             else g.get('csp_nonce', '')}
+
     @app.context_processor
     def inject_locales():
         from flask_babel import get_locale
@@ -199,16 +264,9 @@ def create_app(config=None):
             'interest-cohort=(), payment=(), usb=()'
         )
         response.headers['Cross-Origin-Opener-Policy'] = 'same-origin'
-        response.headers['Content-Security-Policy'] = (
-            "default-src 'self'; "
-            "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
-            "style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net; "
-            "font-src 'self' https://cdnjs.cloudflare.com; "
-            "img-src 'self' data: https://cdn.discordapp.com; "
-            "connect-src 'self'; "
-            "frame-ancestors 'none'; "
-            "base-uri 'self'; "
-            "form-action 'self'"
+        response.headers['Content-Security-Policy'] = build_csp(
+            allow_inline_script=app.config['CSP_ALLOW_INLINE_SCRIPT'],
+            nonce=g.get('csp_nonce'),
         )
 
         # Only enable HSTS when HTTPS is actually being used
diff --git a/app/static/js/main.js b/app/static/js/main.js
index d7beaa6..dcd17d2 100644
--- a/app/static/js/main.js
+++ b/app/static/js/main.js
@@ -436,4 +436,60 @@ document.addEventListener('DOMContentLoaded', function() {
             }
         }, 5000);
     });
-});
\ No newline at end of file
+});
+/* =========================================================================
+   Declarative behaviours — replacing inline event handlers
+   =========================================================================
+
+   A Content Security Policy without 'unsafe-inline' blocks `onclick="..."`
+   attributes, and a nonce does not help: nonces apply to <script> elements,
+   never to event handler attributes. Dropping 'unsafe-inline' therefore
+   requires removing every one of them first.
+
+   Rather than one listener per widget, behaviours are declared in the
+   markup with a data-action attribute and dispatched from a single
+   delegated listener. New markup gets the behaviour for free, and nothing
+   has to be re-bound after content is replaced dynamically.
+
+       <button data-action="toggle-sidebar">
+       <button data-action="dismiss-alert">
+       <div data-action="hide-modal" data-modal-id="confirmDelete">
+
+   Migration status is tracked by tests/test_csp.py.
+   ========================================================================= */
+
+const DATA_ACTIONS = {
+    'toggle-sidebar': function () {
+        toggleSidebar();
+    },
+    'toggle-dark-mode': function () {
+        toggleDarkMode();
+    },
+    'dismiss-alert': function (element) {
+        const alert = element.closest('.alert');
+        if (alert) {
+            alert.remove();
+        }
+    },
+    'hide-modal': function (element) {
+        const id = element.getAttribute('data-modal-id');
+        if (id && typeof hideModal === 'function') {
+            hideModal(id);
+        }
+    },
+    'history-back': function (element, event) {
+        event.preventDefault();
+        history.back();
+    },
+};
+
+document.addEventListener('click', function (event) {
+    const trigger = event.target.closest('[data-action]');
+    if (!trigger) {
+        return;
+    }
+    const handler = DATA_ACTIONS[trigger.getAttribute('data-action')];
+    if (handler) {
+        handler(trigger, event);
+    }
+});
diff --git a/app/templates/layouts/base.html b/app/templates/layouts/base.html
index 83f5dde..9c0dd63 100644
--- a/app/templates/layouts/base.html
+++ b/app/templates/layouts/base.html
@@ -126,14 +126,15 @@
 
     <div class="main-content" id="mainContent">
 <header class="top-bar">
-            <button class="sidebar-toggle" id="sidebarToggle" onclick="toggleSidebar()">
+            <button class="sidebar-toggle" id="sidebarToggle" data-action="toggle-sidebar">
                 <i class="fas fa-bars"></i>
             </button>
             <div class="page-header">
                 <h1>{% block page_title %}{{ _('Dashboard') }}{% endblock %}</h1>
                 {% block breadcrumb %}{% endblock %}
             </div>
-            <button class="dark-mode-toggle" id="darkModeToggle" onclick="toggleDarkMode()" title="Toggle dark mode">
+            <button class="dark-mode-toggle" id="darkModeToggle" data-action="toggle-dark-mode"
+                    title="{{ _('Toggle dark mode') }}">
                 <i class="fas fa-moon"></i>
             </button>
             {% block header_actions %}{% endblock %}
@@ -144,7 +145,8 @@
                     {% for category, message in messages %}
                         <div class="alert alert-{{ category }} alert-dismissible">
                             <span>{{ message }}</span>
-                            <button type="button" class="alert-close" onclick="this.parentElement.remove()">&times;</button>
+                            <button type="button" class="alert-close" data-action="dismiss-alert"
+                                    aria-label="{{ _('Dismiss') }}">&times;</button>
                         </div>
                     {% endfor %}
                 {% endif %}
@@ -162,7 +164,8 @@
                     {% for category, message in messages %}
                         <div class="alert alert-{{ category }} alert-dismissible">
                             <span>{{ message }}</span>
-                            <button type="button" class="alert-close" onclick="this.parentElement.remove()">&times;</button>
+                            <button type="button" class="alert-close" data-action="dismiss-alert"
+                                    aria-label="{{ _('Dismiss') }}">&times;</button>
                         </div>
                     {% endfor %}
                 {% endif %}
diff --git a/app/templates/layouts/macros.html b/app/templates/layouts/macros.html
index c37cfea..e1888b3 100644
--- a/app/templates/layouts/macros.html
+++ b/app/templates/layouts/macros.html
@@ -108,11 +108,12 @@
 {# Modal Macro - renders a modal dialog #}
 {% macro modal(id, title, content, footer_buttons=None) %}
 <div id="{{ id }}" class="modal hidden">
-    <div class="modal-backdrop" onclick="hideModal('{{ id }}')"></div>
+    <div class="modal-backdrop" data-action="hide-modal" data-modal-id="{{ id }}"></div>
     <div class="modal-content">
         <div class="modal-header">
             <h3>{{ title }}</h3>
-            <button class="modal-close" onclick="hideModal('{{ id }}')">&times;</button>
+            <button class="modal-close" data-action="hide-modal" data-modal-id="{{ id }}"
+                    aria-label="{{ _('Close') }}">&times;</button>
         </div>
         <div class="modal-body">
             {{ content }}
diff --git a/app/templates/pages/calendar.html b/app/templates/pages/calendar.html
index 2290230..8c3fd7d 100644
--- a/app/templates/pages/calendar.html
+++ b/app/templates/pages/calendar.html
@@ -116,7 +116,7 @@
 {% block scripts %}
 <link href="https://cdn.jsdelivr.net/npm/fullcalendar@6.1.10/index.global.min.css" rel="stylesheet">
 <script src="https://cdn.jsdelivr.net/npm/fullcalendar@6.1.10/index.global.min.js"></script>
-<script>
+<script nonce="{{ csp_nonce }}">
 var canScheduleMatches = {% if current_user.can_schedule_matches() %}true{% else %}false{% endif %};
 
 document.addEventListener('DOMContentLoaded', function() {
diff --git a/app/templates/pages/coach_availability.html b/app/templates/pages/coach_availability.html
index 2a1629a..7cd24f8 100644
--- a/app/templates/pages/coach_availability.html
+++ b/app/templates/pages/coach_availability.html
@@ -88,7 +88,7 @@
     }
 }
 </style>
-<script>
+<script nonce="{{ csp_nonce }}">
 // Time slots from 8:00 AM to 10:00 PM (30-minute intervals)
 const TIME_SLOTS = [];
 for (let h = 8; h <= 22; h++) {
diff --git a/app/templates/pages/contracts.html b/app/templates/pages/contracts.html
index d275fcb..088607e 100644
--- a/app/templates/pages/contracts.html
+++ b/app/templates/pages/contracts.html
@@ -107,7 +107,7 @@
 </div>
 {% endif %}
 
-<script>
+<script nonce="{{ csp_nonce }}">
 function showUploadSignedForm(contractId) {
     document.getElementById('uploadSignedForm').action = '/users/contracts/' + contractId + '/upload_signed';
     document.getElementById('uploadSignedModal').classList.remove('hidden');
diff --git a/app/templates/pages/edit_profile.html b/app/templates/pages/edit_profile.html
index e126814..31bdb9c 100644
--- a/app/templates/pages/edit_profile.html
+++ b/app/templates/pages/edit_profile.html
@@ -112,7 +112,7 @@
     </div>
 </div>
 
-<script>
+<script nonce="{{ csp_nonce }}">
 var GAME_PLATFORMS = {{ game_platforms|tojson }};
 
 // Show/hide gamertag inputs when games are checked
diff --git a/app/templates/pages/edit_user.html b/app/templates/pages/edit_user.html
index 38274d1..49add26 100644
--- a/app/templates/pages/edit_user.html
+++ b/app/templates/pages/edit_user.html
@@ -114,7 +114,7 @@
     </div>
 </div>
 
-<script>
+<script nonce="{{ csp_nonce }}">
 // Show/hide gamertag inputs when games are checked
 function toggleGamertagInputs() {
     var selectedGames = [];
diff --git a/app/templates/pages/match_form.html b/app/templates/pages/match_form.html
index 68f933d..7b5074e 100644
--- a/app/templates/pages/match_form.html
+++ b/app/templates/pages/match_form.html
@@ -445,7 +445,7 @@
     gap: 4px;
 }
 </style>
-<script>
+<script nonce="{{ csp_nonce }}">
 // Player data as simple JS object (id -> full_name)
 var playerDataById = {
     player_data: {
diff --git a/app/templates/pages/my_teams.html b/app/templates/pages/my_teams.html
index c69ae84..c47276f 100644
--- a/app/templates/pages/my_teams.html
+++ b/app/templates/pages/my_teams.html
@@ -169,7 +169,7 @@
 </div>
 {% endif %}
 
-<script>
+<script nonce="{{ csp_nonce }}">
 function togglePresence(btn) {
     var matchId = btn.getAttribute('data-match-id');
     var participantId = btn.getAttribute('data-participant-id');
diff --git a/app/templates/pages/notes.html b/app/templates/pages/notes.html
index 75146de..3365a2c 100644
--- a/app/templates/pages/notes.html
+++ b/app/templates/pages/notes.html
@@ -260,7 +260,7 @@
 {% endblock %}
 
 {% block scripts %}
-<script>
+<script nonce="{{ csp_nonce }}">
 function showRejectModal(requestId) {
     const modal = document.getElementById('rejectModal');
     const form = document.getElementById('rejectForm');
diff --git a/app/templates/pages/one_on_one.html b/app/templates/pages/one_on_one.html
index 177c3ba..6f2f097 100644
--- a/app/templates/pages/one_on_one.html
+++ b/app/templates/pages/one_on_one.html
@@ -177,7 +177,7 @@
 {% endblock %}
 
 {% block scripts %}
-<script>
+<script nonce="{{ csp_nonce }}">
 // Time slots from 8:00 AM to 10:00 PM
 const TIME_SLOTS = [];
 for (let h = 8; h <= 22; h++) {
diff --git a/app/templates/pages/profile.html b/app/templates/pages/profile.html
index 5e859ef..2c9fef1 100644
--- a/app/templates/pages/profile.html
+++ b/app/templates/pages/profile.html
@@ -266,7 +266,7 @@
 @media (max-width: 768px) { .availability-grid { grid-template-columns: repeat(3, 1fr); } }
 @media (max-width: 480px) { .availability-grid { grid-template-columns: 1fr; } }
 </style>
-<script>
+<script nonce="{{ csp_nonce }}">
 const COACH_TIME_SLOTS = [];
 for (let h = 8; h <= 22; h++) {
     for (let m = 0; m < 60; m += 30) {
@@ -394,7 +394,7 @@ document.addEventListener('DOMContentLoaded', function() {
 {% endif %}
 
 {% if user.role == 'player' %}
-<script>
+<script nonce="{{ csp_nonce }}">
 // Generate time slots from 5pm (17:00) to 12am (24:00)
 var TIME_SLOTS = [];
 for (var h = 17; h <= 24; h++) {
diff --git a/app/templates/pages/register.html b/app/templates/pages/register.html
index 9110ec4..8c5478a 100644
--- a/app/templates/pages/register.html
+++ b/app/templates/pages/register.html
@@ -155,7 +155,7 @@
     <p class="auth-link">Already have an account? <a href="{{ url_for('auth.login') }}">Sign in</a></p>
 </form>
 
-<script>
+<script nonce="{{ csp_nonce }}">
 // Toggle gamertag input visibility when a game checkbox is checked/unchecked
 function toggleGamertagInput(checkbox) {
     var game = checkbox.value.replace(/ /g, '_');
diff --git a/app/templates/pages/team_matches.html b/app/templates/pages/team_matches.html
index 07c2266..956ccba 100644
--- a/app/templates/pages/team_matches.html
+++ b/app/templates/pages/team_matches.html
@@ -145,7 +145,7 @@
 </div>
 {% endif %}
 
-<script>
+<script nonce="{{ csp_nonce }}">
 function togglePresence(btn) {
     var matchId = btn.getAttribute('data-match-id');
     var participantId = btn.getAttribute('data-participant-id');
diff --git a/app/templates/pages/teams.html b/app/templates/pages/teams.html
index 27de3d9..efdbe1a 100644
--- a/app/templates/pages/teams.html
+++ b/app/templates/pages/teams.html
@@ -300,7 +300,7 @@
     </div>
 </div>
 
-<script>
+<script nonce="{{ csp_nonce }}">
 function showCreateForm() {
     document.getElementById('createTeamForm').classList.remove('hidden');
 }
diff --git a/app/templates/pages/view_tryout.html b/app/templates/pages/view_tryout.html
index 8ec6a85..09ed9df 100644
--- a/app/templates/pages/view_tryout.html
+++ b/app/templates/pages/view_tryout.html
@@ -562,7 +562,7 @@
     box-shadow: 0 1px 3px rgba(0,0,0,0.12);
 }
 </style>
-<script>
+<script nonce="{{ csp_nonce }}">
 function showCreateTeam() { document.getElementById('createTeamForm').classList.remove('hidden'); }
 function hideCreateTeam() { document.getElementById('createTeamForm').classList.add('hidden'); }
 
diff --git a/app/translations/en/LC_MESSAGES/messages.mo b/app/translations/en/LC_MESSAGES/messages.mo
index 2b4f6ec611aaf6ddc29c0d57b61c862d30bd6916..6b2c918fbbfc925e768ede71cc0b4e7bec70bcb8 100644
GIT binary patch
delta 1232
zcmb8tO=uHQ6o%nDX&SXjlbFV;7$p@9XvAm~bP>dYND(9`*if`;F`+a+1{+Eig0U6d
z_y@J>rig9|f~a*6T-sd`L{u~zD~eqOL@G!Y1@Zmb0oM+bdFD>$&OPVc^Lg9rc<oEb
zeaCPd<QL(Wa%uGMIO#Sfz_1@Xu!QY6imUOKGk)ldpW+&x&)|BjV-Oc`Bf46b=ST6h
zF*UP;n-lzT6Mfh~FE(){ws?%;*7$H0h8!c<#W;p3?7>rb1rs=rD=^HZ6C<dAcB2wG
zvSiJe0dBP52x{UeZoz4cVI4WmA1-n95S21aq5|yUq5zNLA<W=jypP0SKA{qub8H}|
zX>w^}{iU?pz)N}|>_k6qMZLHW6>&GJ^v6*FpG5^$#v)cxC7#DLy7*`x9>dM}7_}8|
zkyp%Dtmy*{ZnV%ZT!)Le0mG~^f;&;Ao5Egvg-KjXTH}^6hfzH;M|2AG2P#mDEYu?b
z)VRwTCr}ma_Ot)`aE1qp>^v%iG1P<yNRyZ+s2=gNib|PBVlY)y;FnQba2=J|xZ@<M
zN2X9cGK=bwRu)TOHc0(dfe9X{NhVPN*{Dq3IDSJd_!~9RA}#gEE>w?XP~W+TalDGk
z@Hr~LSyX`UP(4yd^~k0g8?GklMP=6Sm`6>lBD-NOIbK6fbC(N6F^^F1y+j2(gR0y|
zRKVX+f&IiHHc=JM@^V^^aib=Ak7|<b;pMGJqe^)O^?^KUp<z^yTtM~61gb}#p(+<6
zZS}|jOyWJXZ?sQa?qa!;vr_@L<r%7!hAI_%fAB?1pgcHO%tf;U!-Z(6oXyz_9R=(5
RqW7F@Ptq><KDhp4+Fv&%g$e)w

delta 1121
zcmY+?K}geK7{~GFKbO<xoNa2Uc~F~VtA;ZXAqflW5{w-(L~tFtL=lMz(dB=Mj)8)p
z1$9vJA`$&NsFyT~B#2-Jc@W7<mo6f8$U^%5*bCD5@BO^*yS@MCc^{sS>5UWqW+FUk
zeERtw<$Elo)&A#X*euTS6eh6`W0=Q7Sa9nRxAw7){c&u-Ijq4IY{nw${5BTMeA{C(
z#K!OevnpJ|gZKd}a1ASQ!}%RsSa0K5Oq6pLbC|&wSdW{i1b(3sk4H+jq2Awv8RFXo
zCMh;Xu^p$8$Ceq=xQe>bPgFut24Y(hFJc4s;58(cO`$IG%sG!dw#X30x6V(PAik|L
zsm343W4jE>xQuJ7REJR+r%;J?;w|h&mGn90@Es0fEm2zWHnL^osB=$H@1MaVIFEi4
zllM%<a0^wkt3(^X5zOK$PIzX2P`&Votd!tWRD!P<)C<dQU3BYjsLJi2-dn*f)eEht
z#Jj4gKfhU?4Vu9Us9t!3Dq$1Rh-t@BnV&)3sLy!`)eCu4FN~sk;U#7;PBitxIaC4z
zsKoC$AJkBP1(;$(2WC;d@CDTiyQtE&aJ@8kpl);pmC#L8FWg1-!hKXPte|?~H|ipm
zC>cYYYeb4|ZN8hFMjq>B;PQ4E^~WJp#@A7mx`#^mAu6#6R4+V6l{CVibC^Q)!WgO-
zKBFqPgF5#Y_5RLqZK)Yzs9tDC^}=~n$rez(P{b^D1cTw%UXUygc|mg|C=0ftU%gPa
OJ6Nh(3;nl!!}|xp)oSGc

diff --git a/app/translations/en/LC_MESSAGES/messages.po b/app/translations/en/LC_MESSAGES/messages.po
index 71c9008..05233a6 100644
--- a/app/translations/en/LC_MESSAGES/messages.po
+++ b/app/translations/en/LC_MESSAGES/messages.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: team-tryouts VERSION\n"
 "Report-Msgid-Bugs-To: EMAIL@ADDRESS\n"
-"POT-Creation-Date: 2026-08-07 20:25-0400\n"
+"POT-Creation-Date: 2026-08-07 20:42-0400\n"
 "PO-Revision-Date: 2026-08-07 20:22-0400\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language: en\n"
@@ -268,10 +268,22 @@ msgstr "My Profile"
 msgid "Logout"
 msgstr "Logout"
 
-#: app/templates/layouts/base.html:175
+#: app/templates/layouts/base.html:137
+msgid "Toggle dark mode"
+msgstr "Toggle dark mode"
+
+#: app/templates/layouts/base.html:149 app/templates/layouts/base.html:168
+msgid "Dismiss"
+msgstr "Dismiss"
+
+#: app/templates/layouts/base.html:178
 msgid "Team Tryout Management System"
 msgstr "Team Tryout Management System"
 
+#: app/templates/layouts/macros.html:116
+msgid "Close"
+msgstr "Close"
+
 #: app/templates/pages/login.html:2
 msgid "Login"
 msgstr "Login"
diff --git a/app/translations/fr/LC_MESSAGES/messages.mo b/app/translations/fr/LC_MESSAGES/messages.mo
index dfa46ba51d06618f95caf6fbc53a223ab4e36541..0365579ca0f61e7e0e7ae815f12bf00090f464a1 100644
GIT binary patch
delta 1234
zcmYMzOGs2v9LMo9<8`XhbbOAM*_0@x`9O`L+}J}z2vM*|%^3Bf;tT_Glc2!Kg;a}P
zRMaX8B8j4iYZR@TO^;PYkiD!RS1ycRxCo-}&juRKoX<IT?m74W|DQWAs~^`SKIU2%
z44<8ROZYZ<HT(bRwT#JTx*zi}iYsvfbMSO(el<0}g9ThqVlmEO0KefH^rrt?AHoC1
zBuov19)385nK+LbxQNR!&1VcllZh)ZH)RQ~V_tzx*ou8PiM2R~%P^m=5KB-2HJ}pN
zy=20eFates47G3q%keH&;0)5tAG#{^5tTBmM+MkQrvN*!1^41+yo|(PUZWD5O*xM=
zvq<OX`Acc}A%paCu@JLx1M0>tsEC_UrSC!oJb(%;h7ml3D)Ah)qnAzhVJEJ~Td1RW
zj@)8CV?rCuGth&+V-fzw)tJvy#;^`my6d<HA7MQPN$ae~m^KVD|3GwF_Y;*!fGkw{
zGR()VsQuef6&%ju{I&6T>cS<|ncha4c|jM(PuP#myooe(jZPJrMq)KjQKf!`O5`2V
z%on;U{DIqWE$R1S4{pK-0qU=X3tUj-zpxf_c(wI!XhsFphdRTf*nlT-BPLPzFQE1*
zCGAEmM<v#cx_%H<@*~)Zlh}rD5)8C)8R@7*b*K{ULM`Y+WjKs9<IpLfV@Ry#25S97
zRKQP=EzKO#%p#qB&tUVzScKJh4m+?v$)Jlt9tTp2BdD`Hj(YGF<hadEBuR50_3wCw
ztMDt1qo0G;%Xb31aSC^!H|SPcuE&bR9NT@LZh3qoPISa^+*#kfwCvc>P{a-mhU255
zXl&4S&-mYZyp8qlXl8Mm)ndn^?nHLb<I~8FyB7oJt>E^sGcXph;~^GmO~{Ew`{TA-
ISuo}K3waWVUjP6A

delta 1122
zcmYMyUr3Wt7{~GF-KN%DPPe(WN}<e%=31>(qPi#{C;~CE$o{OvZXyDSE;48YL05xD
z2v$TvWH;i?i6FaaQMN9+D1#zG5F!F^B=V*x`u^yJ#=G-5=WORa&-0u!z42|fI2#L%
z8lPQ!SMgmN(CGiCBV-n3n8i5m#AVorO<3^9!~VF4&CHiEjSsOAE7*eXQ0o`4U{<t0
zbdEA{qQ)$OQ&^9$a0$-fQvB@u6<0G}z#SN?Wi9q%4ks~*v#0<TQGrM6{@I3le>djX
z-+Jh@GjSf*;Z5YRXEYhCqB8n{3Mfp&-WJC_n8t2AiR@)#s6_7iP9Tpxp$X%2-!~Xz
zfBQ(M0q2p&e$pu7AZe>qDOAMmsK7SkS=@#y={WY{3p|1ec3FexkSQyp*4;+E|2{6q
z2`sLp^ODX5oI{oDFuNVXVa#I{%bwXUOffDImDWAL7*<dve~$^AM{S_2RJk<jy*Yop
z7j=Y%2I^1WuF#yq>o|ztQJ1ctMwK{?#AX*!8C*pkE74@|4sOTScnoW}ah*7b3Umx}
z_y~2$zn}u}nyA0ds*S6>1vg;_4xtv5QD<7gtyo26^4p(Jk-kdYiU)8#?!!x{_fDfK
zGJ~qfH`M<<vQk3zMLNnbNu!81Ai>#w)C-QIB0htxwQI;@w`lbHB#z)y%wiY2_2Cfq
z<6~^a2<M;;Gsr1g7m|bJchk}BKZq-E1TW(#>T)GG*a6IA50;W{Amlt3uMK#vrOpN2
cT=;_*$alJ_NIK{~MH8M|Y`hV2_nODOzw4N8ZU6uP

diff --git a/app/translations/fr/LC_MESSAGES/messages.po b/app/translations/fr/LC_MESSAGES/messages.po
index 20d0ac5..76776ec 100644
--- a/app/translations/fr/LC_MESSAGES/messages.po
+++ b/app/translations/fr/LC_MESSAGES/messages.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: team-tryouts VERSION\n"
 "Report-Msgid-Bugs-To: EMAIL@ADDRESS\n"
-"POT-Creation-Date: 2026-08-07 20:25-0400\n"
+"POT-Creation-Date: 2026-08-07 20:42-0400\n"
 "PO-Revision-Date: 2026-08-07 20:22-0400\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language: fr\n"
@@ -268,10 +268,22 @@ msgstr "Mon profil"
 msgid "Logout"
 msgstr "Déconnexion"
 
-#: app/templates/layouts/base.html:175
+#: app/templates/layouts/base.html:137
+msgid "Toggle dark mode"
+msgstr "Basculer le mode sombre"
+
+#: app/templates/layouts/base.html:149 app/templates/layouts/base.html:168
+msgid "Dismiss"
+msgstr "Fermer"
+
+#: app/templates/layouts/base.html:178
 msgid "Team Tryout Management System"
 msgstr "Système de gestion des sélections d'équipe"
 
+#: app/templates/layouts/macros.html:116
+msgid "Close"
+msgstr "Fermer"
+
 #: app/templates/pages/login.html:2
 msgid "Login"
 msgstr "Connexion"
diff --git a/tests/test_csp.py b/tests/test_csp.py
new file mode 100644
index 0000000..b8bdfc1
--- /dev/null
+++ b/tests/test_csp.py
@@ -0,0 +1,156 @@
+"""Content Security Policy, and the migration away from 'unsafe-inline'.
+
+SEC-WEB-001 / OPS-010. script-src still carries 'unsafe-inline', which is
+why the stored XSS of SEC-XSS-001 executed instead of being blocked.
+
+Removing it is not a one-line change. A nonce authorises `<script>`
+elements; it can do nothing for `onclick="..."` attributes, and there are
+dozens of those across the templates. Under CSP level 3 a browser also
+ignores 'unsafe-inline' the moment a nonce appears, so the two cannot
+coexist as a gradual transition — the switch is atomic.
+
+The counts below are a ratchet: they may only go down. Migrating a
+template and lowering the number is a deliberate act, recorded in the
+diff. Adding a new inline handler turns the suite red.
+"""
+
+import os
+import re
+
+import pytest
+
+from app.app import build_csp
+
+TEMPLATE_ROOT = os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    'app', 'templates',
+)
+
+#: Attributes a nonce can never authorise.
+INLINE_HANDLER = re.compile(
+    r'\son(?:click|change|submit|input|load|keyup|keydown|mouseover|focus|blur)\s*=',
+    re.I,
+)
+
+#: Remaining inline handlers, per template. Lower these as you migrate;
+#: never raise one. Templates absent from this map must have none.
+HANDLER_BUDGET = {
+    'pages/match_form.html': 13,
+    'pages/calendar.html': 11,
+    'pages/teams.html': 11,
+    'pages/evaluate_player.html': 9,
+    'pages/view_tryout.html': 8,
+    'pages/contracts.html': 4,
+    'pages/notes.html': 4,
+    'pages/team_matches.html': 4,
+    'pages/coach_availability.html': 3,
+    'pages/profile.html': 3,
+    'pages/one_on_one.html': 2,
+    'pages/my_teams.html': 1,
+    'pages/register.html': 1,
+    'pages/users.html': 1,
+    'pages/view_user.html': 1,
+}
+
+#: What the ratchet is counting down to.
+TOTAL_BUDGET = sum(HANDLER_BUDGET.values())
+
+
+def _templates():
+    for root, _dirs, files in os.walk(TEMPLATE_ROOT):
+        for name in files:
+            if name.endswith('.html'):
+                full = os.path.join(root, name)
+                rel = os.path.relpath(full, TEMPLATE_ROOT).replace(os.sep, '/')
+                yield rel, full
+
+
+def _count_handlers(path):
+    with open(path, encoding='utf-8') as handle:
+        return len(INLINE_HANDLER.findall(handle.read()))
+
+
+class TestPolicyHeader:
+    def test_the_current_policy_still_allows_inline_script(self, client):
+        """Documents where we are, not where we want to be."""
+        csp = client.get('/auth/login').headers['Content-Security-Policy']
+        assert "'unsafe-inline'" in csp
+
+    def test_the_policy_pins_the_dangerous_directives(self, client):
+        csp = client.get('/auth/login').headers['Content-Security-Policy']
+
+        assert "default-src 'self'" in csp
+        assert "frame-ancestors 'none'" in csp
+        assert "base-uri 'self'" in csp
+        assert "form-action 'self'" in csp
+        assert "object-src" not in csp or "object-src 'none'" in csp
+
+    def test_no_nonce_is_emitted_while_inline_script_is_allowed(self, client):
+        """Emitting both would silently drop every inline script in modern
+        browsers, since a nonce makes them ignore 'unsafe-inline'."""
+        csp = client.get('/auth/login').headers['Content-Security-Policy']
+        assert 'nonce-' not in csp
+
+    def test_the_hardened_policy_carries_a_nonce_and_no_unsafe_inline(self):
+        csp = build_csp(allow_inline_script=False, nonce='abc123')
+
+        assert "'nonce-abc123'" in csp
+        assert "'unsafe-inline'" not in csp.split('style-src')[0]
+
+    def test_each_request_gets_a_distinct_nonce(self, app):
+        """A reused nonce is worth no more than 'unsafe-inline'."""
+        application = app
+        application.config['CSP_ALLOW_INLINE_SCRIPT'] = False
+        client = application.test_client()
+
+        seen = set()
+        for _ in range(5):
+            csp = client.get('/auth/login').headers['Content-Security-Policy']
+            seen.add(re.search(r"'nonce-([^']+)'", csp).group(1))
+
+        assert len(seen) == 5
+
+
+class TestInlineHandlerRatchet:
+    @pytest.mark.parametrize('relative,full', list(_templates()))
+    def test_a_template_never_gains_an_inline_handler(self, relative, full):
+        allowed = HANDLER_BUDGET.get(relative, 0)
+        found = _count_handlers(full)
+
+        assert found <= allowed, (
+            f'{relative} has {found} inline event handler(s), budget is '
+            f'{allowed}. A nonce cannot authorise these — use '
+            f'data-action="..." and the delegated listener in main.js.'
+        )
+
+    def test_the_budget_map_has_no_stale_entries(self):
+        """Lower an entry to zero and it must be deleted, so the map keeps
+        reflecting the real remaining work."""
+        actual = {rel: _count_handlers(full) for rel, full in _templates()}
+
+        stale = [rel for rel, allowed in HANDLER_BUDGET.items()
+                 if actual.get(rel, 0) < allowed]
+
+        assert not stale, (
+            f'Budget is now higher than reality for {stale}. Lower or remove '
+            f'these entries so the count keeps meaning something.'
+        )
+
+    def test_the_shared_layout_is_already_free_of_them(self):
+        """base.html and macros.html render on every single page, so they
+        were migrated first."""
+        for relative in ('layouts/base.html', 'layouts/macros.html'):
+            full = os.path.join(TEMPLATE_ROOT, *relative.split('/'))
+            assert _count_handlers(full) == 0, f'{relative} regressed'
+
+    def test_progress_is_recorded(self):
+        """Fails when the total drops, as a reminder to update the budget
+        and, once it reaches zero, to flip CSP_ALLOW_INLINE_SCRIPT."""
+        total = sum(_count_handlers(full) for _rel, full in _templates())
+
+        assert total <= TOTAL_BUDGET
+        assert total == TOTAL_BUDGET, (
+            f'{TOTAL_BUDGET - total} handler(s) removed since the budget was '
+            f'last updated — lower HANDLER_BUDGET to {total}. At zero, set '
+            f'CSP_ALLOW_INLINE_SCRIPT to false and delete this ratchet.'
+        )