Merge immortal/main into audit/securite-maintenabilite-standards

app/templates/pages/coach_availability.html

@@ -1,5 +1,5 @@
 {% extends "layouts/base.html" %}
-{% block title %}{{ _('Manage Availability') }} - TryoutPro{% endblock %}
+{% block title %}{{ _('Manage Availability') }} - UdeS team manager{% endblock %}
 {% block page_title %}{{ _('Manage Availability') }}{% endblock %}
 {% block breadcrumb %}<span class="breadcrumb">Home / Coach Availability</span>{% endblock %}
 
@@ -15,6 +15,9 @@
         </div>
         
         <div class="form-actions mt-4">
+            <button type="button" class="btn btn-primary" data-action="save-availability">
+                <i class="fas fa-save"></i> {{ _('Save Availability') }}
+            </button>
             <button type="button" class="btn btn-secondary" data-action="clear-availability">
                 <i class="fas fa-trash"></i> {{ _('Clear All') }}
             </button>
@@ -170,13 +173,18 @@ function saveAvailability() {
     
     fetch('{{ url_for("users.manage_coach_availability") }}', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: {
+            'Content-Type': 'application/json',
+            'X-CSRFToken': '{{ csrf_token() }}'
+        },
         body: JSON.stringify({ slots: slots })
     })
     .then(response => response.json())
     .then(data => {
         if (data.success) {
             flash('Availability saved!', 'success');
+        } else {
+            flash(data.error || 'Error saving availability.', 'danger');
         }
     })
     .catch(function(error) {
@@ -190,7 +198,10 @@ function clearAllAvailability() {
         return;
     }
     
-    fetch('{{ url_for("users.clear_coach_availability") }}', { method: 'POST' })
+    fetch('{{ url_for("users.clear_coach_availability") }}', {
+        method: 'POST',
+        headers: { 'X-CSRFToken': '{{ csrf_token() }}' }
+    })
     .then(response => response.json())
     .then(data => {
         if (data.success) {
@@ -222,8 +233,9 @@ document.addEventListener('click', function(e) {
 // dispatched by the delegated listener in main.js. This replaces inline
 // onclick attributes, which no CSP nonce is able to authorise.
 registerActions({
+    'save-availability': saveAvailability,
     'clear-availability': clearAllAvailability,
     'toggle-slot': toggleSlot,
 });
 </script>
-{% endblock %}
+{% endblock %}