mise à jour du README
This commit is contained in:
@@ -1,38 +1,61 @@
|
|||||||
### Plateforme centralisée de tryouts
|
# Plateforme centralisée de tryouts
|
||||||
|
|
||||||
## Security Configuration
|
## Security Configuration
|
||||||
|
|
||||||
### Required Environment Variables
|
### Required Environment Variables
|
||||||
|
|
||||||
Before deploying, create a `.env` file with the following:
|
Before deploying, create a `.env` file which integrates everything in the .env.exemple.
|
||||||
|
Ensure you follow the comments of the exemple if you are to use this tool in production.
|
||||||
|
|
||||||
```
|
|
||||||
# Flask Configuration (REQUIRED)
|
|
||||||
SECRET_KEY=your-secure-random-secret-key-here
|
|
||||||
|
|
||||||
# Production Settings
|
|
||||||
FLASK_DEBUG=false
|
|
||||||
FORCE_HTTPS=true
|
|
||||||
SESSION_COOKIE_SECURE=true
|
|
||||||
```
|
|
||||||
|
|
||||||
### Security Features Implemented
|
### Security Features Implemented
|
||||||
|
|
||||||
- **Rate Limiting**: Login endpoint limited to 10 requests per minute to prevent brute-force attacks
|
- **Rate Limiting**: Login endpoint limited to 10 requests per minute to prevent brute-force attacks
|
||||||
- **Secure Session Cookies**: HTTPOnly, SameSite=Lax, and Secure flags enabled
|
- **Secure Session Cookies**: HTTPSOnly, SameSite=Lax, and Secure flags enabled
|
||||||
- **CSRF Protection**: Enabled by default on all forms
|
- **CSRF Protection**: Enabled by default on all forms
|
||||||
- **HTTPS Enforcement**: Automatic redirect to HTTPS in production
|
- **HTTPS Enforcement**: Automatic redirect to HTTPS in production
|
||||||
- **Security Headers**: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, HSTS
|
- **Security Headers**: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, HSTS
|
||||||
- **Open Redirect Prevention**: URL validation on login redirect
|
- **Open Redirect Prevention**: URL validation on login redirect
|
||||||
- **Authorization Checks**: Proper ownership validation on all sensitive operations
|
- **Authorization Checks**: Proper ownership validation on all sensitive operations
|
||||||
|
- **nginx**: reverse-proxy and load balancer
|
||||||
|
- **Waitress WSGI**: Production ready WSGI
|
||||||
|
|
||||||
## Discord Integration for One on One Requests
|
### When true in .env:
|
||||||
|
- **Forces HTTPS only**
|
||||||
|
- **Forcer secure cookies**
|
||||||
|
|
||||||
The application supports sending Discord direct messages to coaches when players request One on One sessions.
|
## App details
|
||||||
|
|
||||||
|
### Code
|
||||||
|
|
||||||
|
- Full python backend using flask
|
||||||
|
- statics are pure HTML and CSS
|
||||||
|
- Some js to add logic to styling and showing certain pages/cards
|
||||||
|
|
||||||
|
### Functionalities
|
||||||
|
|
||||||
|
- **User base with sign-ins**: Forces users to create an account and register pertinent information for tryouts and teams. The admin can attribute them a role.
|
||||||
|
- **User-Role-Based Permissions**: admin - full acces, coach/manager - access to team management, player - views what he is registered in (no management), scout - view only
|
||||||
|
- **Tryout Management**: manage internal tryout teams, organise internal tryouts matches (3 formats, team vs team, PvP, scrim). Coaches can Evaluate players based on 10 criteria
|
||||||
|
- **Team Management**: manage teams for the season, create matches and practices. When planning a practice there will be a calendar showing player availabitlities slots to help chose a time
|
||||||
|
- **Coach and Player Availabilities**: Allow better planning for the coaches, and for players to book One on Ones with their coach.
|
||||||
|
- **Player Notes**: Coaches can give notes to their players. The players will see them and there is a history which keeps the most recent notes.
|
||||||
|
- **Team Notes**: Coaches can give notes to their teams, where all players from that team can see the note.
|
||||||
|
- **One on One**: Players can request a One on One meeting with their coach. This sends a discord dm to the coach to accept or refuse. The player is then notified of the response.
|
||||||
|
- **Availabilities**: Allow players and coach to enter the moments they are available. Allows for easier practice setup and One on One planning.
|
||||||
|
|
||||||
|
|
||||||
|
## Discord Integration
|
||||||
|
|
||||||
|
The application supports sending Discord direct messages to coaches when players request One on One sessions,
|
||||||
|
when matches/tryouts/practices are created and a player is in it, and the players get match reminders 24h before a match.
|
||||||
|
|
||||||
|
When sending a **One on One** request, the coach can accept via the platform or react to the discord message to answer the booking request.
|
||||||
|
Same thing with **matches** and **practices**, the players can react or answer on the platform.
|
||||||
|
|
||||||
### Setup Instructions
|
### Setup Instructions
|
||||||
|
|
||||||
#### 1. Create a Discord Bot
|
#### 1. Create a Discord Bot (Not needed for UdeS user, the bot already exists)
|
||||||
|
|
||||||
1. Go to the [Discord Developer Portal](https://discord.com/developers/applications)
|
1. Go to the [Discord Developer Portal](https://discord.com/developers/applications)
|
||||||
2. Create a new application
|
2. Create a new application
|
||||||
@@ -40,34 +63,21 @@ The application supports sending Discord direct messages to coaches when players
|
|||||||
4. Copy the bot token - this will be your `DISCORD_BOT_TOKEN`
|
4. Copy the bot token - this will be your `DISCORD_BOT_TOKEN`
|
||||||
5. Enable the "Message Content Intent" under Privileged Gateway Intents (required for sending messages)
|
5. Enable the "Message Content Intent" under Privileged Gateway Intents (required for sending messages)
|
||||||
|
|
||||||
#### 2. Configure Environment Variables
|
#### 2. Add Bot to your server
|
||||||
|
|
||||||
Add the following to your `.env` file (create one if it doesn't exist):
|
For the bot to send DMs:
|
||||||
|
1. Each user must have the bot added to their Discord server OR be friends with the bot
|
||||||
```
|
2. Users need to add their Discord User ID to their profile:
|
||||||
DISCORD_BOT_TOKEN=your_bot_token_here
|
|
||||||
DISCORD_WEBHOOK_URL=optional_webhook_url_for_backup
|
|
||||||
```
|
|
||||||
|
|
||||||
- `DISCORD_BOT_TOKEN`: Required for sending direct messages to coaches
|
|
||||||
- `DISCORD_WEBHOOK_URL`: Optional fallback for webhook-based notifications
|
|
||||||
|
|
||||||
#### 3. Add Coaches to the Bot
|
|
||||||
|
|
||||||
For the bot to send DMs to coaches:
|
|
||||||
1. Each coach must have the bot added to their Discord server OR be friends with the bot
|
|
||||||
2. Coaches need to add their Discord User ID to their profile:
|
|
||||||
- Enable Developer Mode in Discord (User Settings → Advanced → Developer Mode)
|
- Enable Developer Mode in Discord (User Settings → Advanced → Developer Mode)
|
||||||
- Right-click on their profile → Copy ID
|
- Right-click on their profile → Copy ID
|
||||||
- Enter this numeric ID in the "Discord User ID" field in their profile settings
|
- Enter this numeric ID in the "Discord User ID" field in their profile settings
|
||||||
|
|
||||||
|
|
||||||
### How It Works
|
### How It Works
|
||||||
|
|
||||||
When a player submits a One on One request:
|
When a player submits a One on One request:
|
||||||
1. The system checks if the coach has a Discord User ID configured
|
1. The system checks if the coach has a Discord User ID configured
|
||||||
2. If configured, a direct message is sent to the coach via the Discord bot
|
2. If configured, a direct message is sent to the coach via the Discord bot
|
||||||
3. If the bot fails or no Discord User ID is set, the system falls back to the webhook URL (if configured)
|
|
||||||
4. The message includes player name, team, requested date/time, and discussion points
|
|
||||||
|
|
||||||
### Message Format
|
### Message Format
|
||||||
|
|
||||||
@@ -76,4 +86,5 @@ The Discord DM includes:
|
|||||||
- Team name
|
- Team name
|
||||||
- Requested date and time slot
|
- Requested date and time slot
|
||||||
- Discussion points (if provided)
|
- Discussion points (if provided)
|
||||||
- Link to the application for approval/rejection
|
- Link to the application for approval/rejection
|
||||||
|
- Two provided reactions to accept or refuse via discord
|
||||||
Reference in New Issue
Block a user