mise à jour du README
This commit is contained in:
cedrick2711
@@ -1,38 +1,61 @@
|
||||
### Plateforme centralisée de tryouts
|
||||
# Plateforme centralisée de tryouts
|
||||
|
||||
## Security Configuration
|
||||
|
||||
### Required Environment Variables
|
||||
|
||||
Before deploying, create a `.env` file with the following:
|
||||
Before deploying, create a `.env` file which integrates everything in the .env.exemple.
|
||||
Ensure you follow the comments of the exemple if you are to use this tool in production.
|
||||
|
||||
```
|
||||
# Flask Configuration (REQUIRED)
|
||||
SECRET_KEY=your-secure-random-secret-key-here
|
||||
|
||||
# Production Settings
|
||||
FLASK_DEBUG=false
|
||||
FORCE_HTTPS=true
|
||||
SESSION_COOKIE_SECURE=true
|
||||
```
|
||||
|
||||
### Security Features Implemented
|
||||
|
||||
- **Rate Limiting**: Login endpoint limited to 10 requests per minute to prevent brute-force attacks
|
||||
- **Secure Session Cookies**: HTTPOnly, SameSite=Lax, and Secure flags enabled
|
||||
- **Secure Session Cookies**: HTTPSOnly, SameSite=Lax, and Secure flags enabled
|
||||
- **CSRF Protection**: Enabled by default on all forms
|
||||
- **HTTPS Enforcement**: Automatic redirect to HTTPS in production
|
||||
- **Security Headers**: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, HSTS
|
||||
- **Open Redirect Prevention**: URL validation on login redirect
|
||||
- **Authorization Checks**: Proper ownership validation on all sensitive operations
|
||||
- **nginx**: reverse-proxy and load balancer
|
||||
- **Waitress WSGI**: Production ready WSGI
|
||||
|
||||
## Discord Integration for One on One Requests
|
||||
### When true in .env:
|
||||
- **Forces HTTPS only**
|
||||
- **Forcer secure cookies**
|
||||
|
||||
The application supports sending Discord direct messages to coaches when players request One on One sessions.
|
||||
## App details
|
||||
|
||||
### Code
|
||||
|
||||
- Full python backend using flask
|
||||
- statics are pure HTML and CSS
|
||||
- Some js to add logic to styling and showing certain pages/cards
|
||||
|
||||
### Functionalities
|
||||
|
||||
- **User base with sign-ins**: Forces users to create an account and register pertinent information for tryouts and teams. The admin can attribute them a role.
|
||||
- **User-Role-Based Permissions**: admin - full acces, coach/manager - access to team management, player - views what he is registered in (no management), scout - view only
|
||||
- **Tryout Management**: manage internal tryout teams, organise internal tryouts matches (3 formats, team vs team, PvP, scrim). Coaches can Evaluate players based on 10 criteria
|
||||
- **Team Management**: manage teams for the season, create matches and practices. When planning a practice there will be a calendar showing player availabitlities slots to help chose a time
|
||||
- **Coach and Player Availabilities**: Allow better planning for the coaches, and for players to book One on Ones with their coach.
|
||||
- **Player Notes**: Coaches can give notes to their players. The players will see them and there is a history which keeps the most recent notes.
|
||||
- **Team Notes**: Coaches can give notes to their teams, where all players from that team can see the note.
|
||||
- **One on One**: Players can request a One on One meeting with their coach. This sends a discord dm to the coach to accept or refuse. The player is then notified of the response.
|
||||
- **Availabilities**: Allow players and coach to enter the moments they are available. Allows for easier practice setup and One on One planning.
|
||||
|
||||
|
||||
## Discord Integration
|
||||
|
||||
The application supports sending Discord direct messages to coaches when players request One on One sessions,
|
||||
when matches/tryouts/practices are created and a player is in it, and the players get match reminders 24h before a match.
|
||||
|
||||
When sending a **One on One** request, the coach can accept via the platform or react to the discord message to answer the booking request.
|
||||
Same thing with **matches** and **practices**, the players can react or answer on the platform.
|
||||
|
||||
### Setup Instructions
|
||||
|
||||
#### 1. Create a Discord Bot
|
||||
#### 1. Create a Discord Bot (Not needed for UdeS user, the bot already exists)
|
||||
|
||||
1. Go to the [Discord Developer Portal](https://discord.com/developers/applications)
|
||||
2. Create a new application
|
||||
@@ -40,34 +63,21 @@ The application supports sending Discord direct messages to coaches when players
|
||||
4. Copy the bot token - this will be your `DISCORD_BOT_TOKEN`
|
||||
5. Enable the "Message Content Intent" under Privileged Gateway Intents (required for sending messages)
|
||||
|
||||
#### 2. Configure Environment Variables
|
||||
#### 2. Add Bot to your server
|
||||
|
||||
Add the following to your `.env` file (create one if it doesn't exist):
|
||||
|
||||
```
|
||||
DISCORD_BOT_TOKEN=your_bot_token_here
|
||||
DISCORD_WEBHOOK_URL=optional_webhook_url_for_backup
|
||||
```
|
||||
|
||||
- `DISCORD_BOT_TOKEN`: Required for sending direct messages to coaches
|
||||
- `DISCORD_WEBHOOK_URL`: Optional fallback for webhook-based notifications
|
||||
|
||||
#### 3. Add Coaches to the Bot
|
||||
|
||||
For the bot to send DMs to coaches:
|
||||
1. Each coach must have the bot added to their Discord server OR be friends with the bot
|
||||
2. Coaches need to add their Discord User ID to their profile:
|
||||
For the bot to send DMs:
|
||||
1. Each user must have the bot added to their Discord server OR be friends with the bot
|
||||
2. Users need to add their Discord User ID to their profile:
|
||||
- Enable Developer Mode in Discord (User Settings → Advanced → Developer Mode)
|
||||
- Right-click on their profile → Copy ID
|
||||
- Enter this numeric ID in the "Discord User ID" field in their profile settings
|
||||
|
||||
|
||||
### How It Works
|
||||
|
||||
When a player submits a One on One request:
|
||||
1. The system checks if the coach has a Discord User ID configured
|
||||
2. If configured, a direct message is sent to the coach via the Discord bot
|
||||
3. If the bot fails or no Discord User ID is set, the system falls back to the webhook URL (if configured)
|
||||
4. The message includes player name, team, requested date/time, and discussion points
|
||||
|
||||
### Message Format
|
||||
|
||||
@@ -76,4 +86,5 @@ The Discord DM includes:
|
||||
- Team name
|
||||
- Requested date and time slot
|
||||
- Discussion points (if provided)
|
||||
- Link to the application for approval/rejection
|
||||
- Link to the application for approval/rejection
|
||||
- Two provided reactions to accept or refuse via discord
|
||||
Reference in New Issue
Block a user