ajouter des sécurité sur les URL, les Roles, les mdp

routes/tryouts.py

@@ -31,7 +31,7 @@ def list_tryouts():
         - Manager: Only their created tryouts
         - Coach: Tryouts targeting their org team
         - Player: Upcoming and in-progress tryouts
-    
+        
     Returns:
         Response: Rendered tryouts list template.
     """
@@ -248,8 +248,10 @@ def view_tryout(tryout_id):
         
         can_view_calendar = is_registered or player_in_match
 
-    # Get all players (for manager registration dropdown)
-    all_players = User.query.filter_by(role='player').order_by(User.full_name).all()
+    # Only expose all_players to users who can manage players in this tryout
+    all_players = None
+    if can_edit:
+        all_players = User.query.filter_by(role='player').order_by(User.full_name).all()
     
     # Get matches for this tryout with participant info
     matches = Match.query.filter_by(tryout_id=tryout_id).order_by(Match.date).all()