fix(data): une saisie d heure refusee n efface plus la disponibilite

MNT-12. Le meme bloc de parsing date/heure vivait dans quatre modules avec
trois reponses differentes a la meme saisie invalide : signaler et rediriger,
mettre la valeur a None et annoncer la reussite, ou passer au suivant en
silence. Les vagues E et G ont ferme le cote matchs avec des schemas ; il
restait la disponibilite, les creneaux de coach et les demandes individuelles.

Deux choses trouvees en appliquant, aucune dans le constat.

OneOnOneRequestSchema et DisponibilityAddSchema etaient definis dans
validators.py et appeles NULLE PART : aucun import, aucun test. C'est le
motif SEC-AUTHZ-001 -- une politique de validation ecrite et non appliquee --
qui survivait dans un coin que personne n'avait rouvert. Les deux passaient
d'ailleurs par des fields.String + Regexp, qui verifient la forme et laissent
l'appelant convertir ; fields.Date et fields.Time font les deux.

Et manage_coach_availability supprimait tous les creneaux existants avant de
reajouter ceux qu'il savait lire, ignorant les autres en silence et repondant
{'success': true}. Un envoi malforme effacait donc les heures reservables
d'un coach en annoncant la reussite -- et les demandes individuelles sont
refusees contre exactement cette table, donc le coach devenait injoignable
sans que rien ne le dise. Une operation de remplacement doit tout valider
avant de rien supprimer : le lot est refuse en entier.

Trouve aussi : le controle de disponibilite comparait les chaines du
formulaire aux chaines serialisees, ce qui ne marchait que parce que les deux
cotes etaient en HH:MM a zero non significatif. La comparaison porte
desormais sur des objets time.

Et le lint a rattrape une regression que la relecture avait manquee --
sixieme fois : datetime retire de one_on_one.py alors que deux fonctions non
touchees l'utilisaient encore.

Co-Authored-By: Claude Opus 5 <[email protected]>

app/routes/users/availability.py

@@ -5,22 +5,52 @@ weekly availability blocks, and a coach's bookable slots for one-on-one
 sessions.
 """
 
-from datetime import datetime, timedelta
-
 from flask import flash, jsonify, redirect, render_template, request, url_for
 from flask_babel import gettext as _
 from flask_login import current_user, login_required
+from marshmallow import ValidationError
 
 from app.api import json_endpoint
 from app.extensions import db
+from app.forms import form_payload
 from app.models import Coach, CoachAvailability, PlayerDisponibility, User
 from app.routes.users.blueprint import users_bp
-
-DAY_NAMES = ['Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday', 'Sunday']
+from app.timeslots import day_name, slot_end
+from app.validators import TimeSlotSchema
 
 
-def add_30_minutes(t):
-    return (datetime.combine(datetime.today(), t) + timedelta(minutes=30)).time()
+def _load_slots(payload_slots):
+    """Validate a batch of posted slots, keeping the rejects.
+
+    Both bulk endpoints used to `continue` past anything malformed and then
+    answer `{'success': True}`. The client had no way to learn that a slot
+    had been dropped — and for coach availability that is destructive, since
+    the route deletes every existing slot before re-adding the ones it
+    accepted. A payload the browser mangled could therefore wipe a coach's
+    bookable hours and report success (MNT-12).
+
+    Args:
+        payload_slots: Whatever arrived under the `slots` key.
+
+    Returns:
+        tuple[list[dict], list[str]]: Accepted slots, and one message per
+        rejected one.
+    """
+    schema = TimeSlotSchema()
+    accepted, rejected = [], []
+    for index, raw in enumerate(payload_slots or []):
+        if not isinstance(raw, dict):
+            rejected.append(f'slot {index}: expected an object')
+            continue
+        try:
+            accepted.append(schema.load(raw))
+        except ValidationError as err:
+            details = '; '.join(
+                f'{field}: {" ".join(str(m) for m in messages)}'
+                for field, messages in err.messages.items()
+            )
+            rejected.append(f'slot {index}: {details}')
+    return accepted, rejected
 
 
 @users_bp.route('/disponibilities')
@@ -43,7 +73,7 @@ def get_disponibilities():
                 {
                     'id': d.id,
                     'day_of_week': d.day_of_week,
-                    'day_name': DAY_NAMES[d.day_of_week],
+                    'day_name': day_name(d.day_of_week),
                     'start_time': d.start_time.strftime('%H:%M'),
                     'end_time': d.end_time.strftime('%H:%M'),
                 }
@@ -68,7 +98,7 @@ def get_my_disponibilities():
             {
                 'id': d.id,
                 'day_of_week': d.day_of_week,
-                'day_name': DAY_NAMES[d.day_of_week],
+                'day_name': day_name(d.day_of_week),
                 'start_time': d.start_time.strftime('%H:%M'),
                 'end_time': d.end_time.strftime('%H:%M'),
             }
@@ -81,21 +111,18 @@ def get_my_disponibilities():
 @login_required
 def add_disponibility():
     """Add a disponibility block for the current player."""
-    day_of_week = request.form.get('day_of_week', type=int)
-    start_time_str = request.form.get('start_time')
-    if day_of_week is None or day_of_week < 0 or day_of_week > 6:
-        return jsonify({'error': 'Invalid day of week'}), 400
     try:
-        start_time = datetime.strptime(start_time_str, '%H:%M').time()
-    except (ValueError, TypeError):
-        return jsonify({'error': 'Invalid time format'}), 400
+        slot = TimeSlotSchema().load(form_payload())
+    except ValidationError as err:
+        return jsonify({'error': 'Invalid slot', 'details': err.messages}), 400
 
-    end_time = add_30_minutes(start_time)
+    day_of_week = slot['day_of_week']
+    start_time = slot['start_time']
     disponibility = PlayerDisponibility(
         player_id=current_user.id,
         day_of_week=day_of_week,
         start_time=start_time,
-        end_time=end_time,
+        end_time=slot_end(start_time),
     )
     db.session.add(disponibility)
     db.session.commit()
@@ -103,7 +130,7 @@ def add_disponibility():
         {
             'id': disponibility.id,
             'day_of_week': disponibility.day_of_week,
-            'day_name': DAY_NAMES[disponibility.day_of_week],
+            'day_name': day_name(disponibility.day_of_week),
             'start_time': disponibility.start_time.strftime('%H:%M'),
             'end_time': disponibility.end_time.strftime('%H:%M'),
         }
@@ -115,31 +142,23 @@ def add_disponibility():
 @login_required
 def add_disponibilities_bulk():
     """Add multiple disponibility blocks at once."""
-    data = request.get_json()
-    slots = data.get('slots', [])
-    created = []
-    for slot in slots:
-        day_of_week = slot.get('day_of_week')
-        start_time_str = slot.get('start_time')
-        if day_of_week is None or day_of_week < 0 or day_of_week > 6:
-            continue
-        try:
-            start_time = datetime.strptime(start_time_str, '%H:%M').time()
-        except (ValueError, TypeError):
-            continue
+    data = request.get_json(silent=True) or {}
+    accepted, rejected = _load_slots(data.get('slots'))
 
-        end_time = add_30_minutes(start_time)
+    created = []
+    for slot in accepted:
+        start_time = slot['start_time']
         existing = PlayerDisponibility.query.filter_by(
             player_id=current_user.id,
-            day_of_week=day_of_week,
+            day_of_week=slot['day_of_week'],
             start_time=start_time,
         ).first()
         if not existing:
             disponibility = PlayerDisponibility(
                 player_id=current_user.id,
-                day_of_week=day_of_week,
+                day_of_week=slot['day_of_week'],
                 start_time=start_time,
-                end_time=end_time,
+                end_time=slot_end(start_time),
             )
             db.session.add(disponibility)
             db.session.flush()
@@ -147,12 +166,16 @@ def add_disponibilities_bulk():
                 {
                     'id': disponibility.id,
                     'day_of_week': disponibility.day_of_week,
-                    'day_name': DAY_NAMES[disponibility.day_of_week],
+                    'day_name': day_name(disponibility.day_of_week),
                     'start_time': disponibility.start_time.strftime('%H:%M'),
                 }
             )
     db.session.commit()
-    return jsonify({'success': True, 'created': created})
+    # `rejected` is reported rather than swallowed. What was accepted is
+    # still saved — dropping a whole batch because one cell was malformed
+    # would be its own kind of surprise — but the client can now tell the
+    # difference between "nine slots saved" and "ten sent, nine saved".
+    return jsonify({'success': True, 'created': created, 'rejected': rejected})
 
 
 @users_bp.route('/disponibilities/clear', methods=['POST'])
@@ -188,36 +211,42 @@ def manage_coach_availability():
         return redirect(url_for('main.dashboard'))
 
     if request.method == 'POST':
-        data = request.get_json()
-        slots = data.get('slots', []) if data else []
+        data = request.get_json(silent=True) or {}
+        accepted, rejected = _load_slots(data.get('slots'))
+
+        # Validate everything before deleting anything.
+        #
+        # This route replaces the coach's availability: it deleted every
+        # existing slot and then re-added the ones it could parse, skipping
+        # the rest in silence and answering `{'success': true}`. A payload
+        # the browser mangled therefore wiped a coach's bookable hours and
+        # reported success — and one-on-one requests are refused against
+        # exactly this table, so the coach became unbookable with nothing to
+        # show for it. Refusing the whole batch is the only safe answer when
+        # the operation is a replacement (MNT-12).
+        if rejected:
+            return jsonify(
+                {
+                    'error': 'Invalid slots; nothing was changed.',
+                    'rejected': rejected,
+                }
+            ), 400
 
-        # Clear existing availability
         CoachAvailability.query.filter_by(coach_id=current_user.id).delete()
 
-        # Add new slots
-        for slot in slots:
-            day_of_week = slot.get('day_of_week')
-            start_time_str = slot.get('start_time')
-            if day_of_week is None or day_of_week < 0 or day_of_week > 6:
-                continue
-            try:
-                start_time = datetime.strptime(start_time_str, '%H:%M').time()
-                end_time = (
-                    datetime.combine(datetime.today(), start_time) + timedelta(minutes=30)
-                ).time()
-            except (ValueError, TypeError):
-                continue
-
-            availability = CoachAvailability(
-                coach_id=current_user.id,
-                day_of_week=day_of_week,
-                start_time=start_time,
-                end_time=end_time,
+        for slot in accepted:
+            start_time = slot['start_time']
+            db.session.add(
+                CoachAvailability(
+                    coach_id=current_user.id,
+                    day_of_week=slot['day_of_week'],
+                    start_time=start_time,
+                    end_time=slot_end(start_time),
+                )
             )
-            db.session.add(availability)
 
         db.session.commit()
-        return jsonify({'success': True})
+        return jsonify({'success': True, 'saved': len(accepted)})
 
     existing_availability = CoachAvailability.query.filter_by(
         coach_id=current_user.id,