refactor(authz): un seul point de verite pour les autorisations d equipe

ARCH-002. La question "a quelles equipes ce coach est-il rattache ?" etait
posee a huit endroits, de cinq facons differentes, et trois d entre elles
donnaient une mauvaise reponse en production.

Le motif fautif, present tel quel dans six routes :

    OrgTeam.query.filter_by(coach_id=user.id).first()

Il repond au plus une equipe, et seulement par la colonne heritee. Deux
pannes en decoulaient, silencieuses -- les pages s affichaient, vides :

  - un coach rattache uniquement par la relation many-to-many n avait
    aucune equipe, donc aucun joueur, aucun contrat, aucune note d equipe,
    aucun match a venir sur son tableau de bord ;
  - un coach de deux equipes n en voyait qu une. Le formulaire de contrat
    lui proposait la moitie de son effectif, alors que la route POST
    acceptait l autre moitie.

app/permissions.py devient le module ou la question se pose une fois :
coach_org_teams, manager_org_teams, attached_org_teams, visible_org_teams,
can_manage_org_team, org_team_player_ids, coach_player_ids,
can_manage_player_contract, coach_tryouts, coach_manages_tryout. Toutes
lisent les deux rattachements et toutes les equipes.

Le meme ecart existait dans le modele : Coach.get_visible_tryouts ne lisait
que la relation m2m -- calendrier vide pour un coach rattache par la
colonne -- et can_manage_this_tryout ignorait la colonne pour l equipe
cible. Les deux delegent desormais.

Corrections de portee, au passage
  - one_on_one lisait org_team.coach_id : un joueur dont l equipe declare
    ses coachs par la relation etait informe qu il n avait pas de coach, et
    le formulaire de demande restait ferme. Passe par get_coaches(), qui
    retombe deja sur la colonne heritee.
  - notes_dashboard conditionnait les notes personnelles du coach a
    l existence d une equipe : un coach sans equipe ne voyait pas ses
    propres notes.
  - can_manage_team_match reformulait can_manage_this_org_team ; la
    reformulation avait derive. Elle appelle maintenant la regle.

Limite assumee : le panneau de notes d equipe reste ecrit pour une seule
equipe et affiche donc la premiere. La resolution est corrigee, la mise en
page multi-equipes ne l est pas -- c est un choix produit, pas un bug.

14 tests ajoutes. Cinq echouent sur le code d avant, verifie en remettant
les routes et le modele a leur etat precedent.

ARCH-001 fera disparaitre la colonne heritee ; cela demande une migration
de donnees, donc Alembic. D ici la, ce module est ce qui rend la
duplication inoffensive.

Co-Authored-By: Claude Opus 5 <[email protected]>

app/routes/users.py

@@ -26,7 +26,10 @@ from app.validators import (
     UploadContractSchema,
 )
 from app.logging_config import log_auth_event
-from app.permissions import coach_can_access_player
+from app.permissions import (
+    can_manage_player_contract, coach_can_access_player, coach_org_teams,
+    coach_player_ids,
+)
 import requests
 
 ALLOWED_CONTRACT_EXTENSIONS = {'pdf'}
@@ -575,19 +578,19 @@ def delete_disponibility(disponibility_id):
 # Contracts
 # ---------------------------------------------------------------------------
 
-def can_manage_player_contract(user, player_id):
-    """Check if a user can upload contracts for a specific player."""
-    if isinstance(user, Admin):
-        return True
-    if isinstance(user, Manager):
-        return True
-    if isinstance(user, Coach):
-        org_team = OrgTeam.query.filter_by(coach_id=user.id).first()
-        if org_team:
-            tp = TeamPlayer.query.filter_by(player_id=player_id, org_team_id=org_team.id).first()
-            if tp:
-                return True
-    return False
+def _manageable_players():
+    """Players the current user may attach a contract to.
+
+    A coach used to see the squad of one team — the first row matching the
+    legacy coach_id column — so a coach of two teams could file a contract
+    for half of their players and no more, and a coach attached only by the
+    many-to-many relationship for none at all.
+    """
+    if isinstance(current_user, Coach):
+        player_ids = coach_player_ids(current_user)
+        return User.query.filter(User.id.in_(player_ids)).order_by(
+            User.username).all() if player_ids else []
+    return User.query.filter_by(role='player').order_by(User.username).all()
 
 
 @users_bp.route('/contracts')
@@ -602,14 +605,7 @@ def list_contracts():
             player_id=current_user.id,
         ).order_by(Contract.uploaded_at.desc()).all()
     elif isinstance(current_user, (Admin, Manager, Coach)):
-        players = []
-        if isinstance(current_user, Coach):
-            org_team = OrgTeam.query.filter_by(coach_id=current_user.id).first()
-            if org_team:
-                player_ids = [tp.player_id for tp in TeamPlayer.query.filter_by(org_team_id=org_team.id).all()]
-                players = User.query.filter(User.id.in_(player_ids)).all() if player_ids else []
-        else:
-            players = User.query.filter_by(role='player').all()
+        players = _manageable_players()
 
         if players:
             player_ids = [p.id for p in players]
@@ -629,15 +625,7 @@ def upload_contract():
         flash(_('Only presidents, managers, and coaches can upload contracts.'), 'danger')
         return redirect(url_for('users.list_contracts'))
 
-    if isinstance(current_user, Coach):
-        org_team = OrgTeam.query.filter_by(coach_id=current_user.id).first()
-        if org_team:
-            player_ids = [tp.player_id for tp in TeamPlayer.query.filter_by(org_team_id=org_team.id).all()]
-            players = User.query.filter(User.id.in_(player_ids)).all() if player_ids else []
-        else:
-            players = []
-    else:
-        players = User.query.filter_by(role='player').all()
+    players = _manageable_players()
 
     if request.method == 'POST':
         contract_schema = UploadContractSchema()
@@ -826,7 +814,12 @@ def one_on_one():
 
     org_teams = current_user.get_org_teams()
     org_team = org_teams[0] if org_teams else None
-    coach = User.query.get(org_team.coach_id) if org_team and org_team.coach_id else None
+    # Reading org_team.coach_id directly told every player whose team lists
+    # its coaches through the many-to-many relationship — the newer of the
+    # two ways — that they had no coach, and closed the page to them.
+    # get_coaches() falls back to the legacy column when the list is empty.
+    team_coaches = org_team.get_coaches() if org_team else []
+    coach = team_coaches[0] if team_coaches else None
 
     if not coach:
         flash(_('You do not have a coach assigned to your team.'), 'info')
@@ -1123,15 +1116,18 @@ def notes_dashboard():
         flash(_('Only coaches can access the notes dashboard.'), 'danger')
         return redirect(url_for('main.dashboard'))
 
-    org_team = OrgTeam.query.filter_by(coach_id=current_user.id).first()
+    # The team-notes panel is still written against a single team; the
+    # player list is not, and used to be narrowed to one team's squad while
+    # the POST routes accepted every player the coach works with. The form
+    # offered fewer players than the handler would take.
+    org_teams = coach_org_teams(current_user)
+    org_team = org_teams[0] if org_teams else None
 
-    players = []
-    if org_team:
-        player_ids = [tp.player_id for tp in TeamPlayer.query.filter_by(org_team_id=org_team.id).all()]
-        players = User.query.filter(User.id.in_(player_ids)).all() if player_ids else []
+    player_ids = coach_player_ids(current_user)
+    players = User.query.filter(User.id.in_(player_ids)).order_by(
+        User.username).all() if player_ids else []
 
     team_notes = []
-    personal_notes = []
     latest_team_note = None
     if org_team:
         team_notes = TeamNote.query.filter_by(
@@ -1139,16 +1135,16 @@ def notes_dashboard():
         ).order_by(TeamNote.created_at.desc()).all()
         latest_team_note = team_notes[0] if team_notes else None
 
-        personal_notes = PersonalNote.query.filter_by(
-            coach_id=current_user.id,
-        ).order_by(PersonalNote.created_at.desc()).all()
+    # A coach's own notes belong to them whether or not they hold a team;
+    # this list was gated on org_team and came back empty without one.
+    personal_notes = PersonalNote.query.filter_by(
+        coach_id=current_user.id,
+    ).order_by(PersonalNote.created_at.desc()).all()
 
-    # One on One requests from team players
     one_on_one_requests = []
-    if org_team and players:
-        player_ids_list = [p.id for p in players]
+    if player_ids:
         one_on_one_requests = OneOnOneRequest.query.filter(
-            OneOnOneRequest.player_id.in_(player_ids_list)
+            OneOnOneRequest.player_id.in_(player_ids)
         ).order_by(OneOnOneRequest.created_at.desc()).all()
 
     # For context selectors in the form
@@ -1184,10 +1180,12 @@ def manage_team_notes():
         flash(_('Only coaches can manage team notes.'), 'danger')
         return redirect(url_for('main.dashboard'))
 
-    org_team = OrgTeam.query.filter_by(coach_id=current_user.id).first()
-    if not org_team:
+    # Same team the dashboard displays notes for, resolved the same way.
+    org_teams = coach_org_teams(current_user)
+    if not org_teams:
         flash(_('You are not assigned to a team.'), 'danger')
         return redirect(url_for('users.notes_dashboard'))
+    org_team = org_teams[0]
 
     content = request.form.get('content', '').strip()
     if content: