diff --git a/__pycache__/extensions.cpython-313.pyc b/__pycache__/extensions.cpython-313.pyc new file mode 100644 index 0000000..4610344 Binary files /dev/null and b/__pycache__/extensions.cpython-313.pyc differ diff --git a/__pycache__/models.cpython-313.pyc b/__pycache__/models.cpython-313.pyc new file mode 100644 index 0000000..2f07596 Binary files /dev/null and b/__pycache__/models.cpython-313.pyc differ diff --git a/instance/team_tryouts.db b/instance/team_tryouts.db index 748229d..91d116b 100644 Binary files a/instance/team_tryouts.db and b/instance/team_tryouts.db differ diff --git a/models.py b/models.py index 9cbc4b8..6eb2296 100644 --- a/models.py +++ b/models.py @@ -65,6 +65,28 @@ class User(UserMixin, db.Model): def can_manage_teams(self): return self.role in ['president', 'manager'] + def can_manage_this_tryout(self, tryout): + """Check if user can manage a specific tryout (president, or manager/coach in charge of it).""" + if self.role == 'president': + return True + if self.role == 'manager' and tryout.created_by == self.id: + return True + if self.role == 'coach': + org_team = OrgTeam.query.filter_by(coach_id=self.id).first() + if org_team and tryout.target_org_team_id == org_team.id: + return True + return False + + def can_manage_this_org_team(self, org_team): + """Check if user can manage a specific org team (president, or manager/coach in charge of it).""" + if self.role == 'president': + return True + if self.role == 'manager': + return True # Managers can manage all org teams (create/edit/delete) + if self.role == 'coach' and org_team.coach_id == self.id: + return True + return False + @login_manager.user_loader def load_user(user_id): diff --git a/routes/__pycache__/__init__.cpython-313.pyc b/routes/__pycache__/__init__.cpython-313.pyc new file mode 100644 index 0000000..7c160cd Binary files /dev/null and b/routes/__pycache__/__init__.cpython-313.pyc differ diff --git a/routes/__pycache__/auth.cpython-313.pyc b/routes/__pycache__/auth.cpython-313.pyc new file mode 100644 index 0000000..d80c9df Binary files /dev/null and b/routes/__pycache__/auth.cpython-313.pyc differ diff --git a/routes/__pycache__/evaluations.cpython-313.pyc b/routes/__pycache__/evaluations.cpython-313.pyc new file mode 100644 index 0000000..a12e75b Binary files /dev/null and b/routes/__pycache__/evaluations.cpython-313.pyc differ diff --git a/routes/__pycache__/main.cpython-313.pyc b/routes/__pycache__/main.cpython-313.pyc new file mode 100644 index 0000000..dfbe9b2 Binary files /dev/null and b/routes/__pycache__/main.cpython-313.pyc differ diff --git a/routes/__pycache__/teams.cpython-313.pyc b/routes/__pycache__/teams.cpython-313.pyc new file mode 100644 index 0000000..3fba8f7 Binary files /dev/null and b/routes/__pycache__/teams.cpython-313.pyc differ diff --git a/routes/__pycache__/tryouts.cpython-313.pyc b/routes/__pycache__/tryouts.cpython-313.pyc new file mode 100644 index 0000000..86171b9 Binary files /dev/null and b/routes/__pycache__/tryouts.cpython-313.pyc differ diff --git a/routes/__pycache__/users.cpython-313.pyc b/routes/__pycache__/users.cpython-313.pyc new file mode 100644 index 0000000..56c426d Binary files /dev/null and b/routes/__pycache__/users.cpython-313.pyc differ diff --git a/routes/evaluations.py b/routes/evaluations.py index 9ad1c9e..5f5ad28 100644 --- a/routes/evaluations.py +++ b/routes/evaluations.py @@ -99,7 +99,7 @@ def evaluate_player(tryout_id, player_id): flash('Evaluation submitted successfully!', 'success') db.session.commit() - return redirect(url_for('evaluations.list_evaluations')) + return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id)) evaluators = None if current_user.role == 'president': diff --git a/routes/teams.py b/routes/teams.py index 0d3d04d..0e8223c 100644 --- a/routes/teams.py +++ b/routes/teams.py @@ -56,11 +56,11 @@ def create_team(): @teams_bp.route('//edit', methods=['POST']) @login_required def edit_team(team_id): - if not current_user.can_manage_teams(): - flash('You do not have permission to edit teams.', 'danger') + team = OrgTeam.query.get_or_404(team_id) + if not current_user.can_manage_this_org_team(team): + flash('You do not have permission to edit this team.', 'danger') return redirect(url_for('teams.list_teams')) - team = OrgTeam.query.get_or_404(team_id) name = request.form.get('name') coach_id = request.form.get('coach_id') @@ -105,11 +105,10 @@ def delete_team(team_id): @teams_bp.route('//add_player', methods=['POST']) @login_required def add_player(team_id): - if not current_user.can_manage_teams(): + team = OrgTeam.query.get_or_404(team_id) + if not current_user.can_manage_this_org_team(team): flash('Permission denied.', 'danger') return redirect(url_for('teams.list_teams')) - - team = OrgTeam.query.get_or_404(team_id) player_id = request.form.get('player_id') position = request.form.get('position', '') @@ -138,11 +137,11 @@ def add_player(team_id): @teams_bp.route('//remove_player/', methods=['POST']) @login_required def remove_player(team_id, player_id): - if not current_user.can_manage_teams(): + team = OrgTeam.query.get_or_404(team_id) + if not current_user.can_manage_this_org_team(team): flash('Permission denied.', 'danger') return redirect(url_for('teams.list_teams')) - team = OrgTeam.query.get_or_404(team_id) player = User.query.get_or_404(player_id) if player.team_id != team_id: diff --git a/routes/tryouts.py b/routes/tryouts.py index 9a93e1c..b7911a9 100644 --- a/routes/tryouts.py +++ b/routes/tryouts.py @@ -74,17 +74,8 @@ def create_tryout(): def edit_tryout(tryout_id): tryout = Tryout.query.get_or_404(tryout_id) - # Permission: president can edit any; manager can edit own; coach can edit if it targets their team - if current_user.role == 'president': - pass # allowed - elif current_user.role == 'manager' and tryout.created_by == current_user.id: - pass # allowed - elif current_user.role == 'coach': - org_team = OrgTeam.query.filter_by(coach_id=current_user.id).first() - if not org_team or tryout.target_org_team_id != org_team.id: - flash('You do not have permission to edit this tryout.', 'danger') - return redirect(url_for('tryouts.list_tryouts')) - else: + # Permission: president, manager (own tryouts), or coach (targets their team) + if not current_user.can_manage_this_tryout(tryout): flash('You do not have permission to edit this tryout.', 'danger') return redirect(url_for('tryouts.list_tryouts')) @@ -152,15 +143,7 @@ def view_tryout(tryout_id): }) # Determine if current user can edit this tryout - can_edit = False - if current_user.role == 'president': - can_edit = True - elif current_user.role == 'manager' and tryout.created_by == current_user.id: - can_edit = True - elif current_user.role == 'coach': - org_team = OrgTeam.query.filter_by(coach_id=current_user.id).first() - if org_team and tryout.target_org_team_id == org_team.id: - can_edit = True + can_edit = current_user.can_manage_this_tryout(tryout) # Get all players (for manager registration dropdown) all_players = User.query.filter_by(role='player').order_by(User.full_name).all() @@ -209,11 +192,10 @@ def register_for_tryout(tryout_id): @tryouts_bp.route('//status', methods=['POST']) @login_required def update_status(tryout_id): - if not can_manage(): + tryout = Tryout.query.get_or_404(tryout_id) + if not current_user.can_manage_this_tryout(tryout): flash('Permission denied.', 'danger') return redirect(url_for('tryouts.list_tryouts')) - - tryout = Tryout.query.get_or_404(tryout_id) new_status = request.form.get('status') if new_status in ['upcoming', 'in_progress', 'completed']: tryout.status = new_status @@ -224,7 +206,8 @@ def update_status(tryout_id): @tryouts_bp.route('//registration//status', methods=['POST']) @login_required def update_registration_status(tryout_id, player_id): - if not can_manage(): + tryout = Tryout.query.get_or_404(tryout_id) + if not current_user.can_manage_this_tryout(tryout): flash('Permission denied.', 'danger') return redirect(url_for('tryouts.list_tryouts')) @@ -239,11 +222,10 @@ def update_registration_status(tryout_id, player_id): @tryouts_bp.route('//register_player', methods=['POST']) @login_required def register_player(tryout_id): - if not can_manage(): + tryout = Tryout.query.get_or_404(tryout_id) + if not current_user.can_manage_this_tryout(tryout): flash('Permission denied.', 'danger') return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id)) - - tryout = Tryout.query.get_or_404(tryout_id) player_id = request.form.get('player_id') if not player_id: @@ -275,7 +257,8 @@ def register_player(tryout_id): @tryouts_bp.route('//team/create', methods=['POST']) @login_required def create_team(tryout_id): - if not can_manage(): + tryout = Tryout.query.get_or_404(tryout_id) + if not current_user.can_manage_this_tryout(tryout): flash('Permission denied.', 'danger') return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id)) @@ -290,13 +273,14 @@ def create_team(tryout_id): @tryouts_bp.route('//team//add', methods=['POST']) @login_required def add_to_team(tryout_id, team_id): - if not can_manage(): + team = Team.query.get_or_404(team_id) + tryout = Tryout.query.get_or_404(tryout_id) + if not current_user.can_manage_this_tryout(tryout): flash('Permission denied.', 'danger') return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id)) player_id = request.form.get('player_id') position = request.form.get('position', '') - team = Team.query.get_or_404(team_id) existing = TeamMember.query.filter_by(team_id=team_id, player_id=player_id).first() if existing: diff --git a/templates/pages/teams.html b/templates/pages/teams.html index ff14d00..3140b16 100644 --- a/templates/pages/teams.html +++ b/templates/pages/teams.html @@ -45,6 +45,7 @@ {% endif %} {% for team in teams %} +{% set can_manage_team = can_manage or (current_user.role == 'coach' and team.coach_id == current_user.id) %}

{{ team.name }}

@@ -76,7 +77,7 @@ Position / Role Email Phone - {% if can_manage %} + {% if can_manage_team %} Actions {% endif %} @@ -93,7 +94,7 @@ {{ player.role | capitalize }} {{ player.email }} {{ player.phone or '-' }} - {% if can_manage %} + {% if can_manage_team %}
@@ -106,11 +107,11 @@ {% else %} - +

No players assigned

- {% if can_manage %} + {% if can_manage_team %}

Add players to this team using the form below.

{% endif %}
@@ -121,7 +122,7 @@
- {% if can_manage %} + {% if can_manage_team %}
Add Player to {{ team.name }}
diff --git a/templates/pages/view_tryout.html b/templates/pages/view_tryout.html index 57ca69c..eef9458 100644 --- a/templates/pages/view_tryout.html +++ b/templates/pages/view_tryout.html @@ -9,7 +9,7 @@

Tryout Details

- {% if current_user.can_manage_tryouts() %} + {% if can_edit %} @@ -203,7 +203,7 @@
  • No players assigned yet.
  • {% endfor %} - {% if current_user.can_manage_tryouts() and registered_players %} + {% if can_edit and registered_players %}