modification des permissions de coach: Voit uniquement les tryouts de ses équipes.

Evaluer un joueur retourne à la page précédente au lieu de la page des evaluations

routes/evaluations.py

@@ -99,7 +99,7 @@ def evaluate_player(tryout_id, player_id):
             flash('Evaluation submitted successfully!', 'success')
 
         db.session.commit()
-        return redirect(url_for('evaluations.list_evaluations'))
+        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     evaluators = None
     if current_user.role == 'president':

routes/teams.py

@@ -56,11 +56,11 @@ def create_team():
 @teams_bp.route('/<int:team_id>/edit', methods=['POST'])
 @login_required
 def edit_team(team_id):
-    if not current_user.can_manage_teams():
-        flash('You do not have permission to edit teams.', 'danger')
+    team = OrgTeam.query.get_or_404(team_id)
+    if not current_user.can_manage_this_org_team(team):
+        flash('You do not have permission to edit this team.', 'danger')
         return redirect(url_for('teams.list_teams'))
 
-    team = OrgTeam.query.get_or_404(team_id)
     name = request.form.get('name')
     coach_id = request.form.get('coach_id')
 
@@ -105,11 +105,10 @@ def delete_team(team_id):
 @teams_bp.route('/<int:team_id>/add_player', methods=['POST'])
 @login_required
 def add_player(team_id):
-    if not current_user.can_manage_teams():
+    team = OrgTeam.query.get_or_404(team_id)
+    if not current_user.can_manage_this_org_team(team):
         flash('Permission denied.', 'danger')
         return redirect(url_for('teams.list_teams'))
-
-    team = OrgTeam.query.get_or_404(team_id)
     player_id = request.form.get('player_id')
     position = request.form.get('position', '')
 
@@ -138,11 +137,11 @@ def add_player(team_id):
 @teams_bp.route('/<int:team_id>/remove_player/<int:player_id>', methods=['POST'])
 @login_required
 def remove_player(team_id, player_id):
-    if not current_user.can_manage_teams():
+    team = OrgTeam.query.get_or_404(team_id)
+    if not current_user.can_manage_this_org_team(team):
         flash('Permission denied.', 'danger')
         return redirect(url_for('teams.list_teams'))
 
-    team = OrgTeam.query.get_or_404(team_id)
     player = User.query.get_or_404(player_id)
 
     if player.team_id != team_id:

routes/tryouts.py

@@ -74,17 +74,8 @@ def create_tryout():
 def edit_tryout(tryout_id):
     tryout = Tryout.query.get_or_404(tryout_id)
 
-    # Permission: president can edit any; manager can edit own; coach can edit if it targets their team
-    if current_user.role == 'president':
-        pass  # allowed
-    elif current_user.role == 'manager' and tryout.created_by == current_user.id:
-        pass  # allowed
-    elif current_user.role == 'coach':
-        org_team = OrgTeam.query.filter_by(coach_id=current_user.id).first()
-        if not org_team or tryout.target_org_team_id != org_team.id:
-            flash('You do not have permission to edit this tryout.', 'danger')
-            return redirect(url_for('tryouts.list_tryouts'))
-    else:
+    # Permission: president, manager (own tryouts), or coach (targets their team)
+    if not current_user.can_manage_this_tryout(tryout):
         flash('You do not have permission to edit this tryout.', 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
 
@@ -152,15 +143,7 @@ def view_tryout(tryout_id):
         })
 
     # Determine if current user can edit this tryout
-    can_edit = False
-    if current_user.role == 'president':
-        can_edit = True
-    elif current_user.role == 'manager' and tryout.created_by == current_user.id:
-        can_edit = True
-    elif current_user.role == 'coach':
-        org_team = OrgTeam.query.filter_by(coach_id=current_user.id).first()
-        if org_team and tryout.target_org_team_id == org_team.id:
-            can_edit = True
+    can_edit = current_user.can_manage_this_tryout(tryout)
 
     # Get all players (for manager registration dropdown)
     all_players = User.query.filter_by(role='player').order_by(User.full_name).all()
@@ -209,11 +192,10 @@ def register_for_tryout(tryout_id):
 @tryouts_bp.route('/<int:tryout_id>/status', methods=['POST'])
 @login_required
 def update_status(tryout_id):
-    if not can_manage():
+    tryout = Tryout.query.get_or_404(tryout_id)
+    if not current_user.can_manage_this_tryout(tryout):
         flash('Permission denied.', 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
-
-    tryout = Tryout.query.get_or_404(tryout_id)
     new_status = request.form.get('status')
     if new_status in ['upcoming', 'in_progress', 'completed']:
         tryout.status = new_status
@@ -224,7 +206,8 @@ def update_status(tryout_id):
 @tryouts_bp.route('/<int:tryout_id>/registration/<int:player_id>/status', methods=['POST'])
 @login_required
 def update_registration_status(tryout_id, player_id):
-    if not can_manage():
+    tryout = Tryout.query.get_or_404(tryout_id)
+    if not current_user.can_manage_this_tryout(tryout):
         flash('Permission denied.', 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
 
@@ -239,11 +222,10 @@ def update_registration_status(tryout_id, player_id):
 @tryouts_bp.route('/<int:tryout_id>/register_player', methods=['POST'])
 @login_required
 def register_player(tryout_id):
-    if not can_manage():
+    tryout = Tryout.query.get_or_404(tryout_id)
+    if not current_user.can_manage_this_tryout(tryout):
         flash('Permission denied.', 'danger')
         return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
-
-    tryout = Tryout.query.get_or_404(tryout_id)
     player_id = request.form.get('player_id')
 
     if not player_id:
@@ -275,7 +257,8 @@ def register_player(tryout_id):
 @tryouts_bp.route('/<int:tryout_id>/team/create', methods=['POST'])
 @login_required
 def create_team(tryout_id):
-    if not can_manage():
+    tryout = Tryout.query.get_or_404(tryout_id)
+    if not current_user.can_manage_this_tryout(tryout):
         flash('Permission denied.', 'danger')
         return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
@@ -290,13 +273,14 @@ def create_team(tryout_id):
 @tryouts_bp.route('/<int:tryout_id>/team/<int:team_id>/add', methods=['POST'])
 @login_required
 def add_to_team(tryout_id, team_id):
-    if not can_manage():
+    team = Team.query.get_or_404(team_id)
+    tryout = Tryout.query.get_or_404(tryout_id)
+    if not current_user.can_manage_this_tryout(tryout):
         flash('Permission denied.', 'danger')
         return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     player_id = request.form.get('player_id')
     position = request.form.get('position', '')
-    team = Team.query.get_or_404(team_id)
 
     existing = TeamMember.query.filter_by(team_id=team_id, player_id=player_id).first()
     if existing: