ajout de tests

tests/test_admin_route_map.py

@@ -0,0 +1,49 @@
+"""Admin route registration — every endpoint must exist and require login.
+
+ADMIN-003. The admin blueprint registers 10 routes. If one is accidentally
+removed or renamed, the admin panel breaks silently. These tests walk the
+URL map to catch that.
+"""
+
+import pytest
+
+
+ADMIN_ROUTES = [
+    '/admin',
+    '/admin/backup/create',
+    '/admin/toggle-tryouts',
+    '/admin/season/start',
+    '/admin/season/end',
+    '/admin/teams/wipe',
+]
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+class TestAdminRouteRegistration:
+    @pytest.mark.parametrize('route', ADMIN_ROUTES)
+    def test_route_is_registered(self, app, route):
+        """Every admin endpoint must appear in the URL map."""
+        adapter = app.url_map.bind('localhost')
+        try:
+            adapter.match(route, method='GET')
+        except Exception:
+            # Some routes are POST-only; try POST
+            try:
+                adapter.match(route, method='POST')
+            except Exception as exc:
+                pytest.fail(f'Route {route} is not registered: {exc}')
+
+    @pytest.mark.parametrize('route', ADMIN_ROUTES)
+    def test_route_requires_login(self, client, route):
+        """Unauthenticated access must redirect to login."""
+        response = client.get(route, follow_redirects=False)
+        # POST-only routes return 405 on GET, which is fine — the point is
+        # they don't return 200 to an anonymous caller.
+        if response.status_code == 405:
+            return
+        assert _redirected(response), (
+            f'{route} answered {response.status_code} to an anonymous caller'
+        )