fix(audit): moderniser les accès ORM

app/routes/teams.py

@@ -223,7 +223,7 @@ def create_team():
 @login_required
 def edit_team(team_id):
     """Edit an existing organization team."""
-    team = OrgTeam.query.get_or_404(team_id)
+    team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('You do not have permission to edit this team.'), 'danger')
         return redirect(url_for('teams.list_teams'))
@@ -294,7 +294,7 @@ def delete_team(team_id):
     day `Manager.can_manage_this_org_team` is narrowed — which it should be —
     deletion narrows with it instead of staying the one way in.
     """
-    team = OrgTeam.query.get_or_404(team_id)
+    team = db.get_or_404(OrgTeam, team_id)
 
     if not (current_user.can_manage_teams() and current_user.can_manage_this_org_team(team)):
         flash(_('You do not have permission to delete teams.'), 'danger')
@@ -336,7 +336,7 @@ def delete_team(team_id):
 @login_required
 def add_coach(team_id):
     """Add a coach to an organization team."""
-    team = OrgTeam.query.get_or_404(team_id)
+    team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('teams.list_teams'))
@@ -379,7 +379,7 @@ def add_coach(team_id):
 @login_required
 def add_manager(team_id):
     """Add a manager to an organization team."""
-    team = OrgTeam.query.get_or_404(team_id)
+    team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('teams.list_teams'))
@@ -422,7 +422,7 @@ def add_manager(team_id):
 @login_required
 def remove_coach(team_id):
     """Remove a coach from an organization team."""
-    team = OrgTeam.query.get_or_404(team_id)
+    team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('teams.list_teams'))
@@ -450,7 +450,7 @@ def remove_coach(team_id):
 @login_required
 def remove_manager(team_id):
     """Remove a manager from an organization team."""
-    team = OrgTeam.query.get_or_404(team_id)
+    team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('teams.list_teams'))
@@ -478,7 +478,7 @@ def remove_manager(team_id):
 @login_required
 def add_player(team_id):
     """Add a player to an organization team."""
-    team = OrgTeam.query.get_or_404(team_id)
+    team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('teams.list_teams'))
@@ -515,12 +515,12 @@ def add_player(team_id):
 @login_required
 def remove_player(team_id, player_id):
     """Remove a player from an organization team."""
-    team = OrgTeam.query.get_or_404(team_id)
+    team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('teams.list_teams'))
 
-    player = User.query.get_or_404(player_id)
+    player = db.get_or_404(User, player_id)
     tp = TeamPlayer.query.filter_by(player_id=player_id, org_team_id=team_id).first()
     if not tp:
         flash(
@@ -543,7 +543,7 @@ def remove_player(team_id, player_id):
 @login_required
 def toggle_player_status(team_id, player_id):
     """Toggle a player's status between starter and substitute."""
-    team = OrgTeam.query.get_or_404(team_id)
+    team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         return jsonify({'error': 'Permission denied'}), 403
 
@@ -567,7 +567,7 @@ def toggle_player_status(team_id, player_id):
 @login_required
 def add_team_note(team_id):
     """Add a team improvement note (coaches only)."""
-    team = OrgTeam.query.get_or_404(team_id)
+    team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('You do not have permission to add notes to this team.'), 'danger')
         return redirect(url_for('teams.list_teams'))
@@ -589,12 +589,12 @@ def add_team_note(team_id):
 @login_required
 def add_player_note(team_id, player_id):
     """Add a personal note for a player (coaches only)."""
-    team = OrgTeam.query.get_or_404(team_id)
+    team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('You do not have permission to add notes to this team.'), 'danger')
         return redirect(url_for('teams.list_teams'))
 
-    player = User.query.get_or_404(player_id)
+    player = db.get_or_404(User, player_id)
     if not isinstance(player, Player):
         flash(_('Can only add notes for players.'), 'danger')
         return redirect(url_for('teams.list_teams'))