fix(audit): moderniser les accès ORM

app/routes/users/accounts.py

@@ -70,7 +70,7 @@ def edit_user(user_id):
         flash(_('Only the president can edit users.'), 'danger')
         return redirect(url_for('main.dashboard'))
 
-    user = User.query.get_or_404(user_id)
+    user = db.get_or_404(User, user_id)
 
     if request.method == 'POST':
         actor_name, actor_id = current_user.username, current_user.id
@@ -253,7 +253,7 @@ def delete_user(user_id):
         flash(_('You cannot delete your own account.'), 'danger')
         return redirect(url_for('users.list_users'))
 
-    user = User.query.get_or_404(user_id)
+    user = db.get_or_404(User, user_id)
 
     Evaluation.query.filter(
         db.or_(Evaluation.evaluator_id == user_id, Evaluation.player_id == user_id),
@@ -379,5 +379,5 @@ def create_user():
 @login_required
 def view_user(user_id):
     """View a public profile for any user."""
-    user = User.query.get_or_404(user_id)
+    user = db.get_or_404(User, user_id)
     return render_template('pages/view_user.html', profile_user=user)

app/routes/users/availability.py

@@ -193,7 +193,7 @@ def clear_disponibilities():
 @login_required
 def delete_disponibility(disponibility_id):
     """Delete a disponibility block."""
-    disponibility = PlayerDisponibility.query.get_or_404(disponibility_id)
+    disponibility = db.get_or_404(PlayerDisponibility, disponibility_id)
     if disponibility.player_id != current_user.id:
         return jsonify({'error': 'Unauthorized'}), 403
     db.session.delete(disponibility)

app/routes/users/contracts.py

@@ -111,7 +111,7 @@ def upload_contract():
             flash(error, 'danger')
             return redirect(url_for('users.upload_contract'))
 
-        player = User.query.get_or_404(player_id)
+        player = db.get_or_404(User, player_id)
         player_teams = player.get_org_teams()
         team = player_teams[0] if player_teams else None
 
@@ -154,7 +154,7 @@ def upload_contract():
 @login_required
 def upload_signed_contract(contract_id):
     """Upload a signed contract (player only)."""
-    contract = Contract.query.get_or_404(contract_id)
+    contract = db.get_or_404(Contract, contract_id)
     if not contract.can_upload_signed(current_user):
         flash(_('Only the player can upload their signed contract.'), 'danger')
         return redirect(url_for('users.list_contracts'))
@@ -182,7 +182,7 @@ def upload_signed_contract(contract_id):
 @login_required
 def download_contract(contract_id):
     """Download a contract file."""
-    contract = Contract.query.get_or_404(contract_id)
+    contract = db.get_or_404(Contract, contract_id)
     if not contract.can_view(current_user):
         flash(_('You do not have permission to download this contract.'), 'danger')
         return redirect(url_for('users.list_contracts'))
@@ -197,7 +197,7 @@ def download_contract(contract_id):
 @login_required
 def download_signed_contract(contract_id):
     """Download a signed contract file."""
-    contract = Contract.query.get_or_404(contract_id)
+    contract = db.get_or_404(Contract, contract_id)
     if not contract.can_view(current_user):
         flash(_('You do not have permission to download this contract.'), 'danger')
         return redirect(url_for('users.list_contracts'))

app/routes/users/notes.py

@@ -217,7 +217,7 @@ def manage_personal_notes():
         return redirect(url_for('users.notes_dashboard'))
     player_id = data['player_id']
 
-    player = User.query.get_or_404(player_id)
+    player = db.get_or_404(User, player_id)
     if not isinstance(player, Player):
         flash(_('Can only add notes for players.'), 'danger')
         return redirect(url_for('users.notes_dashboard'))
@@ -257,7 +257,7 @@ def add_personal_note():
         return redirect(url_for('users.notes_dashboard'))
     player_id = data['player_id']
 
-    player = User.query.get_or_404(player_id)
+    player = db.get_or_404(User, player_id)
     if not isinstance(player, Player):
         flash(_('Can only add notes for players.'), 'danger')
         return redirect(url_for('users.notes_dashboard'))
@@ -267,7 +267,7 @@ def add_personal_note():
         return redirect(url_for('users.notes_dashboard'))
 
     if data['match_id']:
-        match = Match.query.get_or_404(data['match_id'])
+        match = db.get_or_404(Match, data['match_id'])
         if not current_user.can_manage_this_tryout(match.tryout):
             flash(_('You cannot use that match as note context.'), 'danger')
             return redirect(url_for('users.notes_dashboard'))
@@ -276,7 +276,7 @@ def add_personal_note():
             return redirect(url_for('users.notes_dashboard'))
 
     if data['tryout_id']:
-        tryout = Tryout.query.get_or_404(data['tryout_id'])
+        tryout = db.get_or_404(Tryout, data['tryout_id'])
         if not current_user.can_manage_this_tryout(tryout):
             flash(_('You cannot use that tryout as note context.'), 'danger')
             return redirect(url_for('users.notes_dashboard'))
@@ -285,7 +285,7 @@ def add_personal_note():
             return redirect(url_for('users.notes_dashboard'))
 
     if data['team_id']:
-        team = Team.query.get_or_404(data['team_id'])
+        team = db.get_or_404(Team, data['team_id'])
         if not current_user.can_manage_this_tryout(team.tryout):
             flash(_('You cannot use that team as note context.'), 'danger')
             return redirect(url_for('users.notes_dashboard'))
@@ -320,7 +320,7 @@ def add_note_from_tryout(tryout_id):
         flash(_('Only coaches can add personal notes.'), 'danger')
         return redirect(url_for('main.dashboard'))
 
-    tryout = Tryout.query.get_or_404(tryout_id)
+    tryout = db.get_or_404(Tryout, tryout_id)
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('You do not have permission to add notes for this tryout.'), 'danger')
         return redirect(url_for('users.notes_dashboard'))
@@ -384,7 +384,7 @@ def add_note_from_match(match_id):
         flash(_('Only coaches can add personal notes.'), 'danger')
         return redirect(url_for('main.dashboard'))
 
-    match_obj = Match.query.get_or_404(match_id)
+    match_obj = db.get_or_404(Match, match_id)
     if not current_user.can_manage_this_tryout(match_obj.tryout):
         flash(_('You do not have permission to add notes for this match.'), 'danger')
         return redirect(url_for('users.notes_dashboard'))

app/routes/users/one_on_one.py

@@ -166,7 +166,7 @@ def accept_one_on_one(request_id):
         flash(_('Only coaches can accept One on One requests.'), 'danger')
         return redirect(url_for('main.dashboard'))
 
-    request_obj = OneOnOneRequest.query.get_or_404(request_id)
+    request_obj = db.get_or_404(OneOnOneRequest, request_id)
 
     if request_obj.coach_id != current_user.id:
         flash(_('This request is not for you.'), 'danger')
@@ -216,7 +216,7 @@ def reject_one_on_one(request_id):
         flash(_('Only coaches can reject One on One requests.'), 'danger')
         return redirect(url_for('main.dashboard'))
 
-    request_obj = OneOnOneRequest.query.get_or_404(request_id)
+    request_obj = db.get_or_404(OneOnOneRequest, request_id)
 
     if request_obj.coach_id != current_user.id:
         flash(_('This request is not for you.'), 'danger')