progression 50% pour evolution des joueurs

Creation d'un fichier pour setup postgres en local pour dev

.gitignore

@@ -98,6 +98,9 @@ coverage.xml
 # =============================================================================
 # Base SQLite locale (une base de démo a déjà été committée par le passé,
 # voir l'historique du commit `4fd27ba`).
+# Données PostgreSQL locales — gérées par app/local_postgres.py
+instance/pgdata/
+instance/pg.log
 instance/
 *.db
 *.sqlite

_add_drive_test.py

@@ -0,0 +1,40 @@
+"""Add Drive signed upload test."""
+import pathlib
+
+p = pathlib.Path('tests/test_contract_uploads.py')
+t = p.read_bytes()
+
+drive_test = (
+    b"\n    def test_signed_upload_with_google_drive(\n"
+    b"        self, app, client, as_role, make_user, contract_for, monkeypatch\n"
+    b"    ):\n"
+    b'        """Signing with Drive backend stores gdrive://<id> in signed_file_path."""\n'
+    b"        monkeypatch.setenv('DOCUMENT_STORAGE_BACKEND', 'google_drive')\n"
+    b"        monkeypatch.setattr(\n"
+    b"            'app.storage.upload_google_drive_file',\n"
+    b"            lambda **_kwargs: 'drive-signed-456',\n"
+    b"        )\n"
+    b"        player_id = as_role('player')\n"
+    b"        admin_id = make_user('admin')\n"
+    b"        contract_id, directory = contract_for(player_id, admin_id)\n\n"
+    b"        client.post(\n"
+    b"            f'/users/contracts/{contract_id}/upload_signed',\n"
+    b"            data={'signed_file': (io.BytesIO(_PDF_BYTES), 'signed.pdf')},\n"
+    b"            content_type='multipart/form-data',\n"
+    b"            follow_redirects=True,\n"
+    b"        )\n\n"
+    b"        with app.app_context():\n"
+    b"            contract = db.session.get(Contract, contract_id)\n"
+    b"            assert contract.status == 'signed'\n"
+    b"            assert contract.signed_file_path == 'gdrive://drive-signed-456'\n\n"
+)
+
+# Add before 'class TestTheHelper:'
+marker = b'\nclass TestTheHelper:'
+pos = t.find(marker)
+if pos >= 0:
+    t = t[:pos] + drive_test + t[pos:]
+    p.write_bytes(t)
+    print('Added Drive signed upload test')
+else:
+    print('Could not find marker')

_add_tests.py

@@ -0,0 +1,48 @@
+"""Add new tests to test_contract_uploads.py."""
+import pathlib
+
+p = pathlib.Path('tests/test_contract_uploads.py')
+t = p.read_bytes()
+
+# 1. Header-only test in TestSignedUpload (before 'class TestTheHelper:')
+marker = b'\n\nclass TestTheHelper:'
+test = (
+    b"\n    def test_a_header_only_pdf_is_refused(\n"
+    b"        self, app, client, as_role, make_user, contract_for\n"
+    b"    ):\n"
+    b'        """A file with a %PDF- header but no real PDF structure is rejected."""\n'
+    b"        player_id = as_role('player')\n"
+    b"        admin_id = make_user('admin')\n"
+    b"        contract_id, directory = contract_for(player_id, admin_id)\n\n"
+    b"        client.post(\n"
+    b"            f'/users/contracts/{contract_id}/upload_signed',\n"
+    b"            data={'signed_file': (io.BytesIO(PDF_HEADER_ONLY_BYTES), 'signed.pdf')},\n"
+    b"            content_type='multipart/form-data',\n"
+    b"            follow_redirects=True,\n"
+    b"        )\n\n"
+    b"        with app.app_context():\n"
+    b"            contract = db.session.get(Contract, contract_id)\n"
+    b"            assert contract.status != 'signed'\n"
+    b"            assert contract.signed_file_path is None\n\n"
+)
+pos = t.find(marker)
+if pos >= 0:
+    t = t[:pos] + test + t[pos:]
+
+# 2. Header-only helper test at end of TestTheHelper
+trailing = t.rstrip(b'\n')
+idx = t.find(trailing) + len(trailing)
+helper = (
+    b"\n    def test_a_header_only_file_is_refused(self, app):\n"
+    b'        """A stream starting with %PDF- but holding non-PDF data is\n'
+    b"        rejected (the header check is not enough).\"\"\"\n"
+    b"        from werkzeug.datastructures import FileStorage\n\n"
+    b"        from app.routes.users import ALLOWED_CONTRACT_EXTENSIONS, pdf_upload_error\n\n"
+    b"        upload = FileStorage(stream=io.BytesIO(PDF_HEADER_ONLY_BYTES), filename='clever.pdf')\n"
+    b"        with app.test_request_context('/'):\n"
+    b"            assert pdf_upload_error(upload, ALLOWED_CONTRACT_EXTENSIONS)\n"
+)
+t = t[:idx] + helper + t[idx:]
+
+p.write_bytes(t)
+print('Added new tests')

app/.env.example

@@ -88,17 +88,28 @@ DISCORD_CLIENT_SECRET=
 DISCORD_REDIRECT_URI=https://your-domain/auth/discord/callback
 
 # =============================================================================
-# Optional — storage
+# Contract storage — Google Drive
 # =============================================================================
 
-# Where uploaded contracts live. Empty means `documents/` beside the
+# New contracts are uploaded to the owner's Google Drive. The OAuth client,
-# application. Set it to a path OUTSIDE the deployment directory if you move
+# refresh token, and folder ID are secrets/configuration: do not commit them.
-# to a release-directory layout, or a deployment will take the documents with
+# Use `local` only for isolated development and legacy-file maintenance.
-# it (OPS-011, app/storage.py).
+DOCUMENT_STORAGE_BACKEND=google_drive
-#
+
-# IMPORTANT: the backup script reads this same variable. Before wave J it
+# Target folder in the owner's personal Drive. The application keeps every
-# did not, and archived `./documents` regardless — so setting this here and
+# contract directly in this folder and stores only each Drive file ID in the
-# nowhere else produced empty contract backups that still exited 0.
+# database.
+GOOGLE_DRIVE_FOLDER_ID=
+
+# OAuth 2.0 credentials for the owner's Google account. Create a Google Cloud
+# Desktop OAuth client, authorize the Drive scope once, and place the resulting
+# refresh token here. See docs/deployment.md before enabling this in production.
+GOOGLE_DRIVE_CLIENT_ID=
+GOOGLE_DRIVE_CLIENT_SECRET=
+GOOGLE_DRIVE_REFRESH_TOKEN=
+
+# Local storage is retained only for historical rows and local test runs.
+# It is not used for new contracts while DOCUMENT_STORAGE_BACKEND=google_drive.
 DOCUMENTS_ROOT=
 
 # Where the log files go. Empty means `logs/` beside the application. Both
@@ -140,5 +151,14 @@ AUTO_CREATE_TABLES=true
 #   FORCE_HTTPS=false           no redirect to HTTPS
 #   DISCORD_REDIRECT_URI=http://localhost:5000/auth/discord/callback
 #
+#   LOCAL_PG=true               start a local PostgreSQL server (requires PostgreSQL
+#                               installed on the system). Uses port 5433,
+#                               data in instance/pgdata/, database team_tryouts.
+#
+#   LOCAL_PG_PORT=5433          override the PostgreSQL port
+#   LOCAL_PG_USER=team_tryouts_db   override the PostgreSQL user
+#   LOCAL_PG_DATABASE=team_tryouts_db  override the database name
+#
+#
 # `python run.py` reads DEV_HOST and DEV_PORT rather than HOST and PORT, so a
 # development session cannot accidentally inherit a production binding.

app/app.py

@@ -411,6 +411,8 @@ def create_app(config=None):
     from app.routes.teams import teams_bp
     from app.routes.tryouts import tryouts_bp
     from app.routes.users import users_bp
+    from app.routes.admin import admin_bp
+    from app.routes.objectives import objectives_bp
 
     app.register_blueprint(auth_bp)
     app.register_blueprint(tryouts_bp)
@@ -420,6 +422,8 @@ def create_app(config=None):
     app.register_blueprint(teams_bp)
     app.register_blueprint(matches_bp)
     app.register_blueprint(team_matches_bp)
+    app.register_blueprint(admin_bp)
+    app.register_blueprint(objectives_bp)
 
     # Register custom Jinja filters
     app.jinja_env.filters['nl2br'] = nl2br

app/extensions.py

@@ -22,7 +22,7 @@ babel = Babel()
 # No storage is named here on purpose: it comes from RATELIMIT_STORAGE_URI in
 # app.config, which create_app fills from the environment and defaults to
 # `memory://` (SEC-WEB-004). Naming it in both places is how the two drift.
-limiter = Limiter(key_func=get_remote_address, default_limits=["200 per day", "50 per hour"])
+limiter = Limiter(key_func=get_remote_address, default_limits=["1000 per day", "200 per hour"])
 
 
 def hash_password(password):

app/google_drive.py

@@ -0,0 +1,144 @@
+"""Google Drive storage for contract PDFs.
+
+The application uses an OAuth refresh token for the owner's personal Google
+account. Tokens and client secrets come only from environment variables; the
+database stores opaque file IDs, never a credential or a shareable Drive URL.
+"""
+
+import io
+import os
+
+GOOGLE_DRIVE_FOLDER_ID_ENV = 'GOOGLE_DRIVE_FOLDER_ID'
+GOOGLE_DRIVE_CLIENT_ID_ENV = 'GOOGLE_DRIVE_CLIENT_ID'
+GOOGLE_DRIVE_CLIENT_SECRET_ENV = 'GOOGLE_DRIVE_CLIENT_SECRET'
+GOOGLE_DRIVE_REFRESH_TOKEN_ENV = 'GOOGLE_DRIVE_REFRESH_TOKEN'
+GOOGLE_DRIVE_SCOPE = 'https://www.googleapis.com/auth/drive.file'
+
+
+class GoogleDriveStorageError(RuntimeError):
+    """A configuration or API failure while storing a contract in Drive."""
+
+
+def _setting(name):
+    value = os.getenv(name)
+    if not value:
+        raise GoogleDriveStorageError(
+            f'{name} must be configured for Google Drive document storage.'
+        )
+    return value
+
+
+def _drive_service():
+    """Build an authorized Drive client from the owner's refresh token."""
+    try:
+        from google.oauth2.credentials import Credentials
+        from googleapiclient.discovery import build
+    except ImportError as exc:
+        raise GoogleDriveStorageError(
+            'Google Drive dependencies are not installed. Install requirements.txt again.'
+        ) from exc
+
+    credentials = Credentials(
+        token=None,
+        refresh_token=_setting(GOOGLE_DRIVE_REFRESH_TOKEN_ENV),
+        token_uri='https://oauth2.googleapis.com/token',
+        client_id=_setting(GOOGLE_DRIVE_CLIENT_ID_ENV),
+        client_secret=_setting(GOOGLE_DRIVE_CLIENT_SECRET_ENV),
+        scopes=[GOOGLE_DRIVE_SCOPE],
+    )
+    return build('drive', 'v3', credentials=credentials, cache_discovery=False)
+
+
+def list_folder_files():
+    """Return (file_id, name) tuples for every file in the configured folder.
+
+    Used by the backup script to enumerate Drive-stored contracts. Returns
+    only files directly in the folder (not nested inside sub-folders).
+
+    Returns:
+        list[tuple[str, str]]: (file_id, name) for each file found.
+    """
+    try:
+        folder_id = _setting(GOOGLE_DRIVE_FOLDER_ID_ENV)
+        page_token = None
+        results = []
+        while True:
+            response = (
+                _drive_service()
+                .files()
+                .list(
+                    q=f"'{folder_id}' in parents and trashed=false",
+                    fields='nextPageToken, files(id, name)',
+                    pageToken=page_token,
+                    pageSize=1000,
+                )
+                .execute()
+            )
+            for f in response.get('files', []):
+                results.append((f['id'], f['name']))
+            page_token = response.get('nextPageToken')
+            if not page_token:
+                break
+        return results
+    except GoogleDriveStorageError:
+        raise
+    except Exception as exc:
+        raise GoogleDriveStorageError('Google Drive could not list folder contents.') from exc
+
+
+def upload_file(*, stream, filename, mimetype):
+    """Upload a PDF to the configured owner folder and return its Drive ID."""
+    try:
+        from googleapiclient.http import MediaIoBaseUpload
+
+        stream.seek(0)
+        media = MediaIoBaseUpload(stream, mimetype=mimetype, resumable=True)
+        response = (
+            _drive_service()
+            .files()
+            .create(
+                body={'name': filename, 'parents': [_setting(GOOGLE_DRIVE_FOLDER_ID_ENV)]},
+                media_body=media,
+                fields='id',
+            )
+            .execute()
+        )
+    except GoogleDriveStorageError:
+        raise
+    except Exception as exc:  # Google client exceptions share no stable base class.
+        raise GoogleDriveStorageError('Google Drive rejected the contract upload.') from exc
+
+    file_id = response.get('id')
+    if not file_id:
+        raise GoogleDriveStorageError('Google Drive did not return an uploaded file identifier.')
+    return file_id
+
+
+def download_file(file_id):
+    """Download a Drive file into memory for Flask's authenticated response."""
+    try:
+        from googleapiclient.http import MediaIoBaseDownload
+
+        destination = io.BytesIO()
+        downloader = MediaIoBaseDownload(
+            destination,
+            _drive_service().files().get_media(fileId=file_id),
+        )
+        complete = False
+        while not complete:
+            _status, complete = downloader.next_chunk()
+        return destination.getvalue()
+    except GoogleDriveStorageError:
+        raise
+    except Exception as exc:  # Google client exceptions share no stable base class.
+        raise GoogleDriveStorageError('Google Drive could not download this contract.') from exc
+
+
+def delete_file(file_id):
+    """Permanently delete a Drive document when its contract record is deleted."""
+    try:
+        _drive_service().files().delete(fileId=file_id).execute()
+    except GoogleDriveStorageError:
+        raise
+    except Exception as exc:  # Google client exceptions share no stable base class.
+        raise GoogleDriveStorageError('Google Drive could not delete this contract.') from exc

app/local_postgres.py

@@ -0,0 +1,437 @@
+"""Manage a local PostgreSQL instance for development.
+
+Searches for PostgreSQL binaries on the system, initialises a data directory
+under ``instance/pgdata/``, starts the server on port 5433, creates the
+``team_tryouts`` database, and registers cleanup on exit.
+
+Usage from run.py::
+
+    if os.getenv('LOCAL_PG', '').lower() == 'true':
+        from app.local_postgres import start as start_local_pg
+        os.environ['DATABASE_URL'] = start_local_pg()
+
+Environment used (all optional):
+    LOCAL_PG_PORT        Port to bind (default 5433)
+    LOCAL_PG_USER        Database superuser name (default team_tryouts_dev)
+    LOCAL_PG_DATABASE    Database name (default team_tryouts)
+"""
+
+from __future__ import annotations
+
+import atexit
+import contextlib
+import logging
+import os
+import pathlib
+import shutil
+import signal
+import subprocess
+import sys
+import tempfile
+
+# ---------------------------------------------------------------------------
+# Configuration
+# ---------------------------------------------------------------------------
+
+DATADIR = pathlib.Path(__file__).resolve().parent.parent / 'instance' / 'pgdata'
+PG_LOG = DATADIR.parent / 'pg.log'
+
+PORT = int(os.getenv('LOCAL_PG_PORT', '5433'))
+_USER = os.getenv('LOCAL_PG_USER', 'team_tryouts_dev')
+_DATABASE = os.getenv('LOCAL_PG_DATABASE', 'team_tryouts')
+
+DATABASE_URL = f'postgresql://{_USER}@127.0.0.1:{PORT}/{_DATABASE}'
+
+_started = False
+
+#: Name of the system Windows PostgreSQL service we temporarily stopped.
+_stopped_system_service_name: str | None = None
+
+logger = logging.getLogger('app.local_postgres')
+# ---------------------------------------------------------------------------
+# Binary discovery
+# ---------------------------------------------------------------------------
+
+_WIN_PG_ROOTS = [
+    pathlib.Path(os.environ.get('PROGRAMFILES', 'C:\\Program Files')) / 'PostgreSQL',
+    pathlib.Path(os.environ.get('PROGRAMFILES(X86)', 'C:\\Program Files (x86)')) / 'PostgreSQL',
+]
+
+
+def _find_binary(name: str) -> pathlib.Path | None:
+    """Locate a PostgreSQL binary (pg_ctl, initdb, psql)."""
+    found = shutil.which(name)
+    if found:
+        return pathlib.Path(found)
+
+    if sys.platform == 'win32':
+        for root in _WIN_PG_ROOTS:
+            if not root.is_dir():
+                continue
+            versions = sorted(
+                (p for p in root.iterdir() if p.is_dir()),
+                key=lambda p: p.name,
+                reverse=True,
+            )
+            for version_dir in versions:
+                candidate = version_dir / 'bin' / f'{name}.exe'
+                if candidate.is_file():
+                    return candidate
+
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Windows service management
+# ---------------------------------------------------------------------------
+
+#: Path to the Windows service controller.
+_SC_EXE = pathlib.Path(os.environ.get('SYSTEMROOT', 'C:\\Windows')) / 'System32' / 'sc.exe'
+
+
+def _detect_system_service() -> str | None:
+    """Find a running Windows PostgreSQL service installed by the EDB installer.
+
+    Returns the service name (e.g. ``postgresql-x64-18``) or None.
+    """
+    if sys.platform != 'win32' or not _SC_EXE.is_file():
+        return None
+    for root in _WIN_PG_ROOTS:
+        if not root.is_dir():
+            continue
+        versions = sorted(
+            (p for p in root.iterdir() if p.is_dir()),
+            key=lambda p: p.name,
+            reverse=True,
+        )
+        for version_dir in versions:
+            srv = f'postgresql-x64-{version_dir.name}'
+            try:
+                result = subprocess.run(
+                    [str(_SC_EXE), 'query', srv],
+                    capture_output=True,
+                    text=True,
+                )
+                if result.returncode == 0 and 'RUNNING' in result.stdout:
+                    return srv
+            except (FileNotFoundError, OSError):
+                continue
+    return None
+
+
+def _stop_system_service(name: str):
+    """Stop a Windows system service."""
+    print(f'[INFO] Stopping system PostgreSQL service "{name}" ...')
+    try:
+        subprocess.run(
+            [str(_SC_EXE), 'stop', name],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except (FileNotFoundError, OSError) as exc:
+        print(f'[WARNING] Could not stop service "{name}": {exc}')
+
+
+def _start_system_service(name: str):
+    """Start a Windows system service."""
+    print(f'[INFO] Restarting system PostgreSQL service "{name}" ...')
+    try:
+        subprocess.run(
+            [str(_SC_EXE), 'start', name],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except (FileNotFoundError, OSError) as exc:
+        print(f'[WARNING] Could not restart service "{name}": {exc}')
+
+
+# ---------------------------------------------------------------------------
+# Data directory management
+# ---------------------------------------------------------------------------
+
+_TRUST_HBA = """\
+# Local development configuration — trust all local connections.
+# Installed by app/local_postgres.py.
+local   all   all                    trust
+host   all   all   127.0.0.1/32     trust
+host   all   all   ::1/128          trust
+"""
+
+
+def _init_cluster():
+    """Create the data directory if it does not exist yet."""
+    if DATADIR.is_dir() and (DATADIR / 'PG_VERSION').is_file():
+        return
+
+    initdb = _find_binary('initdb')
+    if not initdb:
+        print(
+            '[ERROR] PostgreSQL not found. Install it from:',
+            'https://www.postgresql.org/download/windows/',
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
+    print(f'[INFO] Initialising PostgreSQL data directory at {DATADIR} ...')
+    DATADIR.mkdir(parents=True, exist_ok=True)
+
+    # Write a non-empty password to a temporary file. PostgreSQL >= 18
+    # rejects an empty password (NUL device), and we immediately overwrite
+    # pg_hba.conf with trust auth anyway, so the value is irrelevant.
+    pw_file = tempfile.NamedTemporaryFile(  # noqa: SIM115 — delete=False needed for initdb --pwfile
+        mode='w',
+        delete=False,
+        suffix='.pw',
+        prefix='pg_',
+    )
+    pw_file.write('dev\n')
+    pw_file.close()
+
+    try:
+        subprocess.run(
+            [
+                str(initdb),
+                '--locale=C',
+                '--encoding=UTF8',
+                '--data-checksums',
+                '--username',
+                _USER,
+                '--pwfile',
+                pw_file.name,
+                '-D',
+                str(DATADIR),
+            ],
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+    except subprocess.CalledProcessError as exc:
+        print(f'[ERROR] initdb failed (exit {exc.returncode}):')
+        if exc.stderr:
+            print(exc.stderr)
+        if exc.stdout:
+            print(exc.stdout)
+        sys.exit(1)
+    finally:
+        with contextlib.suppress(OSError):
+            os.unlink(pw_file.name)
+
+    _set_postgresql_conf()
+
+    hba_path = DATADIR / 'pg_hba.conf'
+    hba_path.write_text(_TRUST_HBA, encoding='utf-8')
+    print('[INFO] pg_hba.conf set to trust local connections.')
+
+
+def _set_postgresql_conf():
+    """Write postgresql.conf to match our development settings."""
+    conf_path = DATADIR / 'postgresql.conf'
+    if not conf_path.is_file():
+        return
+
+    lines = conf_path.read_text(encoding='utf-8').splitlines()
+    lines.append('\n# ---- local_postgres.py overrides ----')
+    lines.append(f'port = {PORT}')
+    lines.append("listen_addresses = '127.0.0.1'")
+    lines.append("unix_socket_directories = ''")
+    lines.append('autovacuum = off')  # avoid DLL conflicts with system PostgreSQL service
+    lines.append('logging_collector = off')
+    lines.append('log_destination = stderr')
+    conf_path.write_text('\n'.join(lines), encoding='utf-8')
+
+
+# ---------------------------------------------------------------------------
+# Server start / stop
+# ---------------------------------------------------------------------------
+
+
+def _pg_ctl(args: list[str], cwd: str | None = None) -> subprocess.CompletedProcess:
+    """Run ``pg_ctl`` with the data directory pre-filled."""
+    pg_ctl = _find_binary('pg_ctl')
+    if not pg_ctl:
+        raise RuntimeError('pg_ctl binary not found')
+
+    return subprocess.run(
+        [str(pg_ctl), *args, '-D', str(DATADIR), '-w'],
+        capture_output=True,
+        text=True,
+        cwd=cwd or str(DATADIR),
+    )
+
+
+def _server_running() -> bool:
+    """Return True if the server is already up on our port."""
+    try:
+        result = _pg_ctl(['status'])
+        return result.returncode == 0
+    except (FileNotFoundError, RuntimeError):
+        return False
+
+
+def _create_database():
+    """Create the database if it does not exist."""
+    psql = _find_binary('psql')
+    if not psql:
+        raise RuntimeError('psql binary not found')
+
+    check = subprocess.run(
+        [
+            str(psql),
+            '-h',
+            '127.0.0.1',
+            '-p',
+            str(PORT),
+            '-U',
+            _USER,
+            '-d',
+            'postgres',
+            '-tAc',
+            f"SELECT 1 FROM pg_database WHERE datname = '{_DATABASE}'",
+        ],
+        capture_output=True,
+        text=True,
+        env={**os.environ, 'PGPASSWORD': ''},
+    )
+
+    if check.stdout.strip() == '1':
+        print(f'[INFO] Database "{_DATABASE}" already exists.')
+        return
+
+    subprocess.run(
+        [
+            str(psql),
+            '-h',
+            '127.0.0.1',
+            '-p',
+            str(PORT),
+            '-U',
+            _USER,
+            '-d',
+            'postgres',
+            '-c',
+            f'CREATE DATABASE "{_DATABASE}"',
+        ],
+        check=True,
+        capture_output=True,
+        text=True,
+        env={**os.environ, 'PGPASSWORD': ''},
+    )
+    print(f'[INFO] Created database "{_DATABASE}".')
+
+
+def _stop(*_args):
+    """Stop the PostgreSQL server with a fast shutdown.
+
+    Registered as ``atexit`` and signal handler so it fires on Ctrl+C,
+    normal exit, and terminal close.
+    """
+    global _started
+    global _stopped_system_service_name
+    if not _started:
+        return
+    _started = False
+
+    try:
+        result = _pg_ctl(['stop', '-m', 'fast'])
+        if result.returncode != 0:
+            logger.info('pg_ctl stop returned %d: %s', result.returncode, result.stderr.strip())
+        else:
+            logger.info('Local PostgreSQL stopped.')
+    except Exception as exc:  # noqa: BLE001 — shutdown must never raise
+        logger.warning('Failed to stop local PostgreSQL: %s', exc)
+
+    # Restart the system service if we stopped it earlier.
+    if _stopped_system_service_name:
+        srv = _stopped_system_service_name
+        _stopped_system_service_name = None
+        _start_system_service(srv)
+
+
+# ---------------------------------------------------------------------------
+# Public API
+# ---------------------------------------------------------------------------
+
+
+def start() -> str:
+    """Start a local PostgreSQL server for development.
+
+    Returns the ``DATABASE_URL`` the application should use.
+
+    The caller is expected to set this on ``os.environ['DATABASE_URL']``
+    before invoking ``create_app()``.
+
+    This function is idempotent: if the server is already running and the
+    database exists, it returns immediately.
+    """
+    global _started
+    global _stopped_system_service_name
+
+    # On Windows, temporarily stop the system PostgreSQL service so its child
+    # processes (autovacuum, etc.) do not collide with our local instance.
+    if _stopped_system_service_name is None:  # only do this once per process
+        srv = _detect_system_service()
+        if srv:
+            _stop_system_service(srv)
+            _stopped_system_service_name = srv
+
+    # 1. Initialise if needed.
+    _init_cluster()
+
+    # 2. Start if not already running.
+    if not _server_running():
+        print(f'[INFO] Starting PostgreSQL on port {PORT} ...')
+        PG_LOG.parent.mkdir(parents=True, exist_ok=True)
+        pg_ctl = _find_binary('pg_ctl')
+        try:
+            subprocess.run(
+                [
+                    str(pg_ctl),
+                    'start',
+                    '-D',
+                    str(DATADIR),
+                    '-l',
+                    str(PG_LOG),
+                    '-w',  # wait for readiness
+                ],
+                check=True,
+            )
+        except subprocess.CalledProcessError:
+            print('[ERROR] pg_ctl start failed.')
+            # Also show the server log — it often has the real error.
+            try:
+                log_text = PG_LOG.read_text(encoding='utf-8')
+                if log_text.strip():
+                    print(f'Server log ({PG_LOG}):')
+                    print(log_text)
+            except Exception:  # noqa: BLE001
+                pass
+            sys.exit(1)
+        print(f'[INFO] PostgreSQL is up (pid in {PG_LOG}).')
+    else:
+        print(f'[INFO] PostgreSQL is already running on port {PORT}.')
+
+    # 3. Create the application database (idempotent).
+    _create_database()
+
+    # 4. Register cleanup (only in the *parent* process, not the reloader
+    #    worker — the worker registers its own and tears the database down
+    #    behind any sibling process that is still connected).
+    #
+    #    The Werkzeug reloader sets WERKZEUG_RUN_MAIN=true in the worker
+    #    process and leaves it unset (or false) in the watcher process that
+    #    acts as the parent.  We want the cleanup on the *actual process
+    #    lifecycle*, i.e. when the watcher exits, not every time the
+    #    reloader restarts the worker.
+    if not _started:
+        _started = True
+        if os.environ.get('WERKZEUG_RUN_MAIN', '').lower() != 'true':
+            atexit.register(_stop)
+            with contextlib.suppress(ValueError, OSError):
+                signal.signal(signal.SIGINT, _stop)
+            with contextlib.suppress(AttributeError, ValueError, OSError):
+                signal.signal(signal.SIGBREAK, _stop)  # type: ignore[attr-defined]
+
+    logger.info('Local PostgreSQL ready — DATABASE_URL=%s', DATABASE_URL)
+    return DATABASE_URL

app/models/__init__.py

@@ -21,6 +21,11 @@ from app.models._constants import (
     PLATFORM_CODES,
     TRN_URLS,
     EVALUATION_CRITERIA,
+    OBJECTIVE_TYPES,
+    OBJECTIVE_STATUSES,
+    OBJECTIVE_PRIORITIES,
+    OBJECTIVE_CHECK_FREQUENCIES,
+    DEFAULT_OBJECTIVE_TEMPLATES,
 )
 
 # =========================================================================
@@ -94,3 +99,21 @@ from app.models.contract import Contract
 from app.models.team_note import TeamNote
 from app.models.personal_note import PersonalNote
 from app.models.one_on_one_request import OneOnOneRequest
+from app.models.admin_settings import AppSettings
+from app.models.backup_record import BackupRecord
+from app.models.audit_log import AuditLog
+
+# =========================================================================
+# Layer 12: player evolution objectives
+# =========================================================================
+from app.models.objective import Objective  # noqa: F401 — new table for create_all()
+
+# =========================================================================
+# Layer 13: player evolution entries (KPI measurements)
+# =========================================================================
+from app.models.objective_entry import ObjectiveEntry  # noqa: F401
+
+# =========================================================================
+# Layer 14: objective comments (coach feedback, no existing-schema change)
+# =========================================================================
+from app.models.objective_comment import ObjectiveComment  # noqa: F401

app/models/_associations.py

@@ -37,3 +37,13 @@ tryout_coaches = db.Table(
         'coach_id', db.Integer, db.ForeignKey('users.id', ondelete='CASCADE'), primary_key=True
     ),
 )
+
+tryout_managers = db.Table(
+    'tryout_managers',
+    db.Column(
+        'tryout_id', db.Integer, db.ForeignKey('tryouts.id', ondelete='CASCADE'), primary_key=True
+    ),
+    db.Column(
+        'manager_id', db.Integer, db.ForeignKey('users.id', ondelete='CASCADE'), primary_key=True
+    ),
+)

app/models/_constants.py

@@ -69,11 +69,84 @@ PLATFORM_CODES = {
 
 PLATFORM_DEFAULTS = {'Apex Legends': 'pc', 'Rainbow Six Siege': 'ubi', 'Rocket League': 'epic'}
 
+# Objective-related constants for the Player Evolution planning feature.
+# Ordered lists of (value, human_label) pairs for form fields and display.
+OBJECTIVE_TYPES = [
+    ('individual', 'Individuel'),
+    ('team', 'Équipe'),
+]
+
+OBJECTIVE_STATUSES = [
+    ('active', 'Actif'),
+    ('pending', 'En attente'),
+    ('completed', 'Terminé'),
+    ('overdue', 'En retard'),
+]
+
+OBJECTIVE_PRIORITIES = [
+    ('low', 'Faible'),
+    ('medium', 'Moyenne'),
+    ('high', 'Élevée'),
+]
+
+OBJECTIVE_CHECK_FREQUENCIES = [
+    ('weekly', 'Hebdomadaire'),
+    ('biweekly', 'Bi-hebdomadaire'),
+    ('monthly', 'Mensuelle'),
+]
+
+# Default templates seeded on first run.
+# (priority, title, description, kpi_metric, kpi_target, kpi_unit, type, category)
+DEFAULT_OBJECTIVE_TEMPLATES = [
+    # Quantitative
+    ('medium', 'Améliorer le taux de headshot (HS)',
+     'Augmenter le pourcentage de têtes sur les kills totaux.',
+     'Taux de headshot', 45.0, '%', 'individual', 'Mécaniques'),
+    ('medium', 'Augmenter le K/D ratio',
+     'Améliorer le ratio kills/morts sur les matchs compétitifs.',
+     'K/D Ratio', 1.2, '', 'individual', 'Performance'),
+    ('medium', 'Atteindre un KDA cible',
+     'Maintenir un ratio kills/deaths/assists au-dessus du seuil.',
+     'KDA', 3.0, '', 'individual', 'Performance'),
+    ('medium', 'Améliorer la précision',
+     'Augmenter le pourcentage de tirs touchés par partie.',
+     'Précision', 40.0, '%', 'individual', 'Mécaniques'),
+    ('medium', 'Augmenter les CS par minute',
+     'Atteindre une moyenne de last-hits par minute en jeu.',
+     'CS/min', 8.0, '', 'individual', 'Farm'),
+    ('medium', 'Réduire les morts par match',
+     'Diminuer le nombre de décès moyens par partie compétitive.',
+     'Morts/match', 5.0, '', 'individual', 'Survie'),
+    ('medium', 'Augmenter les dégâts par round',
+     'Améliorer le damage output moyen par round joué.',
+     'Dégâts/round', 150.0, '', 'individual', 'Performance'),
+    ('medium', 'Améliorer le taux de victoire',
+     'Augmenter le pourcentage de parties gagnées sur la saison.',
+     'Winrate', 55.0, '%', 'team', 'Compétitif'),
+
+    # Qualitative
+    ('medium', 'Améliorer le positionnement',
+     'Travailler le placement sur la carte pour réduire les angles exposés.',
+     None, None, None, 'individual', 'Positionnement'),
+    ('medium', 'Améliorer la communication',
+     'Être plus vocal et clair dans les callouts en équipe.',
+     None, None, None, 'individual', 'Communication'),
+    ('medium', 'Développer la conscience de carte',
+     'Anticiper les rotations adverses et mieux lire la minimap.',
+     None, None, None, 'individual', 'Game Sense'),
+    ('medium', 'Améliorer la prise de décision',
+     'Réduire les décisions risquées et améliorer le choix des engagements.',
+     None, None, None, 'individual', 'Decision'),
+    ('medium', 'Renforcer la cohésion d\'équipe',
+     'Participer activement aux stratégies collectives et aux drills.',
+     None, None, None, 'team', 'Équipe'),
+]
+
 TRN_URLS = {
     'Valorant': 'https://tracker.gg/valorant/profile/riot/{username}',
-    'League of Legends': 'https://tracker.gg/lol/profile/{username}',
+    'League of Legends': 'https://tracker.gg/lol/riot/profile/{username}',
     'Counter-Strike 2': 'https://tracker.gg/cs2/profile/steam/{username}',
-    'Apex Legends': 'https://tracker.gg/apex/profile/{platform}/{username}',
+    'Apex Legends': 'https://tracker.gg/apex/profile/{platform_code}/{username}',
     'Overwatch 2': 'https://tracker.gg/overwatch/profile/battlenet/{username}',
     'Rainbow Six Siege': 'https://r6.tracker.network/r6siege/profile/{platform_code}/{username}',
     'Rocket League': 'https://rocketleague.tracker.network/rocket-league/profile/{platform_code}/{username}',

app/models/admin_settings.py

@@ -0,0 +1,56 @@
+"""Global application settings stored as key-value pairs in the database."""
+
+from app.extensions import db
+
+
+class AppSettings(db.Model):
+    """Key-value store for global application settings.
+
+    Stores toggles and configuration that admins control through the
+    admin panel, such as whether tryouts are open, season state, etc.
+    """
+
+    __tablename__ = 'app_settings'
+
+    key = db.Column(db.String(100), primary_key=True)
+    value = db.Column(db.Text, nullable=True)
+
+    # ------------------------------------------------------------------
+    # Well-known keys (documented here for discoverability)
+    # ------------------------------------------------------------------
+    # tryouts_open             – "true" / "false"  (default: "true")
+    # document_uploads_enabled – "true" / "false"  (default: "true")
+    # season_active            – "true" / "false"  (default: "false")
+    # season_name              – e.g. "Fall 2026"
+    # season_start             – ISO date string
+    # season_end               – ISO date string
+
+    @staticmethod
+    def get(key, default=None):
+        """Return the value for *key*, or *default* if not set."""
+        row = db.session.get(AppSettings, key)
+        return row.value if row is not None else default
+
+    @staticmethod
+    def set(key, value):
+        """Upsert a setting."""
+        row = db.session.get(AppSettings, key)
+        if row is None:
+            row = AppSettings(key=key, value=str(value) if value is not None else None)
+            db.session.add(row)
+        else:
+            row.value = str(value) if value is not None else None
+        db.session.commit()
+
+    @staticmethod
+    def get_bool(key, default=False):
+        """Return a boolean setting."""
+        val = AppSettings.get(key)
+        if val is None:
+            return default
+        return val.lower() in ('true', '1', 'yes', 'on')
+
+    @staticmethod
+    def set_bool(key, value):
+        """Store a boolean setting as 'true' / 'false'."""
+        AppSettings.set(key, 'true' if value else 'false')

app/models/audit_log.py

@@ -0,0 +1,32 @@
+"""Audit log for tracking sensitive administrative actions."""
+
+from app.extensions import db
+from app.time_utils import utc_now_naive
+
+
+class AuditLog(db.Model):
+    """Append-only log of critical admin actions for accountability."""
+
+    __tablename__ = 'audit_logs'
+
+    id = db.Column(db.Integer, primary_key=True)
+    user_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=True)
+    action = db.Column(db.String(100), nullable=False)
+    details = db.Column(db.Text, nullable=True)
+    ip_address = db.Column(db.String(64), nullable=True)
+    created_at = db.Column(db.DateTime, default=utc_now_naive)
+
+    user = db.relationship('User', foreign_keys=[user_id], backref='audit_logs')
+
+    @staticmethod
+    def record(user_id, action, details=None, ip_address=None):
+        """Create a new audit log entry."""
+        entry = AuditLog(
+            user_id=user_id,
+            action=action,
+            details=details,
+            ip_address=ip_address,
+        )
+        db.session.add(entry)
+        db.session.commit()
+        return entry

app/models/backup_record.py

@@ -0,0 +1,21 @@
+"""Records of database backups created through the admin panel."""
+
+from app.extensions import db
+from app.time_utils import utc_now_naive
+
+
+class BackupRecord(db.Model):
+    """Metadata for a database backup stored on disk."""
+
+    __tablename__ = 'backup_records'
+
+    id = db.Column(db.Integer, primary_key=True)
+    filename = db.Column(db.String(255), nullable=False)
+    file_path = db.Column(db.String(500), nullable=False)
+    size_bytes = db.Column(db.BigInteger, nullable=True)
+    backup_type = db.Column(db.String(20), default='manual')  # 'manual' or 'auto'
+    notes = db.Column(db.Text, nullable=True)
+    created_by_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=True)
+    created_at = db.Column(db.DateTime, default=utc_now_naive)
+
+    creator = db.relationship('User', foreign_keys=[created_by_id], backref='backups')

app/models/objective.py

@@ -0,0 +1,84 @@
+"""Player evolution objective — individual or team KPI-based goal."""
+
+from app.extensions import db
+from app.time_utils import utc_now_naive
+
+
+class Objective(db.Model):
+    """Player evolution objective — a KPI-driven plan for individual players
+    or teams, created and tracked by coaching staff.
+
+    Covers the full lifecycle: draft (pending), active, completed, overdue.
+    Supports arbitrary KPI metrics, optional tags, and verifiable progress.
+    """
+
+    __tablename__ = 'objectives'
+
+    id = db.Column(db.Integer, primary_key=True)
+    title = db.Column(db.String(200), nullable=False)
+    description = db.Column(db.Text, nullable=True)
+
+    # Category
+    type = db.Column(
+        db.String(20),
+        nullable=False,
+        default='individual',
+    )
+    status = db.Column(
+        db.String(20),
+        nullable=False,
+        default='active',
+    )
+    priority = db.Column(
+        db.String(20),
+        nullable=False,
+        default='medium',
+    )
+    category = db.Column(db.String(50), nullable=True)
+    is_template = db.Column(db.Boolean, default=False, nullable=False)
+
+    # Assignment (individual player / org team)
+    player_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=True)
+    team_id = db.Column(db.Integer, db.ForeignKey('org_teams.id'), nullable=True)
+
+    # KPI fields
+    kpi_metric = db.Column(db.String(120), nullable=True)
+    kpi_target = db.Column(db.Numeric(10, 2), nullable=True)
+    kpi_unit = db.Column(db.String(20), nullable=True)
+    kpi_precision = db.Column(db.Integer, nullable=True)
+
+    # Timeline
+    start_date = db.Column(db.Date, nullable=True)
+    due_date = db.Column(db.Date, nullable=False)
+    check_frequency = db.Column(db.String(30), nullable=True)
+
+    # Progress tracking (0–100)
+    progress = db.Column(db.Integer, default=0, nullable=False)
+
+    # Misc
+    tags = db.Column(db.String(255), nullable=True)
+
+    # Who created it
+    created_by = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=False)
+
+    # Timestamps
+    created_at = db.Column(db.DateTime, default=utc_now_naive)
+    updated_at = db.Column(db.DateTime, default=utc_now_naive, onupdate=utc_now_naive)
+
+    # -----------------------------------------------------------------------
+    # Relationships
+    # -----------------------------------------------------------------------
+    player = db.relationship(
+        'User',
+        foreign_keys=[player_id],
+        backref=db.backref('objectives', lazy='dynamic'),
+    )
+    team = db.relationship(
+        'OrgTeam',
+        foreign_keys=[team_id],
+        backref=db.backref('objectives', lazy='dynamic'),
+    )
+    creator = db.relationship(
+        'User',
+        foreign_keys=[created_by],
+    )

app/models/objective_comment.py

@@ -0,0 +1,35 @@
+"""Coach comments on a specific objective."""
+
+from app.extensions import db
+from app.time_utils import utc_now_naive
+
+
+class ObjectiveComment(db.Model):
+    """A coach's comment on a player-evolution objective.
+
+    This is a separate table from PersonalNote — no existing schema
+    is altered.  The objective-form page also *reads* PersonalNote and
+    TeamNote for context, but never writes to those tables.
+    """
+
+    __tablename__ = 'objective_comments'
+
+    id = db.Column(db.Integer, primary_key=True)
+    objective_id = db.Column(
+        db.Integer,
+        db.ForeignKey('objectives.id'),
+        nullable=False,
+    )
+    coach_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=False)
+    content = db.Column(db.Text, nullable=False)
+    created_at = db.Column(db.DateTime, default=utc_now_naive)
+    updated_at = db.Column(db.DateTime, default=utc_now_naive, onupdate=utc_now_naive)
+
+    # -----------------------------------------------------------------------
+    # Relationships
+    # -----------------------------------------------------------------------
+    objective = db.relationship(
+        'Objective',
+        backref=db.backref('comments', lazy='dynamic', order_by='ObjectiveComment.created_at'),
+    )
+    coach = db.relationship('User', foreign_keys=[coach_id])

app/models/objective_entry.py

@@ -0,0 +1,39 @@
+"""Player evolution — KPI measurement entries for objectives."""
+
+from app.extensions import db
+from app.time_utils import utc_now_naive
+
+
+class ObjectiveEntry(db.Model):
+    """A single KPI measurement recorded for an objective.
+
+    Each entry records a value at a point in time so the evolution
+    graph can plot historical data and compute a trend line.
+    """
+
+    __tablename__ = 'objective_entries'
+
+    id = db.Column(db.Integer, primary_key=True)
+    objective_id = db.Column(
+        db.Integer,
+        db.ForeignKey('objectives.id'),
+        nullable=False,
+    )
+    value = db.Column(db.Numeric(10, 2), nullable=True)
+    recorded_at = db.Column(db.DateTime, nullable=False, default=utc_now_naive)
+    note = db.Column(db.Text, nullable=True)
+
+    # Who recorded it
+    recorded_by = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=False)
+
+    # Timestamps
+    created_at = db.Column(db.DateTime, default=utc_now_naive)
+
+    # -----------------------------------------------------------------------
+    # Relationships
+    # -----------------------------------------------------------------------
+    objective = db.relationship(
+        'Objective',
+        backref=db.backref('entries', lazy='dynamic', order_by='ObjectiveEntry.recorded_at'),
+    )
+    recorder = db.relationship('User', foreign_keys=[recorded_by])

app/models/tryout/tryout.py

@@ -1,7 +1,7 @@
 """Tryout event for player evaluations and team formation."""
 
 from app.extensions import db
-from app.models._associations import tryout_coaches
+from app.models._associations import tryout_coaches, tryout_managers
 from app.time_utils import utc_now_naive
 
 
@@ -20,16 +20,17 @@ class Tryout(db.Model):
     max_players = db.Column(db.Integer, nullable=True)
     created_by = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=False)
     target_org_team_id = db.Column(db.Integer, db.ForeignKey('org_teams.id'), nullable=True)
-    manager_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=True)
+    manager_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=True)  # deprecated, kept for migration
     coach_id = db.Column(
         db.Integer, db.ForeignKey('users.id'), nullable=True
     )  # deprecated, kept for migration
     created_at = db.Column(db.DateTime, default=utc_now_naive)
 
     creator = db.relationship('User', foreign_keys=[created_by], backref='created_tryouts')
-    manager = db.relationship('User', foreign_keys=[manager_id], backref='managed_tryouts')
+    manager = db.relationship('User', foreign_keys=[manager_id], backref='managed_tryouts')  # deprecated
     coach = db.relationship('User', foreign_keys=[coach_id], backref='_deprecated_coached_tryouts')
     coaches = db.relationship('User', secondary=tryout_coaches, backref='coached_tryouts')
+    managers = db.relationship('User', secondary=tryout_managers, backref='managed_tryouts_m2m')
     registrations = db.relationship('TryoutRegistration', backref='tryout', lazy='dynamic')
     evaluations = db.relationship('Evaluation', backref='tryout', lazy='dynamic')
     teams = db.relationship('Team', backref='tryout', lazy='dynamic')
@@ -47,3 +48,17 @@ class Tryout(db.Model):
         if self.end_date is not None:
             return self.end_date < today
         return self.date < today
+
+    def get_managers(self):
+        """Managers attached to this tryout, both legacy and many-to-many."""
+        manager_list = list(self.managers)
+        if not manager_list and self.manager:
+            return [self.manager]
+        return manager_list
+
+    def get_coaches(self):
+        """Coaches attached to this tryout, both legacy and many-to-many."""
+        coach_list = list(self.coaches)
+        if not coach_list and self.coach:
+            return [self.coach]
+        return coach_list

app/models/user_model/manager.py

@@ -21,7 +21,11 @@ class Manager(User):
         return True
 
     def can_manage_this_tryout(self, tryout):
-        return tryout.created_by == self.id or tryout.manager_id == self.id
+        return (
+            tryout.created_by == self.id
+            or tryout.manager_id == self.id
+            or any(m.id == self.id for m in tryout.managers)
+        )
 
     def can_manage_this_org_team(self, org_team):
         return True
@@ -32,7 +36,13 @@ class Manager(User):
         from app.models.tryout.tryout import Tryout
 
         return (
-            Tryout.query.filter(or_(Tryout.created_by == self.id, Tryout.manager_id == self.id))
+            Tryout.query.filter(
+                or_(
+                    Tryout.created_by == self.id,
+                    Tryout.manager_id == self.id,
+                    Tryout.managers.any(id=self.id),
+                )
+            )
             .order_by(Tryout.date)
             .all()
         )

app/objectives_analytics.py

@@ -0,0 +1,124 @@
+"""Objective analytics — linear regression for KPI prediction.
+
+Given a set of ObjectiveEntry measurements, computes a simple linear
+regression (y = mx + b, where x = days since first entry) and answers:
+
+- **predicted_achievement_date**: the date when the trend line crosses
+  the KPI target value (or None if the trend is flat or negative).
+- **confidence_score**: a heuristic 0.0–1.0 based on sample count and
+  the R² coefficient of determination.
+- **predicted_value_at_date(date)**: the value the trend predicts at a
+  given future date.
+"""
+
+from __future__ import annotations
+
+import datetime
+
+
+def _to_days(timestamps: list[datetime.datetime]) -> list[float]:
+    """Convert datetimes to float days since the first entry."""
+    if not timestamps:
+        return []
+    t0 = timestamps[0]
+    return [(t - t0).total_seconds() / 86400.0 for t in timestamps]
+
+
+def _r_squared(xs, ys, slope, intercept):
+    """Coefficient of determination (R²)."""
+    if len(xs) < 2:
+        return 0.0
+    mean_y = sum(ys) / len(ys)
+    ss_res = sum((y - (slope * x + intercept)) ** 2 for x, y in zip(xs, ys, strict=True))
+    ss_tot = sum((y - mean_y) ** 2 for y in ys)
+    if ss_tot == 0:
+        return 1.0
+    return 1.0 - ss_res / ss_tot
+
+
+def compute_trend(
+    timestamps: list[datetime.datetime],
+    values: list[float],
+    target: float | None,
+) -> dict:
+    """Compute a linear regression trend and prediction.
+
+    Args:
+        timestamps: Entry dates.
+        values: Entry values (must be same length as timestamps).
+        target: KPI target value, or None for qualitative objectives.
+
+    Returns:
+        dict with keys:
+            slope, intercept, r_squared, confidence,
+            predicted_achievement_days, predicted_achievement_date,
+            predicted_value_at_due, target_value
+    """
+    n = len(timestamps)
+    if n < 2 or not values:
+        return {
+            'slope': 0.0,
+            'intercept': float(values[0]) if values else 0.0,
+            'r_squared': 0.0,
+            'confidence': 0.0,
+            'predicted_achievement_days': None,
+            'predicted_achievement_date': None,
+            'predicted_value_at_due': None,
+            'target_value': target,
+        }
+
+    xs = _to_days(timestamps)
+    ys = [float(v) for v in values]
+
+    n_f = float(n)
+    sum_x = sum(xs)
+    sum_y = sum(ys)
+    sum_xy = sum(x * y for x, y in zip(xs, ys, strict=True))
+    sum_xx = sum(x * x for x in xs)
+
+    denom = n_f * sum_xx - sum_x * sum_x
+    if abs(denom) < 1e-12:
+        return {
+            'slope': 0.0,
+            'intercept': sum_y / n_f,
+            'r_squared': 0.0,
+            'confidence': 0.0,
+            'predicted_achievement_days': None,
+            'predicted_achievement_date': None,
+            'predicted_value_at_due': None,
+            'target_value': target,
+        }
+
+    slope = (n_f * sum_xy - sum_x * sum_y) / denom
+    intercept = (sum_y - slope * sum_x) / n_f
+    r2 = _r_squared(xs, ys, slope, intercept)
+
+    # Confidence heuristic: combination of R² and sample count
+    sample_confidence = min(1.0, n / 10.0)  # 10+ entries = full confidence
+    confidence = sample_confidence * r2
+
+    # Days from first entry to target (if slope > 0 and target > intercept)
+    predicted_achievement_days = None
+    predicted_achievement_date = None
+    if target is not None and slope > 1e-12:
+        days_to_target = (target - intercept) / slope
+        if days_to_target >= 0:
+            predicted_achievement_days = days_to_target
+            predicted_achievement_date = timestamps[0] + datetime.timedelta(
+                days=days_to_target,
+            )
+
+    return {
+        'slope': slope,
+        'intercept': intercept,
+        'r_squared': round(r2, 4),
+        'confidence': round(confidence, 4),
+        'predicted_achievement_days': (
+            round(predicted_achievement_days, 1) if predicted_achievement_days is not None else None
+        ),
+        'predicted_achievement_date': (
+            predicted_achievement_date.isoformat() if predicted_achievement_date else None
+        ),
+        'predicted_value_at_due': None,
+        'target_value': target,
+    }

app/permissions.py

@@ -343,3 +343,73 @@ def coach_manages_tryout(coach, tryout):
     if tryout.target_org_team_id:
         return tryout.target_org_team_id in coach_org_team_ids(coach)
     return False
+
+
+# ---------------------------------------------------------------------------
+# Player Evolution — Objectives
+# ---------------------------------------------------------------------------
+
+
+def can_view_objectives(user):
+    """Whether the user may view the objectives list.
+
+    Everyone except regular players without any context can browse objectives.
+    Players see only their own.
+    """
+    return True
+
+
+def can_manage_objectives(user):
+    """Whether the user may create, edit, or delete objectives.
+
+    Presidents, managers, and coaches may manage objectives.  Players are
+    read-only.
+    """
+    from app.models import Admin, Coach, Manager
+
+    return isinstance(user, (Admin, Manager, Coach))
+
+
+def can_manage_objective(user, objective):
+    """Whether the user may edit or delete a specific objective.
+
+    Presidents and managers may manage any objective.  A coach may manage
+    objectives assigned to their players or their teams.
+    """
+    from app.models import Admin, Coach, Manager
+
+    if isinstance(user, (Admin, Manager)):
+        return True
+    if isinstance(user, Coach):
+        if objective.player_id and objective.player_id in coach_player_ids(user):
+            return True
+        if objective.team_id and objective.team_id in coach_org_team_ids(user):
+            return True
+    return False
+
+
+def can_view_objective(user, objective):
+    """Whether the user may view this objective's detail page.
+
+    Presidents, managers, and coaches may view any they manage.
+    A player may view only their own assigned objectives.
+    Everyone else may view objectives they created.
+    """
+    from app.models import Admin, Coach, Manager, Player
+
+    if isinstance(user, (Admin, Manager)):
+        return True
+    if isinstance(user, Coach):
+        return can_manage_objective(user, objective)
+    if isinstance(user, Player):
+        return objective.player_id == user.id
+    return objective.created_by == user.id
+
+
+def can_add_objective_entry(user, objective):
+    """Whether the user may record a KPI measurement on this objective.
+
+    The same as can_view_objective — the assigned player may record
+    their own measurements on their own objectives.
+    """
+    return can_view_objective(user, objective)

app/routes/admin.py

@@ -0,0 +1,396 @@
+"""Admin panel routes for system-level management.
+
+Provides backup/restore, tryout open/close toggling, season lifecycle
+management, team wiping, and audit log viewing. All routes are restricted
+to administrators.
+"""
+
+import os
+from datetime import datetime
+
+from flask import (
+    Blueprint, render_template, redirect, url_for, flash, request,
+    send_file,
+)
+from flask_login import login_required, current_user
+
+from app.extensions import db
+from app.models import (
+    Admin, User, Tryout, OrgTeam, TeamPlayer, TeamMatch,
+    TeamMatchParticipant, AppSettings, BackupRecord, AuditLog,
+)
+from app.supporting_scripts.backup import (
+    BACKUP_DIR, BackupError, backup_database, backup_documents,
+    create_backup_dir, parse_database_url, verify_backup,
+)
+
+admin_bp = Blueprint('admin', __name__, url_prefix='/admin')
+
+
+def require_admin():
+    """Return True if current user is an Admin, else flash and redirect."""
+    if isinstance(current_user, Admin):
+        return True
+    flash('Only the president can access the admin panel.', 'danger')
+    return False
+
+
+def _client_ip():
+    """Best-effort client IP for audit logging."""
+    if request.headers.get('X-Forwarded-For'):
+        return request.headers.get('X-Forwarded-For').split(',')[0].strip()
+    return request.remote_addr
+
+
+def _log(action, details=None):
+    """Record an audit log entry for the current user."""
+    AuditLog.record(
+        user_id=current_user.id,
+        action=action,
+        details=details,
+        ip_address=_client_ip(),
+    )
+
+
+# ---------------------------------------------------------------------------
+# Dashboard
+# ---------------------------------------------------------------------------
+
+@admin_bp.route('')
+@login_required
+def dashboard():
+    """Render the admin panel dashboard."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    stats = {
+        'total_users': User.query.count(),
+        'total_players': User.query.filter_by(role='player').count(),
+        'total_org_teams': OrgTeam.query.count(),
+        'active_tryouts': Tryout.query.filter_by(status='in_progress').count(),
+        'upcoming_tryouts': Tryout.query.filter_by(status='upcoming').count(),
+    }
+
+    settings = {
+        'tryouts_open': AppSettings.get_bool('tryouts_open', default=True),
+        'document_uploads_enabled': AppSettings.get_bool('document_uploads_enabled', default=True),
+        'season_active': AppSettings.get_bool('season_active', default=False),
+        'season_name': AppSettings.get('season_name') or 'Not set',
+        'season_start': AppSettings.get('season_start') or 'Not set',
+        'season_end': AppSettings.get('season_end') or 'Not set',
+    }
+
+    backups = BackupRecord.query.order_by(BackupRecord.created_at.desc()).limit(20).all()
+    audit_logs = AuditLog.query.order_by(AuditLog.created_at.desc()).limit(20).all()
+
+    return render_template(
+        'pages/admin.html',
+        stats=stats,
+        settings=settings,
+        backups=backups,
+        audit_logs=audit_logs,
+    )
+
+
+# ---------------------------------------------------------------------------
+# Backups
+# ---------------------------------------------------------------------------
+
+def _create_backup_record(backup_type='manual', notes=None):
+    """Run a database backup and return a BackupRecord, or raise BackupError."""
+    create_backup_dir()
+    conn = parse_database_url(os.getenv('DATABASE_URL'))
+    file_path = backup_database(conn)
+    size = os.path.getsize(file_path) if os.path.exists(file_path) else 0
+    filename = os.path.basename(file_path)
+
+    record = BackupRecord(
+        filename=filename,
+        file_path=file_path,
+        size_bytes=size,
+        backup_type=backup_type,
+        notes=notes,
+        created_by_id=current_user.id,
+    )
+    db.session.add(record)
+    db.session.commit()
+    return record
+
+
+@admin_bp.route('/backup/create', methods=['POST'])
+@login_required
+def create_backup():
+    """Create a manual database backup."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    notes = request.form.get('notes', '').strip() or None
+    try:
+        record = _create_backup_record(backup_type='manual', notes=notes)
+    except BackupError as e:
+        flash(f'Backup failed: {e}', 'danger')
+        _log('backup_failed', f'Error: {e}')
+        return redirect(url_for('admin.dashboard'))
+
+    _log('backup_created', f'File: {record.filename} ({record.size_bytes} bytes)')
+    flash(f'Backup created successfully: {record.filename}', 'success')
+    return redirect(url_for('admin.dashboard'))
+
+
+@admin_bp.route('/backup/<int:backup_id>/download')
+@login_required
+def download_backup(backup_id):
+    """Download a backup file."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    record = BackupRecord.query.get_or_404(backup_id)
+    if not os.path.exists(record.file_path):
+        flash('Backup file is missing from disk.', 'danger')
+        return redirect(url_for('admin.dashboard'))
+
+    _log('backup_downloaded', f'File: {record.filename}')
+    return send_file(record.file_path, as_attachment=True, download_name=record.filename)
+
+
+@admin_bp.route('/backup/<int:backup_id>/delete', methods=['POST'])
+@login_required
+def delete_backup(backup_id):
+    """Delete a backup file and its record."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    record = BackupRecord.query.get_or_404(backup_id)
+    if os.path.exists(record.file_path):
+        try:
+            os.remove(record.file_path)
+        except OSError as e:
+            flash(f'Could not remove backup file: {e}', 'danger')
+            return redirect(url_for('admin.dashboard'))
+
+    _log('backup_deleted', f'File: {record.filename}')
+    db.session.delete(record)
+    db.session.commit()
+    flash(f'Backup {record.filename} deleted.', 'success')
+    return redirect(url_for('admin.dashboard'))
+
+
+@admin_bp.route('/backup/<int:backup_id>/restore', methods=['POST'])
+@login_required
+def restore_backup(backup_id):
+    """Restore a selected backup.
+
+    A safety backup of the current state is created first, then the
+    selected dump is restored via pg_restore.
+    """
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    record = BackupRecord.query.get_or_404(backup_id)
+    if not os.path.exists(record.file_path):
+        flash('Backup file is missing from disk.', 'danger')
+        return redirect(url_for('admin.dashboard'))
+
+    # Create a safety backup of the current state before restoring.
+    try:
+        safety = _create_backup_record(
+            backup_type='pre_restore',
+            notes='Automatic safety backup before restoring ' + record.filename,
+        )
+    except BackupError as e:
+        flash(f'Could not create safety backup, restore aborted: {e}', 'danger')
+        return redirect(url_for('admin.dashboard'))
+
+    # Restore using pg_restore
+    import subprocess
+    from app.supporting_scripts.backup import (
+        PG_RESTORE, dump_environment, parse_database_url,
+    )
+
+    conn = parse_database_url(os.getenv('DATABASE_URL'))
+    cmd = [
+        PG_RESTORE,
+        '--host', conn['host'],
+        '--port', conn['port'],
+        '--username', conn['user'],
+        '--dbname', conn['dbname'],
+        '--clean', '--if-exists', '--no-owner',
+        record.file_path,
+    ]
+    try:
+        result = subprocess.run(
+            cmd,
+            env=dump_environment(conn),
+            capture_output=True,
+            text=True,
+            timeout=900,
+        )
+        if result.returncode != 0:
+            raise RuntimeError(result.stderr.strip() or 'pg_restore failed')
+    except (subprocess.TimeoutExpired, FileNotFoundError, RuntimeError) as e:
+        flash(f'Restore failed: {e}', 'danger')
+        _log('backup_restore_failed', f'File: {record.filename}, Error: {e}')
+        return redirect(url_for('admin.dashboard'))
+
+    _log('backup_restored', f'File: {record.filename}')
+    flash(
+        f'Backup {record.filename} restored successfully. The database has been rolled back.',
+        'success',
+    )
+    return redirect(url_for('admin.dashboard'))
+
+
+# ---------------------------------------------------------------------------
+# Tryouts open/close toggle
+# ---------------------------------------------------------------------------
+
+@admin_bp.route('/toggle-tryouts', methods=['POST'])
+@login_required
+def toggle_tryouts():
+    """Toggle the global tryout open/close state."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    current = AppSettings.get_bool('tryouts_open', default=True)
+    new_value = not current
+    AppSettings.set_bool('tryouts_open', new_value)
+
+    state = 'opened' if new_value else 'closed'
+    _log('tryouts_toggled', f'Tryouts {state}')
+    flash(f'Tryouts are now {state}.', 'success')
+    return redirect(url_for('admin.dashboard'))
+
+
+# ---------------------------------------------------------------------------
+# Season lifecycle
+# ---------------------------------------------------------------------------
+
+@admin_bp.route('/season/start', methods=['POST'])
+@login_required
+def start_season():
+    """Begin a new regular season."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    if AppSettings.get_bool('season_active', default=False):
+        flash('A season is already active. End it before starting a new one.', 'danger')
+        return redirect(url_for('admin.dashboard'))
+
+    name = request.form.get('season_name', '').strip()
+    start_date = request.form.get('season_start', '').strip()
+    if not start_date:
+        flash('A season start date is required.', 'danger')
+        return redirect(url_for('admin.dashboard'))
+
+    try:
+        datetime.strptime(start_date, '%Y-%m-%d')
+    except ValueError:
+        flash('Invalid season start date format.', 'danger')
+        return redirect(url_for('admin.dashboard'))
+
+    AppSettings.set('season_name', name or 'Untitled Season')
+    AppSettings.set('season_start', start_date)
+    AppSettings.set('season_end', None)
+    AppSettings.set_bool('season_active', True)
+
+    _log('season_started', f'Season: {name or "Untitled Season"}, Start: {start_date}')
+    flash(f'Season "{name or "Untitled Season"}" has begun.', 'success')
+    return redirect(url_for('admin.dashboard'))
+
+
+@admin_bp.route('/season/end', methods=['POST'])
+@login_required
+def end_season():
+    """End the current regular season."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    if not AppSettings.get_bool('season_active', default=False):
+        flash('No season is currently active.', 'danger')
+        return redirect(url_for('admin.dashboard'))
+
+    end_date = request.form.get('season_end', '').strip()
+    if not end_date:
+        flash('A season end date is required.', 'danger')
+        return redirect(url_for('admin.dashboard'))
+
+    try:
+        datetime.strptime(end_date, '%Y-%m-%d')
+    except ValueError:
+        flash('Invalid season end date format.', 'danger')
+        return redirect(url_for('admin.dashboard'))
+
+    name = AppSettings.get('season_name')
+    AppSettings.set('season_end', end_date)
+    AppSettings.set_bool('season_active', False)
+
+    _log('season_ended', f'Season: {name}, End: {end_date}')
+    flash(f'Season "{name}" has ended.', 'success')
+    return redirect(url_for('admin.dashboard'))
+@admin_bp.route('/toggle-document-uploads', methods=['POST'])
+@login_required
+def toggle_document_uploads():
+    """Enable or disable document uploads for non-admin users."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    current = AppSettings.get_bool('document_uploads_enabled', default=True)
+    new_value = not current
+    AppSettings.set_bool('document_uploads_enabled', new_value)
+
+    state = 'enabled' if new_value else 'disabled'
+    _log('document_uploads_toggled', f'Document uploads {state}')
+    flash(f'Document uploads are now {state}.', 'success')
+    return redirect(url_for('admin.dashboard'))
+
+
+
+
+
+# ---------------------------------------------------------------------------
+# Wipe teams for new season
+# ---------------------------------------------------------------------------
+
+@admin_bp.route('/teams/wipe', methods=['POST'])
+@login_required
+def wipe_teams():
+    """Wipe team rosters and season matches for a new season.
+
+    Players are removed from org teams (TeamPlayer records), regular-season
+    matches and their participants are deleted. OrgTeam structures, coaches,
+    and managers are preserved.
+    """
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    confirm = request.form.get('confirm', '').strip()
+    if confirm != 'WIPE':
+        flash("Type 'WIPE' in the confirmation box to proceed.", 'danger')
+        return redirect(url_for('admin.dashboard'))
+
+    # Safety backup before destructive operation
+    try:
+        _create_backup_record(
+            backup_type='pre_wipe',
+            notes='Automatic safety backup before wiping teams',
+        )
+    except BackupError as e:
+        flash(f'Wipe aborted — could not create safety backup: {e}', 'danger')
+        return redirect(url_for('admin.dashboard'))
+
+    roster_count = TeamPlayer.query.count()
+    match_count = TeamMatch.query.count()
+
+    # Delete team match participants first (FK order)
+    TeamMatchParticipant.query.delete()
+    TeamMatch.query.delete()
+    TeamPlayer.query.delete()
+    db.session.commit()
+
+    _log('teams_wiped', f'Removed {roster_count} roster entries and {match_count} season matches')
+    flash(
+        f'Teams wiped for the new season. Removed {roster_count} roster entries '
+        f'and {match_count} regular-season matches.',
+        'success',
+    )
+    return redirect(url_for('admin.dashboard'))

app/routes/objectives.py

@@ -0,0 +1,661 @@
+"""Player Evolution — Objective management routes.
+
+Allows coaches and staff to create, update, delete, and list
+KPI-driven objectives for individual players or teams.
+"""
+
+import datetime
+
+from flask import Blueprint, flash, redirect, render_template, request, url_for
+from flask_babel import gettext as _
+from flask_login import current_user, login_required
+from marshmallow import ValidationError
+
+from app.api import json_endpoint
+from app.extensions import db
+from app.forms import flash_validation_errors, form_payload
+from app.models import (
+    DEFAULT_OBJECTIVE_TEMPLATES,
+    OBJECTIVE_CHECK_FREQUENCIES,
+    OBJECTIVE_PRIORITIES,
+    OBJECTIVE_STATUSES,
+    OBJECTIVE_TYPES,
+    Admin,
+    Coach,
+    Manager,
+    Objective,
+    ObjectiveComment,
+    ObjectiveEntry,
+    OrgTeam,
+    PersonalNote,
+    TeamNote,
+    User,
+)
+from app.pagination import paginate
+from app.permissions import (
+    can_manage_objective,
+    can_manage_objectives,
+    coach_org_team_ids,
+    coach_player_ids,
+)
+from app.validators import ObjectiveSchema
+
+objectives_bp = Blueprint('objectives', __name__, url_prefix='/objectives')
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+def _resolve_objective(obj_id):
+    """Load an objective or 404."""
+    return db.get_or_404(Objective, obj_id)
+
+
+def _can_edit(user, objective):
+    """Short-hand permission check with flash fallback."""
+    if can_manage_objective(user, objective):
+        return True
+    flash(_('You do not have permission to manage this objective.'), 'danger')
+    return False
+
+
+# ---------------------------------------------------------------------------
+# List / Dashboard
+# ---------------------------------------------------------------------------
+
+
+@objectives_bp.route('')
+@login_required
+def list_objectives():
+    """List all objectives the current user may see."""
+    user = current_user
+    can_edit = can_manage_objectives(user)
+
+    # ── Query base ──────────────────────────────────────────────────────
+    base = Objective.query
+
+    # Scope: players only see their own, coaches/admins see theirs, etc.
+    if isinstance(user, Manager):
+        base = base.filter(Objective.created_by == user.id)
+    elif isinstance(user, Coach):
+        team_ids = coach_org_team_ids(user)
+        player_ids = coach_player_ids(user)
+        conditions = [Objective.created_by == user.id]
+        if team_ids:
+            conditions.append(Objective.team_id.in_(team_ids))
+        if player_ids:
+            conditions.append(Objective.player_id.in_(player_ids))
+        base = base.filter(db.or_(*conditions))
+    elif isinstance(user, Admin):
+        pass  # all
+    elif hasattr(user, 'role') and user.role == 'player':
+        base = base.filter(Objective.player_id == user.id)
+    else:
+        base = base.filter(Objective.created_by == user.id)
+    # ── Tab / filter ────────────────────────────────────────────────────
+    tab = request.args.get('tab', 'all')
+    if tab == 'kpi':
+        base = base.filter(Objective.kpi_metric.isnot(None))
+    elif tab in ('modeles', 'templates'):
+        base = base.filter(Objective.is_template.is_(True))
+
+    search = request.args.get('search', '').strip()
+    if search:
+        base = base.filter(Objective.title.ilike(f'%{search}%'))
+
+    f_status = request.args.get('status', '').strip()
+    f_priority = request.args.get('priority', '').strip()
+    f_type = request.args.get('type', '').strip()
+    f_team = request.args.get('team', type=int)
+
+    if f_status:
+        base = base.filter(Objective.status == f_status)
+    if f_priority:
+        base = base.filter(Objective.priority == f_priority)
+    if f_type:
+        base = base.filter(Objective.type == f_type)
+    if f_team:
+        base = base.filter(Objective.team_id == f_team)
+
+    sort_column = request.args.get('sort', 'due_date')
+    sort_order = request.args.get('order', 'asc')
+    if sort_order not in ('asc', 'desc'):
+        sort_order = 'asc'
+
+    sort_map = {
+        'title': Objective.title,
+        'priority': Objective.priority,
+        'status': Objective.status,
+        'progress': Objective.progress,
+        'due_date': Objective.due_date,
+        'created_at': Objective.created_at,
+    }
+    sort_expr = sort_map.get(sort_column, Objective.due_date)
+    if sort_order == 'desc':
+        sort_expr = sort_expr.desc()
+    else:
+        sort_expr = sort_expr.asc()
+
+    objectives_page = paginate(base.order_by(sort_expr, Objective.id))
+
+    all_q = Objective.query
+    count_total = all_q.count()
+    count_kpi = all_q.filter(Objective.kpi_metric.isnot(None)).count()
+    count_templates = all_q.filter(Objective.is_template.is_(True)).count()
+    success_rate = 0.0
+    total_with_status = all_q.count()
+    if total_with_status > 0:
+        completed = all_q.filter(Objective.status == 'completed').count()
+        success_rate = round((completed / total_with_status) * 100, 1)
+
+    teams = OrgTeam.query.order_by(OrgTeam.name).all()
+    players = User.query.filter(User.role == 'player').order_by(User.username).all()
+    templates = Objective.query.filter_by(is_template=True).order_by(Objective.title).all()
+
+    return render_template(
+        'pages/objectives.html',
+        objectives=objectives_page,
+        pagination=objectives_page,
+        can_edit=can_edit,
+        tab=tab,
+        search=search,
+        f_status=f_status,
+        f_priority=f_priority,
+        f_type=f_type,
+        f_team=f_team,
+        sort_column=sort_column,
+        sort_order=sort_order,
+        count_total=count_total,
+        count_kpi=count_kpi,
+        count_templates=count_templates,
+        success_rate=success_rate,
+        objective_types=OBJECTIVE_TYPES,
+        objective_statuses=OBJECTIVE_STATUSES,
+        objective_priorities=OBJECTIVE_PRIORITIES,
+        objective_frequencies=OBJECTIVE_CHECK_FREQUENCIES,
+        teams=teams,
+        players=players,
+        templates=templates,
+    )
+
+
+# ---------------------------------------------------------------------------
+# Create
+# ---------------------------------------------------------------------------
+# New / Edit form page
+# ---------------------------------------------------------------------------
+# ---------------------------------------------------------------------------
+# View (player-facing detail page)
+# ---------------------------------------------------------------------------
+
+
+@objectives_bp.route('/<int:objective_id>')
+@login_required
+def view_objective(objective_id):
+    """Player-facing detail page for a specific objective."""
+    from app.permissions import can_view_objective as _can_view
+
+    objective = _resolve_objective(objective_id)
+    if not _can_view(current_user, objective):
+        flash(_('You do not have permission to view this objective.'), 'danger')
+        return redirect(url_for('objectives.list_objectives'))
+
+    can_edit = can_manage_objectives(current_user)
+    entries = (
+        ObjectiveEntry.query.filter_by(objective_id=objective.id)
+        .order_by(ObjectiveEntry.recorded_at)
+        .all()
+    )
+    comments = (
+        ObjectiveComment.query.filter_by(objective_id=objective.id)
+        .order_by(ObjectiveComment.created_at.desc())
+        .all()
+    )
+    personal_notes = []
+    if objective.player_id:
+        personal_notes = (
+            PersonalNote.query.filter_by(player_id=objective.player_id)
+            .order_by(PersonalNote.created_at.desc())
+            .limit(10)
+            .all()
+        )
+    team_notes = []
+    if objective.team_id:
+        team_notes = (
+            TeamNote.query.filter_by(org_team_id=objective.team_id)
+            .order_by(TeamNote.created_at.desc())
+            .limit(10)
+            .all()
+        )
+
+    return render_template(
+        'pages/objective_view.html',
+        objective=objective,
+        entries=entries,
+        comments=comments,
+        personal_notes=personal_notes,
+        team_notes=team_notes,
+        can_edit=can_edit,
+        objective_types=OBJECTIVE_TYPES,
+        objective_statuses=OBJECTIVE_STATUSES,
+        objective_priorities=OBJECTIVE_PRIORITIES,
+        objective_frequencies=OBJECTIVE_CHECK_FREQUENCIES,
+    )
+
+
+def _form_context():
+    """Shared context for the create/edit form page."""
+    teams = OrgTeam.query.order_by(OrgTeam.name).all()
+    players = User.query.filter(User.role == 'player').order_by(User.username).all()
+    templates = Objective.query.filter_by(is_template=True).order_by(Objective.title).all()
+    return {
+        'objective_types': OBJECTIVE_TYPES,
+        'objective_statuses': OBJECTIVE_STATUSES,
+        'objective_priorities': OBJECTIVE_PRIORITIES,
+        'objective_frequencies': OBJECTIVE_CHECK_FREQUENCIES,
+        'teams': teams,
+        'players': players,
+        'templates': templates,
+    }
+
+
+@objectives_bp.route('/new')
+@login_required
+def new_objective():
+    """Render the create-objective form page with preview."""
+    if not can_manage_objectives(current_user):
+        flash(_('You do not have permission to create objectives.'), 'danger')
+        return redirect(url_for('objectives.list_objectives'))
+
+    ctx = _form_context()
+    ctx['objective'] = None
+    ctx['edit_mode'] = False
+    ctx['entries'] = []
+    ctx['comments'] = []
+    ctx['personal_notes'] = []
+    ctx['team_notes'] = []
+    return render_template('pages/objective_form.html', **ctx)
+
+
+@objectives_bp.route('/<int:objective_id>/edit')
+@login_required
+def edit_objective(objective_id):
+    """Render the edit-objective form page with preview."""
+    objective = _resolve_objective(objective_id)
+    if not _can_edit(current_user, objective):
+        return redirect(url_for('objectives.list_objectives'))
+
+    ctx = _form_context()
+    ctx['objective'] = objective
+    ctx['edit_mode'] = True
+    ctx['entries'] = (
+        ObjectiveEntry.query.filter_by(objective_id=objective.id)
+        .order_by(ObjectiveEntry.recorded_at)
+        .all()
+    )
+    ctx['comments'] = (
+        ObjectiveComment.query.filter_by(objective_id=objective.id)
+        .order_by(ObjectiveComment.created_at.desc())
+        .all()
+    )
+    ctx['personal_notes'] = []
+    if objective.player_id:
+        ctx['personal_notes'] = (
+            PersonalNote.query.filter_by(player_id=objective.player_id)
+            .order_by(PersonalNote.created_at.desc())
+            .limit(10)
+            .all()
+        )
+    ctx['team_notes'] = []
+    if objective.team_id:
+        ctx['team_notes'] = (
+            TeamNote.query.filter_by(org_team_id=objective.team_id)
+            .order_by(TeamNote.created_at.desc())
+            .limit(10)
+            .all()
+        )
+    return render_template('pages/objective_form.html', **ctx)
+
+
+# ---------------------------------------------------------------------------
+
+
+@objectives_bp.route('/create', methods=['POST'])
+@login_required
+def create_objective():
+    """Create a new objective."""
+    if not can_manage_objectives(current_user):
+        flash(_('You do not have permission to create objectives.'), 'danger')
+        return redirect(url_for('objectives.list_objectives'))
+
+    try:
+        data = ObjectiveSchema().load(
+            form_payload(list_fields=(), optional_blank=('password', 'check_frequency'))
+        )
+    except ValidationError as err:
+        flash_validation_errors(err)
+        return redirect(url_for('objectives.list_objectives'))
+
+    objective = Objective(
+        title=data['title'],
+        description=data.get('description'),
+        type=data['type'],
+        status=data['status'],
+        priority=data['priority'],
+        category=data.get('category'),
+        is_template=data.get('is_template', False),
+        player_id=data.get('player_id'),
+        team_id=data.get('team_id'),
+        kpi_metric=data.get('kpi_metric'),
+        kpi_target=data.get('kpi_target'),
+        kpi_unit=data.get('kpi_unit'),
+        kpi_precision=data.get('kpi_precision'),
+        start_date=data.get('start_date'),
+        due_date=data['due_date'],
+        check_frequency=data.get('check_frequency') or None,
+        progress=data.get('progress', 0),
+        tags=data.get('tags'),
+        created_by=current_user.id,
+    )
+    db.session.add(objective)
+    db.session.commit()
+    flash(_('Objective created successfully.'), 'success')
+    return redirect(url_for('objectives.list_objectives'))
+
+
+# ---------------------------------------------------------------------------
+# Update
+# ---------------------------------------------------------------------------
+
+
+@objectives_bp.route('/<int:objective_id>/update', methods=['POST'])
+@login_required
+def update_objective(objective_id):
+    """Update an existing objective."""
+    objective = _resolve_objective(objective_id)
+    if not _can_edit(current_user, objective):
+        return redirect(url_for('objectives.list_objectives'))
+
+    try:
+        data = ObjectiveSchema().load(
+            form_payload(list_fields=(), optional_blank=('password', 'check_frequency')),
+            partial=('due_date',),
+        )
+    except ValidationError as err:
+        flash_validation_errors(err)
+        return redirect(url_for('objectives.list_objectives'))
+
+    for field in (
+        'title',
+        'description',
+        'type',
+        'status',
+        'priority',
+        'category',
+        'is_template',
+        'player_id',
+        'team_id',
+        'kpi_metric',
+        'kpi_unit',
+        'kpi_precision',
+        'check_frequency',
+        'progress',
+        'tags',
+    ):
+        val = data.get(field)
+        setattr(objective, field, val)
+    if 'kpi_target' in data:
+        objective.kpi_target = data['kpi_target']
+    if 'start_date' in data:
+        objective.start_date = data['start_date']
+    if 'due_date' in data:
+        objective.due_date = data['due_date']
+
+    db.session.commit()
+    flash(_('Objective updated successfully.'), 'success')
+    return redirect(url_for('objectives.list_objectives'))
+
+
+# ---------------------------------------------------------------------------
+# Delete
+# ---------------------------------------------------------------------------
+
+
+@objectives_bp.route('/<int:objective_id>/delete', methods=['POST'])
+@login_required
+def delete_objective(objective_id):
+    """Delete an objective."""
+    objective = _resolve_objective(objective_id)
+    if not _can_edit(current_user, objective):
+        return redirect(url_for('objectives.list_objectives'))
+
+    db.session.delete(objective)
+    db.session.commit()
+    flash(_('Objective deleted.'), 'success')
+    return redirect(url_for('objectives.list_objectives'))
+
+
+# ---------------------------------------------------------------------------
+# JSON data endpoint for the edit modal
+# ---------------------------------------------------------------------------
+
+
+@objectives_bp.route('/<int:objective_id>/data')
+@json_endpoint
+@login_required
+def objective_data(objective_id):
+    """Return objective details as JSON for the edit modal."""
+    from flask import jsonify
+
+    objective = _resolve_objective(objective_id)
+    return jsonify(
+        {
+            'id': objective.id,
+            'title': objective.title,
+            'description': objective.description,
+            'type': objective.type,
+            'status': objective.status,
+            'priority': objective.priority,
+            'category': objective.category,
+            'is_template': objective.is_template,
+            'player_id': objective.player_id,
+            'team_id': objective.team_id,
+            'kpi_metric': objective.kpi_metric,
+            'kpi_target': str(objective.kpi_target) if objective.kpi_target is not None else None,
+            'kpi_unit': objective.kpi_unit,
+            'kpi_precision': objective.kpi_precision,
+            'start_date': objective.start_date.isoformat() if objective.start_date else None,
+            'due_date': objective.due_date.isoformat() if objective.due_date else None,
+            'check_frequency': objective.check_frequency,
+            'progress': objective.progress,
+            'tags': objective.tags,
+        }
+    )
+
+
+# ---------------------------------------------------------------------------
+# Seed default templates (idempotent)
+# ---------------------------------------------------------------------------
+
+
+def seed_default_templates():
+    """Create the default Objective templates if they don't exist yet.
+
+    Idempotent — safe to call on every startup.
+    Skips if no admin user exists yet (first run seeding may not have run).
+    """
+    admin = User.query.filter(User.role == 'admin').first()
+    if not admin:
+        return
+
+    existing = {t.title for t in Objective.query.filter_by(is_template=True).all()}
+    for (
+        priority,
+        title,
+        description,
+        kpi_metric,
+        kpi_target,
+        kpi_unit,
+        typ,
+        category,
+    ) in DEFAULT_OBJECTIVE_TEMPLATES:
+        if title in existing:
+            continue
+        obj = Objective(
+            title=title,
+            description=description,
+            type=typ,
+            status='active',
+            priority=priority,
+            category=category,
+            is_template=True,
+            kpi_metric=kpi_metric,
+            kpi_target=kpi_target,
+            kpi_unit=kpi_unit,
+            progress=0,
+            due_date=datetime.date(2099, 12, 31),
+            created_by=admin.id,
+        )
+        db.session.add(obj)
+    db.session.commit()
+
+
+# ---------------------------------------------------------------------------
+# KPI Entries — measurements for the quantitative graph
+# ---------------------------------------------------------------------------
+
+
+@objectives_bp.route('/<int:objective_id>/entries', methods=['GET'])
+@login_required
+@json_endpoint
+def list_entries(objective_id):
+    """Return KPI entries for an objective as JSON."""
+    from flask import jsonify
+
+    objective = _resolve_objective(objective_id)
+    entries = (
+        ObjectiveEntry.query.filter_by(objective_id=objective.id)
+        .order_by(ObjectiveEntry.recorded_at)
+        .all()
+    )
+    return jsonify(
+        [
+            {
+                'id': e.id,
+                'value': str(e.value),
+                'recorded_at': e.recorded_at.isoformat(),
+                'note': e.note,
+            }
+            for e in entries
+        ]
+    )
+
+
+@objectives_bp.route('/<int:objective_id>/entries', methods=['POST'])
+@login_required
+def add_entry(objective_id):
+    """Record a KPI measurement for an objective.
+
+    Accepts an optional numeric value (for quantitative KPI tracking)
+    and an optional note.  If neither is provided the entry is rejected.
+    The assigned player may record entries on their own objectives.
+    """
+    from datetime import datetime
+
+    from app.permissions import can_add_objective_entry
+
+    objective = _resolve_objective(objective_id)
+    if not can_add_objective_entry(current_user, objective):
+        flash(_('You do not have permission to record entries for this objective.'), 'danger')
+        return redirect(url_for('objectives.list_objectives'))
+
+    raw_value = request.form.get('value', '').strip()
+    note = request.form.get('note', '').strip()
+    value = None
+    if raw_value:
+        try:
+            value = float(raw_value)
+        except (ValueError, TypeError):
+            flash(_('Invalid measurement value.'), 'danger')
+            return redirect(url_for('objectives.view_objective', objective_id=objective_id))
+
+    if value is None and not note:
+        flash(_('Provide a value, a note, or both.'), 'warning')
+        return redirect(url_for('objectives.view_objective', objective_id=objective_id))
+
+    entry = ObjectiveEntry(
+        objective_id=objective.id,
+        value=value,
+        recorded_at=datetime.now(),
+        note=note or None,
+        recorded_by=current_user.id,
+    )
+    db.session.add(entry)
+    db.session.commit()
+    flash(_('Measurement recorded.'), 'success')
+    return redirect(url_for('objectives.view_objective', objective_id=objective_id))
+    flash(_('Measurement recorded.'), 'success')
+    return redirect(url_for('objectives.edit_objective', objective_id=objective_id))
+
+
+# ---------------------------------------------------------------------------
+# Comments — coach feedback on an objective
+# ---------------------------------------------------------------------------
+
+
+@objectives_bp.route('/<int:objective_id>/comments', methods=['POST'])
+@login_required
+def add_comment(objective_id):
+    """Add a coach comment on an objective."""
+    objective = _resolve_objective(objective_id)
+    if not can_manage_objectives(current_user):
+        flash(_('You do not have permission to comment.'), 'danger')
+        return redirect(url_for('objectives.list_objectives'))
+
+    from app.validators import NoteContentSchema
+
+    try:
+        data = NoteContentSchema().load(form_payload(list_fields=()))
+    except ValidationError as err:
+        flash_validation_errors(err)
+        return redirect(url_for('objectives.edit_objective', objective_id=objective_id))
+
+    comment = ObjectiveComment(
+        objective_id=objective.id,
+        coach_id=current_user.id,
+        content=data['content'],
+    )
+    db.session.add(comment)
+    db.session.commit()
+    flash(_('Comment added.'), 'success')
+    return redirect(url_for('objectives.edit_objective', objective_id=objective_id))
+
+
+# ---------------------------------------------------------------------------
+# Trend / prediction data for the chart
+# ---------------------------------------------------------------------------
+
+
+@objectives_bp.route('/<int:objective_id>/trend')
+@login_required
+@json_endpoint
+def trend_data(objective_id):
+    """Return the trend + prediction data for an objective's chart."""
+    from flask import jsonify
+
+    from app.objectives_analytics import compute_trend
+
+    objective = _resolve_objective(objective_id)
+    entries = (
+        ObjectiveEntry.query.filter_by(objective_id=objective.id)
+        .order_by(ObjectiveEntry.recorded_at)
+        .all()
+    )
+    timestamps = [e.recorded_at for e in entries]
+    values = [float(e.value) for e in entries]
+    target = float(objective.kpi_target) if objective.kpi_target is not None else None
+
+    trend = compute_trend(timestamps, values, target)
+    return jsonify(trend)

app/routes/team_matches.py

@@ -20,6 +20,7 @@ from app.models import (
     TeamMatch,
     TeamMatchParticipant,
     TeamPlayer,
+    AppSettings,
 )
 from app.pagination import paginate
 from app.permissions import can_manage_org_team, coach_org_teams, visible_org_teams
@@ -40,6 +41,17 @@ def can_manage_team_match(team):
     return can_manage_org_team(current_user, team)
 
 
+def season_locked():
+    """Return True when the regular season is inactive for non-admins.
+
+    Admins bypass the lock. Coaches and managers may only schedule regular
+    season matches while the season is active.
+    """
+    if isinstance(current_user, Admin):
+        return False
+    return not AppSettings.get_bool('season_active', default=False)
+
+
 @team_matches_bp.route('')
 @login_required
 def list_matches():
@@ -108,6 +120,10 @@ def list_matches():
 def create_match(team_id):
     """Create a new regular-season team match."""
     team = db.get_or_404(OrgTeam, team_id)
+    if season_locked():
+        flash('The regular season is not active. Begin a season before scheduling matches.', 'warning')
+        return redirect(url_for('team_matches.list_matches'))
+
     if not can_manage_team_match(team):
         flash(_('You do not have permission to schedule matches for this team.'), 'danger')
         return redirect(url_for('team_matches.list_matches'))
@@ -260,9 +276,14 @@ def delete_match(match_id):
     """Delete a team match."""
     team_match = db.get_or_404(TeamMatch, match_id)
     team = team_match.org_team
+    if season_locked():
+        flash('The regular season is not active. Begin a season before deleting matches.', 'warning')
+        return redirect(url_for('team_matches.list_matches'))
+
     if not can_manage_team_match(team):
         flash(_('You do not have permission to delete this match.'), 'danger')
         return redirect(url_for('team_matches.list_matches'))
+
     db.session.delete(team_match)
     db.session.commit()
     flash(_('Match deleted successfully.'), 'success')

app/routes/tryouts.py

@@ -30,6 +30,7 @@ from app.models import (
     Tryout,
     TryoutRegistration,
     User,
+    AppSettings,
 )
 from app.time_utils import utc_now_naive
 from app.validators import (
@@ -49,9 +50,20 @@ def can_manage():
     return isinstance(current_user, (Admin, Manager))
 
 
+def tryouts_locked():
+    """Return True when tryouts are globally closed to coaches/managers.
+
+    Admins are always allowed to bypass the lock. Coaches and managers can
+    only make changes when the global tryout switch is open.
+    """
+    if isinstance(current_user, Admin):
+        return False
+    return not AppSettings.get_bool('tryouts_open', default=True)
+
+
 def tryout_form_payload():
     """The tryout form, shaped for marshmallow (ARCH-005)."""
-    return form_payload(list_fields=('coach_ids',), optional_blank=())
+    return form_payload(list_fields=('coach_ids', 'manager_ids'), optional_blank=())
 
 
 def coaches_from_ids(coach_ids):
@@ -67,6 +79,13 @@ def coaches_from_ids(coach_ids):
     return User.query.filter(User.id.in_(coach_ids), User.role == 'coach').all()
 
 
+def managers_from_ids(manager_ids):
+    """The manager accounts behind these ids, filtered by role."""
+    if not manager_ids:
+        return []
+    return User.query.filter(User.id.in_(manager_ids), User.role == 'manager').all()
+
+
 def _users_by_id(user_ids):
     """Load these users in one query, keyed by id.
 
@@ -120,6 +139,10 @@ def list_tryouts():
 @login_required
 def create_tryout():
     """Create a new tryout event. Requires Admin or Manager."""
+    if tryouts_locked():
+        flash('Tryouts are currently closed. An admin must open tryouts before changes can be made.', 'danger')
+        return redirect(url_for('tryouts.list_tryouts'))
+
     if not can_manage():
         flash(_('You do not have permission to create tryouts.'), 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
@@ -160,12 +183,12 @@ def create_tryout():
             created_by=current_user.id,
             status='upcoming',
             target_org_team_id=data['target_org_team_id'],
-            manager_id=data['manager_id'],
         )
         db.session.add(tryout)
         db.session.flush()
 
         tryout.coaches = coaches_from_ids(data['coach_ids'])
+        tryout.managers = managers_from_ids(data['manager_ids'])
 
         db.session.commit()
         flash(_('Tryout created successfully!'), 'success')
@@ -180,6 +203,10 @@ def edit_tryout(tryout_id):
     """Edit an existing tryout event. Permission based on can_manage_this_tryout."""
     tryout = db.get_or_404(Tryout, tryout_id)
 
+    if tryouts_locked():
+        flash('Tryouts are currently closed. An admin must open tryouts before changes can be made.', 'danger')
+        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout.id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('You do not have permission to edit this tryout.'), 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
@@ -221,8 +248,14 @@ def edit_tryout(tryout_id):
         tryout.location = data['location']
         tryout.max_players = data['max_players']
         tryout.target_org_team_id = data['target_org_team_id']
-        tryout.manager_id = data['manager_id']
+
-        tryout.coaches = coaches_from_ids(data['coach_ids'])
+        # Only update staff lists when the form explicitly sends them.
+        # An absent checkbox group (all unchecked or JS failed) means
+        # "don't change", not "remove everyone".
+        if 'coach_ids' in request.form:
+            tryout.coaches = coaches_from_ids(data['coach_ids'])
+        if 'manager_ids' in request.form:
+            tryout.managers = managers_from_ids(data['manager_ids'])
 
         db.session.commit()
         flash(_('Tryout updated successfully!'), 'success')
@@ -241,7 +274,7 @@ def view_tryout(tryout_id):
     if isinstance(current_user, Admin):
         can_view = True
     elif isinstance(current_user, Manager):
-        can_view = tryout.created_by == current_user.id or tryout.manager_id == current_user.id
+        can_view = current_user.can_manage_this_tryout(tryout)
     elif isinstance(current_user, Coach):
         can_view = current_user.can_manage_this_tryout(tryout)
     elif isinstance(current_user, Player):
@@ -466,6 +499,10 @@ def register_for_tryout(tryout_id):
 def update_status(tryout_id):
     """Update the status of a tryout."""
     tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash('Tryouts are currently closed. An admin must open tryouts before changes can be made.', 'danger')
+        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
@@ -486,6 +523,10 @@ def update_status(tryout_id):
 def update_registration_status(tryout_id, player_id):
     """Update a registration's attendance status."""
     tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash('Tryouts are currently closed. An admin must open tryouts before changes can be made.', 'danger')
+        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
@@ -510,6 +551,10 @@ def update_registration_status(tryout_id, player_id):
 def register_player(tryout_id):
     """Manually register a player for a tryout (by managers/coaches)."""
     tryout = locked_tryout_or_404(tryout_id)
+    if tryouts_locked():
+        flash('Tryouts are currently closed. An admin must open tryouts before changes can be made.', 'danger')
+        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
@@ -557,6 +602,10 @@ def register_player(tryout_id):
 def remove_player(tryout_id, player_id):
     """Remove a registered player from a tryout (cascades to teams/matches)."""
     tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash('Tryouts are currently closed. An admin must open tryouts before changes can be made.', 'danger')
+        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
@@ -593,6 +642,10 @@ def remove_player(tryout_id, player_id):
 def create_team(tryout_id):
     """Create a tryout-specific team."""
     tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash('Tryouts are currently closed. An admin must open tryouts before changes can be made.', 'danger')
+        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
@@ -616,6 +669,10 @@ def add_to_team(tryout_id, team_id):
     """Add a player to a tryout team."""
     team = db.get_or_404(Team, team_id)
     tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash('Tryouts are currently closed. An admin must open tryouts before changes can be made.', 'danger')
+        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
@@ -658,6 +715,10 @@ def add_to_team(tryout_id, team_id):
 def delete_tryout(tryout_id):
     """Delete a tryout and all associated data (matches, teams, registrations, evaluations)."""
     tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash('Tryouts are currently closed. An admin must open tryouts before changes can be made.', 'danger')
+        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('You do not have permission to delete this tryout.'), 'danger')
         return redirect(url_for('tryouts.list_tryouts'))

app/routes/users/_shared.py

@@ -39,6 +39,10 @@ def pdf_upload_error(file, allowed_extensions):
     could put an arbitrary file on the server under a name the application
     later hands back for download (SEC-021).
 
+    The check now goes beyond the header: it parses the upload with pypdf
+    and requires at least one parseable page, so a file with ``%PDF-``
+    prepended or a renamed non-PDF is rejected.
+
     Args:
         file: The uploaded FileStorage, or None.
         allowed_extensions: Extensions to accept, lowercase and without dot.
@@ -53,11 +57,27 @@ def pdf_upload_error(file, allowed_extensions):
     if not (stem and dot) or extension.lower() not in allowed_extensions:
         return _('Only PDF files are allowed for contracts.')
 
+    # Fast-fail: the PDF signature must appear at the start of the stream.
     head = file.stream.read(len(PDF_SIGNATURE))
     file.stream.seek(0)
     if head != PDF_SIGNATURE:
         return _('That file is not a PDF, whatever its name says.')
 
+    # Full-content validation: parse with pypdf and require at least one
+    # page.  A file with a forged header but no real PDF structure (e.g. a
+    # renamed executable with ``%PDF-`` prepended) will fail here.
+    try:
+        from pypdf import PdfReader
+        from pypdf.errors import PyPdfError
+
+        reader = PdfReader(file.stream, strict=False)
+        if len(reader.pages) == 0:
+            return _('That file is not a PDF, whatever its name says.')
+    except (PyPdfError, ValueError, TypeError):
+        return _('That file is not a PDF, whatever its name says.')
+    finally:
+        file.stream.seek(0)
+
     return None
 
 

app/routes/users/accounts.py

@@ -44,6 +44,7 @@ from app.routes.users._shared import (
 )
 from app.routes.users.blueprint import users_bp
 from app.storage import discard_documents
+from app.timeslots import total_hours
 from app.validators import CreateUserSchema, EditUserSchema
 
 
@@ -59,7 +60,39 @@ def list_users():
     # query without a stable ORDER BY can show the same row twice and never
     # show another (MNT-14).
     page = paginate(User.query.order_by(User.role, User.username, User.id))
-    return render_template('pages/users.html', users=page.items, pagination=page, roles=USER_TYPES)
+
+    # Build a per-user hours map for the current page with two bounded
+    # queries (one per availability table), avoiding an N+1 per row.
+    user_ids = [u.id for u in page.items]
+    hours_by_user: dict[int, float] = {}
+
+    for slots, fk in [
+        (
+            PlayerDisponibility.query.filter(
+                PlayerDisponibility.player_id.in_(user_ids),
+            ).all(),
+            'player_id',
+        ),
+        (
+            CoachAvailability.query.filter(
+                CoachAvailability.coach_id.in_(user_ids),
+            ).all(),
+            'coach_id',
+        ),
+    ]:
+        buckets: dict[int, list] = {}
+        for slot in slots:
+            buckets.setdefault(getattr(slot, fk), []).append(slot)
+        for uid, group in buckets.items():
+            hours_by_user[uid] = total_hours(group)
+
+    return render_template(
+        'pages/users.html',
+        users=page.items,
+        pagination=page,
+        roles=USER_TYPES,
+        hours=hours_by_user,
+    )
 
 
 @users_bp.route('/<int:user_id>/edit', methods=['GET', 'POST'])
@@ -380,4 +413,19 @@ def create_user():
 def view_user(user_id):
     """View a public profile for any user."""
     user = db.get_or_404(User, user_id)
-    return render_template('pages/view_user.html', profile_user=user)
+
+    # Load availability for players and coaches so the public profile
+    # can render a read-only weekly grid.
+    availability = None
+    if user.role == 'player':
+        availability = user.disponibilities
+    elif user.role == 'coach':
+        availability = user.coach_availabilities
+    availability_hours = total_hours(availability) if availability else None
+
+    return render_template(
+        'pages/view_user.html',
+        profile_user=user,
+        availability=availability,
+        availability_hours=availability_hours,
+    )

app/routes/users/availability.py

@@ -5,8 +5,7 @@ weekly availability blocks, and a coach's bookable slots for one-on-one
 sessions.
 """
 
-from flask import flash, jsonify, redirect, render_template, request, url_for
+from flask import jsonify, request
-from flask_babel import gettext as _
 from flask_login import current_user, login_required
 from marshmallow import ValidationError
 
@@ -201,60 +200,50 @@ def delete_disponibility(disponibility_id):
     return jsonify({'success': True})
 
 
-@users_bp.route('/coach-availability', methods=['GET', 'POST'])
+@users_bp.route('/coach-availability', methods=['POST'])
 @json_endpoint
 @login_required
 def manage_coach_availability():
     """Manage coach availability for One on One sessions."""
     if not isinstance(current_user, Coach):
-        flash(_('Only coaches can manage availability.'), 'danger')
+        return jsonify({'error': 'Unauthorized'}), 403
-        return redirect(url_for('main.dashboard'))
 
-    if request.method == 'POST':
+    data = request.get_json(silent=True) or {}
-        data = request.get_json(silent=True) or {}
+    accepted, rejected = _load_slots(data.get('slots'))
-        accepted, rejected = _load_slots(data.get('slots'))
 
-        # Validate everything before deleting anything.
+    # Validate everything before deleting anything.
-        #
+    #
-        # This route replaces the coach's availability: it deleted every
+    # This route replaces the coach's availability: it deleted every
-        # existing slot and then re-added the ones it could parse, skipping
+    # existing slot and then re-added the ones it could parse, skipping
-        # the rest in silence and answering `{'success': true}`. A payload
+    # the rest in silence and answering `{'success': true}`. A payload
-        # the browser mangled therefore wiped a coach's bookable hours and
+    # the browser mangled therefore wiped a coach's bookable hours and
-        # reported success — and one-on-one requests are refused against
+    # reported success — and one-on-one requests are refused against
-        # exactly this table, so the coach became unbookable with nothing to
+    # exactly this table, so the coach became unbookable with nothing to
-        # show for it. Refusing the whole batch is the only safe answer when
+    # show for it. Refusing the whole batch is the only safe answer when
-        # the operation is a replacement (MNT-12).
+    # the operation is a replacement (MNT-12).
-        if rejected:
+    if rejected:
-            return jsonify(
+        return jsonify(
-                {
+            {
-                    'error': 'Invalid slots; nothing was changed.',
+                'error': 'Invalid slots; nothing was changed.',
-                    'rejected': rejected,
+                'rejected': rejected,
-                }
+            }
-            ), 400
+        ), 400
 
-        CoachAvailability.query.filter_by(coach_id=current_user.id).delete()
+    CoachAvailability.query.filter_by(coach_id=current_user.id).delete()
 
-        for slot in accepted:
+    for slot in accepted:
-            start_time = slot['start_time']
+        start_time = slot['start_time']
-            db.session.add(
+        db.session.add(
-                CoachAvailability(
+            CoachAvailability(
-                    coach_id=current_user.id,
+                coach_id=current_user.id,
-                    day_of_week=slot['day_of_week'],
+                day_of_week=slot['day_of_week'],
-                    start_time=start_time,
+                start_time=start_time,
-                    end_time=slot_end(start_time),
+                end_time=slot_end(start_time),
-                )
             )
+        )
 
-        db.session.commit()
+    db.session.commit()
-        return jsonify({'success': True, 'saved': len(accepted)})
+    return jsonify({'success': True, 'saved': len(accepted)})
-
-    existing_availability = CoachAvailability.query.filter_by(
-        coach_id=current_user.id,
-    ).all()
-
-    return render_template(
-        'pages/coach_availability.html', existing_availability=existing_availability
-    )
 
 
 @users_bp.route('/coach-availability/clear', methods=['POST'])

app/routes/users/contracts.py

@@ -11,6 +11,7 @@ from werkzeug.utils import secure_filename
 
 from app.extensions import db
 from app.models import Admin, Coach, Contract, Manager, Player, User
+from app.models.admin_settings import AppSettings
 from app.permissions import can_manage_player_contract, coach_player_ids
 from app.routes.users._shared import (
     ALLOWED_CONTRACT_EXTENSIONS,
@@ -18,7 +19,13 @@ from app.routes.users._shared import (
     pdf_upload_error,
 )
 from app.routes.users.blueprint import users_bp
-from app.storage import CONTRACTS_DIR, document_path
+from app.storage import (
+    CONTRACTS_DIR,
+    GoogleDriveStorageError,
+    is_google_drive_path,
+    open_document,
+    store_uploaded_document,
+)
 from app.time_utils import utc_now_naive
 from app.validators import UploadContractSchema
 
@@ -43,6 +50,17 @@ def manageable_players():
     return User.query.filter_by(role='player', is_active_account=True).order_by(User.username).all()
 
 
+def document_uploads_locked():
+    """Return True when document uploads are globally disabled.
+
+    Admins are always allowed to bypass the lock. Managers, coaches, and
+    players are blocked when the toggle is off.
+    """
+    if isinstance(current_user, Admin):
+        return False
+    return not AppSettings.get_bool('document_uploads_enabled', default=True)
+
+
 @users_bp.route('/contracts')
 @login_required
 def list_contracts():
@@ -86,6 +104,10 @@ def upload_contract():
         flash(_('Only presidents, managers, and coaches can upload contracts.'), 'danger')
         return redirect(url_for('users.list_contracts'))
 
+    if document_uploads_locked():
+        flash(_('Document uploads are currently disabled.'), 'danger')
+        return redirect(url_for('users.list_contracts'))
+
     players = manageable_players()
 
     if request.method == 'POST':
@@ -126,9 +148,13 @@ def upload_contract():
         if team:
             relative_path = os.path.join(CONTRACTS_DIR, secure_filename(team.name), stored_filename)
 
-        absolute_path = document_path(relative_path)
+        try:
-        os.makedirs(os.path.dirname(absolute_path), exist_ok=True)
+            stored_path = store_uploaded_document(file, relative_path)
-        file.save(absolute_path)
+        except GoogleDriveStorageError:
+            flash(
+                _('Contract storage is temporarily unavailable. Please try again later.'), 'danger'
+            )
+            return redirect(url_for('users.upload_contract'))
 
         contract = Contract(
             player_id=player_id,
@@ -136,7 +162,7 @@ def upload_contract():
             uploaded_by_id=current_user.id,
             original_filename=original_filename,
             stored_filename=stored_filename,
-            file_path=relative_path,
+            file_path=stored_path,
             notes=notes if notes else None,
         )
         db.session.add(contract)
@@ -159,6 +185,10 @@ def upload_signed_contract(contract_id):
         flash(_('Only the player can upload their signed contract.'), 'danger')
         return redirect(url_for('users.list_contracts'))
 
+    if document_uploads_locked():
+        flash(_('Document uploads are currently disabled.'), 'danger')
+        return redirect(url_for('users.list_contracts'))
+
     file = request.files.get('signed_file')
     error = pdf_upload_error(file, ALLOWED_SIGNED_EXTENSIONS)
     if error:
@@ -166,11 +196,22 @@ def upload_signed_contract(contract_id):
         return redirect(url_for('users.list_contracts'))
 
     signed_filename = f"signed_{contract.stored_filename}"
-    signed_path = contract.file_path.replace(contract.stored_filename, signed_filename)
+    # Legacy local records keep their signed copy beside the original. Drive
-    file.save(document_path(signed_path))
+    # identifiers are opaque rather than filenames, so new Drive records use
+    # a fresh logical path and receive a second Drive ID.
+    signed_path = (
+        os.path.join(CONTRACTS_DIR, signed_filename)
+        if is_google_drive_path(contract.file_path)
+        else contract.file_path.replace(contract.stored_filename, signed_filename)
+    )
+    try:
+        stored_signed_path = store_uploaded_document(file, signed_path)
+    except GoogleDriveStorageError:
+        flash(_('Contract storage is temporarily unavailable. Please try again later.'), 'danger')
+        return redirect(url_for('users.list_contracts'))
 
     contract.signed_filename = signed_filename
-    contract.signed_file_path = signed_path
+    contract.signed_file_path = stored_signed_path
     contract.status = 'signed'
     contract.signed_at = utc_now_naive()
     db.session.commit()
@@ -186,11 +227,12 @@ def download_contract(contract_id):
     if not contract.can_view(current_user):
         flash(_('You do not have permission to download this contract.'), 'danger')
         return redirect(url_for('users.list_contracts'))
-    return send_file(
+    try:
-        document_path(contract.file_path),
+        document = open_document(contract.file_path)
-        as_attachment=True,
+    except GoogleDriveStorageError:
-        download_name=contract.original_filename,
+        flash(_('Contract storage is temporarily unavailable. Please try again later.'), 'danger')
-    )
+        return redirect(url_for('users.list_contracts'))
+    return send_file(document, as_attachment=True, download_name=contract.original_filename)
 
 
 @users_bp.route('/contracts/<int:contract_id>/download_signed')
@@ -204,8 +246,9 @@ def download_signed_contract(contract_id):
     if not contract.signed_file_path:
         flash(_('No signed contract available.'), 'danger')
         return redirect(url_for('users.list_contracts'))
-    return send_file(
+    try:
-        document_path(contract.signed_file_path),
+        document = open_document(contract.signed_file_path)
-        as_attachment=True,
+    except GoogleDriveStorageError:
-        download_name=contract.signed_filename,
+        flash(_('Contract storage is temporarily unavailable. Please try again later.'), 'danger')
-    )
+        return redirect(url_for('users.list_contracts'))
+    return send_file(document, as_attachment=True, download_name=contract.signed_filename)

app/static/css/style.css

@@ -1256,6 +1256,64 @@ a:hover { color: var(--primary-dark); }
     color: white !important;
     border-color: #4f46e5 !important;
 }
+/* Read-only weekly availability grid (public profile) */
+.readonly-availability-grid {
+    display: grid;
+    grid-template-columns: repeat(7, 1fr);
+    gap: 8px;
+    margin-top: 8px;
+}
+
+.ra-day-column {
+    background: var(--bg-secondary);
+    border-radius: 8px;
+    padding: 8px;
+    min-height: 120px;
+}
+
+.ra-day-header {
+    text-align: center;
+    font-weight: 600;
+    padding: 6px 0;
+    border-bottom: 1px solid var(--border-color);
+    margin-bottom: 6px;
+    color: var(--primary);
+    font-size: 0.85rem;
+}
+
+.ra-slot {
+    padding: 4px 6px;
+    margin: 3px 0;
+    border-radius: 4px;
+    font-size: 0.75rem;
+    text-align: center;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-color);
+}
+
+.ra-slot.selected {
+    background: var(--primary);
+    color: white;
+    border-color: var(--primary-dark);
+}
+
+.ra-slot.ra-empty {
+    color: var(--gray-400);
+    border: 1px dashed var(--gray-300);
+    background: transparent;
+}
+
+@media (max-width: 768px) {
+    .readonly-availability-grid {
+        grid-template-columns: repeat(3, 1fr);
+    }
+}
+
+@media (max-width: 480px) {
+    .readonly-availability-grid {
+        grid-template-columns: 1fr;
+    }
+}
 
 .merged-disponibility-time-block.high-availability {
     background: var(--success);
@@ -1730,6 +1788,296 @@ a:hover { color: var(--primary-dark); }
     box-shadow: var(--shadow-md);
 }
 
+/* ------------------------------------------------------------------- */
+/* Player Evolution — Objective Management                             */
+/* ------------------------------------------------------------------- */
+
+/* Wider variant for the create/edit modal with five sections */
+.modal-lg .modal-content {
+    max-width: 720px;
+}
+
+/* Section grouping inside the form */
+.form-section {
+    margin-bottom: 20px;
+    padding-bottom: 16px;
+    border-bottom: 1px solid var(--gray-200);
+}
+
+.form-section:last-child {
+    border-bottom: none;
+    margin-bottom: 0;
+}
+
+.form-section h4 {
+    font-size: 0.95rem;
+    color: var(--primary);
+    margin-bottom: 12px;
+    display: flex;
+    align-items: center;
+    gap: 6px;
+}
+
+/* Toolbar (tabs + search/filter bar) */
+.objectives-toolbar {
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+}
+
+.objectives-tabs {
+    display: flex;
+    gap: 4px;
+    border-bottom: 2px solid var(--gray-200);
+    padding-bottom: 4px;
+}
+
+.tab-link {
+    padding: 6px 16px;
+    font-size: 0.9rem;
+    color: var(--gray-500);
+    text-decoration: none;
+    border-radius: var(--radius) var(--radius) 0 0;
+    transition: all 0.2s;
+    border: none;
+    background: transparent;
+    cursor: pointer;
+}
+
+.tab-link:hover {
+    color: var(--primary);
+    background: var(--gray-100);
+}
+
+.tab-link.active {
+    color: var(--primary);
+    font-weight: 600;
+    border-bottom: 2px solid var(--primary);
+    margin-bottom: -5px;
+}
+
+.objectives-search-bar {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+    align-items: center;
+}
+
+.objectives-search-bar .form-inline {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+    width: 100%;
+    align-items: flex-end;
+}
+
+/* Tag badges inside objective cells */
+.objective-tags {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 4px;
+    margin-top: 4px;
+}
+
+.objective-tags .badge {
+    font-size: 0.7rem;
+    padding: 2px 6px;
+}
+
+/* Progress bar in the table */
+.progress-bar-container {
+    width: 80px;
+    height: 6px;
+    background: var(--gray-200);
+    border-radius: 3px;
+    overflow: hidden;
+    display: inline-block;
+    vertical-align: middle;
+}
+
+.progress-bar {
+    height: 100%;
+    background: linear-gradient(90deg, var(--danger), var(--warning), var(--success));
+    border-radius: 3px;
+    transition: width 0.3s ease;
+}
+
+/* Score-input range mirror (reused from evaluation forms) */
+.score-input {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+}
+
+.score-input input[type="range"] {
+    flex: 1;
+}
+
+.range-value {
+    font-weight: 600;
+    font-size: 1rem;
+/* ------------------------------------------------------------------- */
+/* Objective Form — two-column editor layout                           */
+/* ------------------------------------------------------------------- */
+.objective-editor {
+    display: grid;
+    grid-template-columns: 1fr 360px;
+    gap: 20px;
+    align-items: start;
+}
+
+.objective-editor-form .card-body {
+    max-height: 80vh;
+    overflow-y: auto;
+}
+
+.objective-editor-preview {
+    position: sticky;
+    top: 20px;
+}
+
+/* Preview card stats */
+.preview-stats {
+    margin: 12px 0;
+}
+
+.preview-stat {
+    display: flex;
+    justify-content: space-between;
+    padding: 4px 0;
+    border-bottom: 1px solid var(--gray-100);
+    font-size: 0.85rem;
+}
+
+.preview-label {
+    color: var(--gray-500);
+}
+
+.preview-value {
+    font-weight: 600;
+    color: var(--gray-800);
+}
+
+.progress-section {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    margin-top: 8px;
+}
+
+.progress-section .progress-bar-container {
+    flex: 1;
+}
+
+/* Template list items */
+.template-item {
+    padding: 10px;
+    margin-bottom: 8px;
+    border: 1px solid var(--gray-200);
+    border-radius: var(--radius);
+    transition: border-color 0.2s;
+}
+
+.template-item:hover {
+    border-color: var(--primary);
+}
+
+.template-item h5 {
+    margin: 0 0 4px 0;
+    font-size: 0.9rem;
+}
+
+.template-item p {
+    margin: 0 0 8px 0;
+    font-size: 0.8rem;
+}
+
+/* ------------------------------------------------------------------- */
+/* Objective form — comments, entries, prediction info                 */
+/* ------------------------------------------------------------------- */
+
+.comments-list {
+    max-height: 300px;
+    overflow-y: auto;
+}
+
+.comment-item {
+    padding: 8px 0;
+    border-bottom: 1px solid var(--gray-100);
+}
+
+.comment-item:last-child {
+    border-bottom: none;
+}
+
+.comment-item p {
+    margin: 4px 0 0 0;
+    font-size: 0.85rem;
+    line-height: 1.4;
+}
+
+#predictionInfo {
+    font-size: 0.85rem;
+    padding: 8px;
+    background: var(--gray-50);
+    border-radius: var(--radius);
+}
+
+#predictionInfo .confidence-high { color: var(--success); }
+#predictionInfo .confidence-medium { color: var(--warning); }
+#predictionInfo .confidence-low { color: var(--danger); }
+
+/* Form-inline for measurement entry */
+.form-inline {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+    align-items: flex-end;
+}
+
+.form-inline .form-group {
+    margin-bottom: 0;
+}
+
+/* Hide template/team fields initially */
+#playerField, #teamField {
+    transition: opacity 0.2s;
+}
+/* Chart sizing */
+#progressChart {
+    background: transparent;
+}
+
+/* Responsive: stack on small screens */
+@media (max-width: 900px) {
+    .objective-editor {
+        grid-template-columns: 1fr;
+    }
+    .objective-editor-preview {
+        position: static;
+    }
+}
+    min-width: 24px;
+    text-align: center;
+    color: var(--primary);
+}
+
+/* Actions cell in table */
+.actions-cell {
+    white-space: nowrap;
+    display: flex;
+    gap: 4px;
+}
+
+/* Required field indicator */
+.required {
+    color: var(--danger);
+}
+
+/* Reused stat card col-4 / col-6 helpers */
+.col-4 { flex: 0 0 calc(33.333% - 12px); }
+.col-6 { flex: 0 0 calc(50% - 12px); }
+.col-12 { flex: 0 0 100%; }
 .card-header .drag-handle {
     margin-left: auto;
     margin-right: 0;

app/static/js/main.js

@@ -530,13 +530,31 @@ document.addEventListener('change', function (event) {
  * Confirmation before a destructive submit.
  *
  *     <form data-confirm="Delete this match?">
+ *     <form data-confirm-input="confirm" data-confirm-value="DELETE"
+ *           data-confirm-input-message="Type DELETE to continue."
+ *           data-confirm="Delete this record?">
  *
  * Replaces onsubmit="return confirm(...)", and keeps the wording in the
  * markup where it can be translated.
  */
 document.addEventListener('submit', function (event) {
     const form = event.target.closest('[data-confirm]');
-    if (form && !window.confirm(form.getAttribute('data-confirm'))) {
+    if (!form) {
+        return;
+    }
+
+    const inputName = form.getAttribute('data-confirm-input');
+    if (inputName) {
+        const input = form.elements.namedItem(inputName);
+        const expectedValue = form.getAttribute('data-confirm-value') || '';
+        if (!input || input.value.trim() !== expectedValue) {
+            window.alert(form.getAttribute('data-confirm-input-message') || 'Confirmation is required.');
+            event.preventDefault();
+            return;
+        }
+    }
+
+    if (!window.confirm(form.getAttribute('data-confirm'))) {
         event.preventDefault();
     }
 });

app/storage.py

@@ -28,8 +28,23 @@ absolute path and are returned untouched, so this change needs no data
 migration and can ship before Alembic does (DB-002).
 """
 
+import io
+import logging
 import os
 
+from app.google_drive import (
+    GoogleDriveStorageError,
+)
+from app.google_drive import (
+    delete_file as delete_google_drive_file,
+)
+from app.google_drive import (
+    download_file as download_google_drive_file,
+)
+from app.google_drive import (
+    upload_file as upload_google_drive_file,
+)
+
 #: Environment override for the document root. What a release-directory
 #: deployment sets, to a path outside the releases — alongside them, not
 #: inside whichever one is current.
@@ -45,6 +60,16 @@ BACKUP_DIR_ENV = 'BACKUP_DIR'
 #: Sub-directory holding uploaded contracts, under the document root.
 CONTRACTS_DIR = 'contrats signés'
 
+#: Database marker for documents stored remotely. Existing rows continue to
+#: hold relative or absolute filesystem paths, so switching storage does not
+#: invalidate contracts already uploaded before the Google Drive move.
+GOOGLE_DRIVE_PATH_PREFIX = 'gdrive://'
+
+#: Storage backends deliberately stay explicit. Google Drive is the
+#: production default; local disk exists only for legacy rows and isolated
+#: test/development environments.
+DOCUMENT_STORAGE_BACKEND_ENV = 'DOCUMENT_STORAGE_BACKEND'
+
 
 def project_root():
     """Absolute path of the project, derived from this file's location.
@@ -91,6 +116,56 @@ def _rooted(env_name, default_name):
     return os.path.join(project_root(), default_name)
 
 
+def document_storage_backend():
+    """Return the configured backend for new document uploads."""
+    backend = os.getenv(DOCUMENT_STORAGE_BACKEND_ENV, 'local').strip().lower()
+    if backend not in {'google_drive', 'local'}:
+        raise ValueError(
+            f'{DOCUMENT_STORAGE_BACKEND_ENV} must be "google_drive" or "local", not {backend!r}'
+        )
+    return backend
+
+
+def is_google_drive_path(stored_path):
+    """Whether a database path references a Google Drive file."""
+    return bool(stored_path and stored_path.startswith(GOOGLE_DRIVE_PATH_PREFIX))
+
+
+def _google_drive_id(stored_path):
+    file_id = stored_path.removeprefix(GOOGLE_DRIVE_PATH_PREFIX)
+    if not file_id:
+        raise GoogleDriveStorageError('The stored Google Drive file identifier is empty.')
+    return file_id
+
+
+def store_uploaded_document(file_storage, relative_path):
+    """Store an uploaded document and return its durable database reference.
+
+    Local storage retains the relative-path format used by existing rows. A
+    Google Drive upload returns an opaque Drive file identifier prefixed with
+    ``gdrive://`` so it cannot be mistaken for a filesystem path.
+    """
+    if document_storage_backend() == 'local':
+        absolute_path = document_path(relative_path)
+        os.makedirs(os.path.dirname(absolute_path), exist_ok=True)
+        file_storage.save(absolute_path)
+        return relative_path
+
+    file_id = upload_google_drive_file(
+        stream=file_storage.stream,
+        filename=os.path.basename(relative_path),
+        mimetype=file_storage.mimetype or 'application/pdf',
+    )
+    return f'{GOOGLE_DRIVE_PATH_PREFIX}{file_id}'
+
+
+def open_document(stored_path):
+    """Return a filesystem path or in-memory stream suitable for ``send_file``."""
+    if is_google_drive_path(stored_path):
+        return io.BytesIO(download_google_drive_file(_google_drive_id(stored_path)))
+    return document_path(stored_path)
+
+
 def discard_documents(stored_paths):
     """Remove these documents from disk. Returns how many went (DATA-012).
 
@@ -107,27 +182,27 @@ def discard_documents(stored_paths):
     A path that cannot be removed is logged and skipped. Nothing here should
     be able to abort the deletion of an account.
     """
-    import logging
-
     logger = logging.getLogger(__name__)
     removed = 0
     for stored_path in stored_paths:
         if not stored_path:
             continue
-        target = document_path(stored_path)
         try:
-            os.remove(target)
+            if is_google_drive_path(stored_path):
+                delete_google_drive_file(_google_drive_id(stored_path))
+            else:
+                os.remove(document_path(stored_path))
             removed += 1
         except FileNotFoundError:
             # Already gone. Two contracts sharing a stem, or a previous
             # attempt: not a problem, and not worth an error line.
-            logger.info('Document already absent: %s', target)
+            logger.info('Document already absent: %s', stored_path)
-        except OSError as exc:
+        except (GoogleDriveStorageError, OSError) as exc:
             logger.error(
                 'Could not remove %s (%s). It is now an orphan: no database row '
                 'refers to it, so nothing in the application will ever offer to '
                 'delete it again.',
-                target,
+                stored_path,
                 exc,
             )
     return removed

app/supporting_scripts/backup.py

@@ -42,7 +42,11 @@ from urllib.parse import unquote, urlparse
 # to be — see DOCUMENTS_DIR below.
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
 
-from app.storage import backups_root, documents_root  # noqa: E402 — needs the path above
+from app.storage import (  # noqa: E402 — needs the path above
+    backups_root,
+    document_storage_backend,
+    documents_root,
+)
 
 # Configuration
 BACKUP_DIR = backups_root()
@@ -292,6 +296,75 @@ def backup_documents():
     return zip_path
 
 
+def backup_drive_documents():
+    """Download every file from the configured Google Drive folder and archive it.
+
+    Called **in addition to** ``backup_documents()`` when the storage backend is
+    ``google_drive``.  When the backend is ``local`` this function silently
+    skips — local backups already handled by ``backup_documents()``.
+
+    Returns:
+        str | None: Path to the created archive, or None when skipped.
+
+    Raises:
+        BackupError: If Drive is configured but listing or downloading fails.
+    """
+    if document_storage_backend() != 'google_drive':
+        print('[SKIP] Google Drive is not configured; local documents only.')
+        return None
+
+    try:
+        from app.google_drive import (
+            GoogleDriveStorageError,
+            list_folder_files,
+        )
+        from app.google_drive import (
+            download_file as download_drive_file,
+        )
+    except ImportError:
+        raise BackupError(
+            'Google Drive dependencies are not installed. Install requirements.txt again.'
+        ) from None
+
+    print('[INFO] Listing Google Drive contract folder...')
+    try:
+        files = list_folder_files()
+    except (GoogleDriveStorageError, Exception) as exc:  # noqa: BLE001 — boundary
+        raise BackupError(f'Google Drive listing failed: {exc}') from exc
+
+    if not files:
+        print('[INFO] Google Drive folder is empty; no Drive documents to back up.')
+        return None
+
+    timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
+    archive_basename = os.path.join(BACKUP_DIR, f'documents_backup_drive_{timestamp}')
+
+    download = {}
+    for file_id, name in files:
+        print(f'  Downloading {name} ({file_id})...')
+        try:
+            download[name] = download_drive_file(file_id)
+        except (GoogleDriveStorageError, Exception) as exc:  # noqa: BLE001 — boundary
+            raise BackupError(f'Google Drive download failed for {name}: {exc}') from exc
+
+    try:
+        import zipfile
+
+        zip_path = f'{archive_basename}.zip'
+        with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:
+            for name, data in download.items():
+                zf.writestr(name, data)
+    except Exception as exc:  # noqa: BLE001 — boundary
+        raise BackupError(f'Drive document archive failed: {exc}') from exc
+
+    if not os.path.exists(zip_path) or os.path.getsize(zip_path) == 0:
+        raise BackupError('Drive document archiver reported success but produced an empty file.')
+
+    size_mb = os.path.getsize(zip_path) / (1024 * 1024)
+    print(f'[OK] Drive documents backed up to: {zip_path} ({size_mb:.1f} MB)')
+    return zip_path
+
+
 def cleanup_old_backups():
     """Remove backup files older than BACKUP_RETENTION_DAYS."""
     if not os.path.exists(BACKUP_DIR):
@@ -365,10 +438,16 @@ def main(argv=None):
     except BackupError as exc:
         documents_ok = False
         print(f'[ERROR] {exc}')
+    drive_ok = True
+    try:
+        backup_drive_documents()
+    except BackupError as exc:
+        drive_ok = False
+        print(f'[ERROR] {exc}')
     cleanup_old_backups()
 
     print()
-    if verified and documents_ok:
+    if verified and documents_ok and drive_ok:
         print('=== Backup completed successfully ===')
         return 0
 

app/supporting_scripts/get_refresh_token.py

@@ -0,0 +1,121 @@
+"""Obtain a Google Drive refresh token for the application.
+
+Run this once from a development machine that has a browser. It opens a local
+OAuth redirect server, asks you to log in, and prints the refresh token.
+
+Usage:
+    python app/supporting_scripts/get_refresh_token.py
+
+Requires:
+    pip install google-auth-oauthlib
+
+Before running:
+    1. Create a Google Cloud project and enable the Drive API.
+    2. Create a **Desktop** OAuth 2.0 client ID.
+    3. Add your email as a test user in the OAuth consent screen.
+    4. Run this script and paste the values when prompted.
+"""
+
+import os
+import sys
+
+
+def _prompt(label, env_name, default=""):
+    """Ask the user for a value, accepting an env-var fallback or a default."""
+    candidate = os.getenv(env_name) or default
+    hint = f" [{candidate}]" if candidate else ""
+    raw = input(f"{label}{hint}: ").strip()
+    if raw:
+        return raw
+    if candidate:
+        return candidate
+    return default
+
+
+def _validate_client_id(client_id):
+    """Warn if the client ID doesn't look like a real OAuth client ID."""
+    if client_id == "YOUR_CLIENT_ID.apps.googleusercontent.com":
+        print("[ERROR] You must provide a real client ID from the Google Cloud console.")
+        return False
+    if not client_id.endswith(".apps.googleusercontent.com"):
+        print(
+            f"[WARNING] Client ID should end with '.apps.googleusercontent.com'.\n"
+            f"          Got: {client_id!r}\n"
+            f"          If this is a placeholder, the OAuth request will fail.\n"
+        )
+    return True
+
+
+def _validate_client_secret(secret):
+    if secret == "YOUR_CLIENT_SECRET":
+        print("[ERROR] You must provide a real client secret from the Google Cloud console.")
+        return False
+    # The GOCSPX- prefix is now used by every client type, so it no longer
+    # tells us anything about whether the client was created as a Desktop app.
+    return True
+
+
+def main():
+    print("=" * 60)
+    print("Google Drive Refresh Token — Setup")
+    print("=" * 60)
+    print()
+
+    # When both env vars are set, skip prompts entirely for headless runs.
+    env_id = os.getenv("GOOGLE_DRIVE_CLIENT_ID")
+    env_secret = os.getenv("GOOGLE_DRIVE_CLIENT_SECRET")
+    if env_id and env_secret:
+        client_id = env_id
+        client_secret = env_secret
+        print(f"Using Client ID from environment: {client_id[:30]}...")
+    else:
+        print("Enter your Google Cloud OAuth credentials.")
+        print("You can also set GOOGLE_DRIVE_CLIENT_ID and GOOGLE_DRIVE_CLIENT_SECRET")
+        print("environment variables and re-run to skip the prompts.")
+        print()
+
+        client_id = _prompt("Client ID", "GOOGLE_DRIVE_CLIENT_ID")
+        client_secret = _prompt("Client Secret", "GOOGLE_DRIVE_CLIENT_SECRET")
+
+        if not _validate_client_id(client_id) or not _validate_client_secret(client_secret):
+            sys.exit(1)
+
+    print()
+    print("Opening browser to authenticate with Google...")
+    print("(If it doesn't open, copy the URL below into your browser.)")
+    print()
+
+    from google_auth_oauthlib.flow import InstalledAppFlow
+
+    SCOPE = "https://www.googleapis.com/auth/drive.file"
+
+    client_config = {
+        "installed": {
+            "client_id": client_id,
+            "client_secret": client_secret,
+            "redirect_uris": ["http://localhost"],
+            "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+            "token_uri": "https://oauth2.googleapis.com/token",
+        }
+    }
+
+    flow = InstalledAppFlow.from_client_config(client_config, scopes=[SCOPE])
+    credentials = flow.run_local_server(host="localhost", port=8080, open_browser=True)
+
+    print()
+    print("=" * 60)
+    print("SUCCESS — copy these values into your .env file:")
+    print("=" * 60)
+    print()
+    print("DOCUMENT_STORAGE_BACKEND=google_drive")
+    print(f"GOOGLE_DRIVE_CLIENT_ID={credentials.client_id}")
+    print(f"GOOGLE_DRIVE_CLIENT_SECRET={client_secret}")
+    print(f"GOOGLE_DRIVE_REFRESH_TOKEN={credentials.refresh_token}")
+    print("GOOGLE_DRIVE_FOLDER_ID=<get this from the Drive folder URL>")
+    print()
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

app/templates/layouts/base.html

@@ -68,6 +68,12 @@
                 </a>
             </li>
             {% endif %}
+            <li>
+                <a href="{{ url_for('objectives.list_objectives') }}" class="{% if request.endpoint and 'objectives' in request.endpoint %}active{% endif %}">
+                    <i class="fas fa-bullseye"></i>
+                    <span>{{ _('Objectives') }}</span>
+                </a>
+            </li>
             {% if current_user.role == 'player' %}
             <li>
                 <a href="{{ url_for('teams.my_teams') }}" class="{% if request.endpoint == 'teams.my_teams' %}active{% endif %}">
@@ -90,6 +96,12 @@
                     <span>{{ _('Manage Users') }}</span>
                 </a>
             </li>
+            <li>
+                <a href="{{ url_for('admin.dashboard') }}" class="{% if request.endpoint and 'admin' in request.endpoint %}active{% endif %}">
+                    <i class="fas fa-cogs"></i>
+                    <span>Admin Panel</span>
+                </a>
+            </li>
             {% endif %}
             {% if current_user.role == 'player' %}
             <li>

app/templates/pages/admin.html

@@ -0,0 +1,294 @@
+{% extends "layouts/base.html" %}
+{% block title %}Admin Panel{% endblock %}
+{% block page_title %}Admin Panel{% endblock %}
+
+{% block content %}
+
+<!-- Stats Bar -->
+<div class="stats-grid">
+    <div class="stat-card">
+        <div class="stat-icon bg-primary">
+            <i class="fas fa-users"></i>
+        </div>
+        <div class="stat-info">
+            <h3>{{ stats.total_users }}</h3>
+            <p>Total Users</p>
+        </div>
+    </div>
+    <div class="stat-card">
+        <div class="stat-icon bg-success">
+            <i class="fas fa-user"></i>
+        </div>
+        <div class="stat-info">
+            <h3>{{ stats.total_players }}</h3>
+            <p>Players</p>
+        </div>
+    </div>
+    <div class="stat-card">
+        <div class="stat-icon bg-warning">
+            <i class="fas fa-shield-alt"></i>
+        </div>
+        <div class="stat-info">
+            <h3>{{ stats.total_org_teams }}</h3>
+            <p>Org Teams</p>
+        </div>
+    </div>
+    <div class="stat-card">
+        <div class="stat-icon bg-info">
+            <i class="fas fa-calendar-alt"></i>
+        </div>
+        <div class="stat-info">
+            <h3>{{ stats.active_tryouts }}</h3>
+            <p>Active Tryouts</p>
+        </div>
+    </div>
+    <div class="stat-card">
+        <div class="stat-icon bg-secondary">
+            <i class="fas fa-clock"></i>
+        </div>
+        <div class="stat-info">
+            <h3>{{ stats.upcoming_tryouts }}</h3>
+            <p>Upcoming</p>
+        </div>
+    </div>
+</div>
+
+<div class="dashboard-grid">
+    <!-- Left column -->
+    <div class="card">
+        <div class="card-header">
+            <h3><i class="fas fa-toggle-{% if settings.tryouts_open %}on{% else %}off{% endif %}"></i> Tryouts Access</h3>
+        </div>
+        <div class="card-body">
+            <p>
+                Status:
+                <span class="badge badge-{% if settings.tryouts_open %}success{% else %}danger{% endif %}">
+                    {% if settings.tryouts_open %}OPEN{% else %}CLOSED{% endif %}
+                </span>
+            </p>
+            <p class="text-muted" style="font-size: 0.85rem; margin: 8px 0;">
+                {% if settings.tryouts_open %}
+                    Coaches and managers can create and modify tryouts.
+                {% else %}
+                    Only admins can create or modify tryouts. Coaches and managers are locked out.
+                {% endif %}
+            </p>
+            <form method="POST" action="{{ url_for('admin.toggle_tryouts') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <button type="submit" class="btn btn-{% if settings.tryouts_open %}warning{% else %}success{% endif %}">
+                    {% if settings.tryouts_open %}Close Tryouts{% else %}Open Tryouts{% endif %}
+                </button>
+            </form>
+        </div>
+    </div>
+
+    <div class="card">
+        <div class="card-header">
+            <h3><i class="fas fa-toggle-{% if settings.document_uploads_enabled %}on{% else %}off{% endif %}"></i> Document Uploads</h3>
+        </div>
+        <div class="card-body">
+            <p>
+                Status:
+                <span class="badge badge-{% if settings.document_uploads_enabled %}success{% else %}danger{% endif %}">
+                    {% if settings.document_uploads_enabled %}ENABLED{% else %}DISABLED{% endif %}
+                </span>
+            </p>
+            <p class="text-muted" style="font-size: 0.85rem; margin: 8px 0;">
+                {% if settings.document_uploads_enabled %}
+                    Managers and coaches can upload contracts. Players can upload signed contracts.
+                {% else %}
+                    Only admins can upload or sign contracts. Other roles are blocked.
+                {% endif %}
+            </p>
+            <form method="POST" action="{{ url_for('admin.toggle_document_uploads') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <button type="submit" class="btn btn-{% if settings.document_uploads_enabled %}warning{% else %}success{% endif %}">
+                    {% if settings.document_uploads_enabled %}Disable Uploads{% else %}Enable Uploads{% endif %}
+                </button>
+            </form>
+        </div>
+    </div>
+
+    <div class="card">
+        <div class="card-header">
+            <h3><i class="fas fa-calendar-check"></i> Season Management</h3>
+        </div>
+        <div class="card-body">
+            <p>
+                Season:
+                <span class="badge badge-{% if settings.season_active %}success{% else %}info{% endif %}">
+                    {% if settings.season_active %}ACTIVE{% else %}INACTIVE{% endif %}
+                </span>
+            </p>
+            <p><strong>Name:</strong> {{ settings.season_name }}</p>
+            <p><strong>Start:</strong> {{ settings.season_start }}</p>
+            <p><strong>End:</strong> {{ settings.season_end }}</p>
+
+            {% if not settings.season_active %}
+            <hr style="margin: 12px 0;">
+            <form method="POST" action="{{ url_for('admin.start_season') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <div class="form-group">
+                    <label>Season Name</label>
+                    <input type="text" name="season_name" class="form-input" placeholder="e.g. Fall 2026" required>
+                </div>
+                <div class="form-group">
+                    <label>Start Date</label>
+                    <input type="date" name="season_start" class="form-input" required>
+                </div>
+                <button type="submit" class="btn btn-success">Begin Season</button>
+            </form>
+            {% else %}
+            <hr style="margin: 12px 0;">
+            <form method="POST" action="{{ url_for('admin.end_season') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <div class="form-group">
+                    <label>End Date</label>
+                    <input type="date" name="season_end" class="form-input" required>
+                </div>
+                <button type="submit" class="btn btn-warning">End Season</button>
+            </form>
+            {% endif %}
+        </div>
+    </div>
+
+    <!-- Wipe Teams -->
+    <div class="card" style="border-left: 4px solid var(--danger);">
+        <div class="card-header">
+            <h3><i class="fas fa-trash-alt" style="color: var(--danger);"></i> Wipe Teams for New Season</h3>
+        </div>
+        <div class="card-body">
+            <p class="text-muted" style="font-size: 0.85rem; margin-bottom: 12px;">
+                This removes all players from organization teams and deletes all regular-season matches.
+                Team structures, coaches, and managers are preserved. A safety backup is created automatically.
+            </p>
+            <form method="POST" action="{{ url_for('admin.wipe_teams') }}"
+                  data-confirm-input="confirm" data-confirm-value="WIPE"
+                  data-confirm-input-message="You must type WIPE to confirm."
+                  data-confirm="This will remove ALL players from organization teams and delete ALL regular-season matches. A safety backup will be created automatically. Are you ABSOLUTELY sure?">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <div class="form-group">
+                    <label>Type <strong>WIPE</strong> to confirm:</label>
+                    <input type="text" name="confirm" class="form-input" placeholder="WIPE" autocomplete="off" required>
+                </div>
+                <button type="submit" class="btn btn-danger">Wipe Team Rosters</button>
+            </form>
+        </div>
+    </div>
+
+    <!-- Manual Backup -->
+    <div class="card">
+        <div class="card-header">
+            <h3><i class="fas fa-database"></i> Manual Backup</h3>
+        </div>
+        <div class="card-body">
+            <p class="text-muted" style="font-size: 0.85rem; margin-bottom: 12px;">
+                Creates a full PostgreSQL database dump (.sql file). Stored on the server.
+            </p>
+            <form method="POST" action="{{ url_for('admin.create_backup') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <div class="form-group">
+                    <label>Notes (optional)</label>
+                    <input type="text" name="notes" class="form-input" placeholder="What's this backup for?">
+                </div>
+                <button type="submit" class="btn btn-primary">
+                    <i class="fas fa-save"></i> Create Backup Now
+                </button>
+            </form>
+        </div>
+    </div>
+
+    <!-- Backup History -->
+    <div class="card">
+        <div class="card-header">
+            <h3><i class="fas fa-history"></i> Backup History & Restore</h3>
+        </div>
+        <div class="card-body">
+            <div class="table-container">
+            <table class="table">
+                <thead>
+                    <tr>
+                        <th>Date</th>
+                        <th>Filename</th>
+                        <th>Size</th>
+                        <th>Type</th>
+                        <th>Actions</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    {% for b in backups %}
+                    <tr>
+                        <td>{{ b.created_at.strftime('%Y-%m-%d %H:%M') if b.created_at else '—' }}</td>
+                        <td style="max-width: 200px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;" title="{{ b.filename }}">{{ b.filename }}</td>
+                        <td>{{ (b.size_bytes / 1024)|round(1) }} KB</td>
+                        <td><span class="badge badge-info">{{ b.backup_type }}</span></td>
+                        <td style="white-space: nowrap;">
+                            <a href="{{ url_for('admin.download_backup', backup_id=b.id) }}" class="btn btn-sm btn-primary" title="Download">
+                                <i class="fas fa-download"></i>
+                            </a>
+                            <form method="POST" action="{{ url_for('admin.restore_backup', backup_id=b.id) }}" class="inline-form"
+                                  data-confirm="Restore backup {{ b.filename }}? This will overwrite all current data. A safety backup will be made first.">
+                                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                                <button type="submit" class="btn btn-sm btn-warning" title="Restore">
+                                    <i class="fas fa-undo"></i>
+                                </button>
+                            </form>
+                            <form method="POST" action="{{ url_for('admin.delete_backup', backup_id=b.id) }}" class="inline-form"
+                                  data-confirm="Delete backup {{ b.filename }}?">
+                                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                                <button type="submit" class="btn btn-sm btn-danger" title="Delete">
+                                    <i class="fas fa-trash"></i>
+                                </button>
+                            </form>
+                        </td>
+                    </tr>
+                    {% else %}
+                    <tr>
+                        <td colspan="5" class="text-muted" style="font-size: 0.85rem;">No backups yet. Create your first backup above.</td>
+                    </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+            </div>
+        </div>
+    </div>
+</div>
+
+<!-- Audit Log -->
+<div class="card mt-4">
+    <div class="card-header">
+        <h3><i class="fas fa-clipboard-list"></i> Audit Log (Recent)</h3>
+    </div>
+    <div class="card-body">
+        <div class="table-container">
+        <table class="table">
+            <thead>
+                <tr>
+                    <th>Date</th>
+                    <th>User</th>
+                    <th>Action</th>
+                    <th>Details</th>
+                    <th>IP</th>
+                </tr>
+            </thead>
+            <tbody>
+                {% for entry in audit_logs %}
+                <tr>
+                    <td>{{ entry.created_at.strftime('%Y-%m-%d %H:%M') if entry.created_at else '—' }}</td>
+                    <td>{{ entry.user.username if entry.user else 'System' }}</td>
+                    <td><span class="badge badge-info">{{ entry.action }}</span></td>
+                    <td style="max-width: 250px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;">{{ entry.details or '—' }}</td>
+                    <td>{{ entry.ip_address or '—' }}</td>
+                </tr>
+                {% else %}
+                <tr>
+                    <td colspan="5" class="text-muted" style="font-size: 0.85rem;">No audit log entries yet.</td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        </div>
+    </div>
+</div>
+
+{% endblock %}

app/templates/pages/batch_evaluate.html

@@ -43,7 +43,7 @@
                     <div class="form-group col-4">
                         <label for="{{ field_name }}_{{ pid }}">{{ label }} (1-10)</label>
                         <div class="score-input">
-                            <input type="range" id="{{ field_name }}_{{ pid }}" name="{{ field_name }}_{{ pid }}" min="1" max="10" value="{{ existing_scores[field_name] or 5 }}" oninput="this.nextElementSibling.textContent = this.value">
+                            <input type="range" id="{{ field_name }}_{{ pid }}" name="{{ field_name }}_{{ pid }}" min="1" max="10" value="{{ existing_scores[field_name] or 5 }}" data-mirror>
                             <span class="range-value">{{ existing_scores[field_name] or 5 }}</span>
                         </div>
                     </div>

app/templates/pages/coach_availability.html

@@ -1,248 +0,0 @@
-{% extends "layouts/base.html" %}
-{% block title %}{{ _('Manage Availability') }} - UdeS team manager{% endblock %}
-{% block page_title %}{{ _('Manage Availability') }}{% endblock %}
-{% block breadcrumb %}<span class="breadcrumb">Home / Coach Availability</span>{% endblock %}
-
-{% block content %}
-<div class="card">
-    <div class="card-header">
-        <h3><i class="fas fa-clock"></i> {{ _('Set Your Weekly Availability') }}</h3>
-        <p class="text-muted small">{{ _('Select time slots when you\'re available for One on One sessions') }}</p>
-    </div>
-    <div class="card-body">
-        <div class="availability-grid" id="availability-grid">
-            <p class="text-muted">{{ _('Loading availability grid...') }}</p>
-        </div>
-        
-        <div class="form-actions mt-4">
-            <button type="button" class="btn btn-primary" data-action="save-availability">
-                <i class="fas fa-save"></i> {{ _('Save Availability') }}
-            </button>
-            <button type="button" class="btn btn-secondary" data-action="clear-availability">
-                <i class="fas fa-trash"></i> {{ _('Clear All') }}
-            </button>
-        </div>
-    </div>
-</div>
-
-{% endblock %}
-
-{% block scripts %}
-<style>
-.availability-grid {
-    display: grid;
-    grid-template-columns: repeat(7, 1fr);
-    gap: 12px;
-    margin-top: 10px;
-}
-
-.day-column {
-    background: var(--bg-secondary);
-    border-radius: 8px;
-    padding: 10px;
-    min-height: 300px;
-}
-
-.day-header {
-    text-align: center;
-    font-weight: 600;
-    padding: 8px 0;
-    border-bottom: 1px solid var(--border-color);
-    margin-bottom: 10px;
-    color: var(--primary);
-}
-
-.time-slot {
-    padding: 6px 8px;
-    margin: 4px 0;
-    border-radius: 4px;
-    font-size: 0.8rem;
-    text-align: center;
-    cursor: pointer;
-    transition: var(--transition);
-    background: var(--bg-secondary);
-    border: 1px solid var(--border-color);
-}
-
-.time-slot:hover {
-    background: var(--primary-light);
-    border-color: var(--primary);
-}
-
-.time-slot.selected {
-    background: var(--primary);
-    color: white;
-    border-color: var(--primary-dark);
-}
-
-.time-slot.selected:hover {
-    background: var(--danger);
-}
-
-@media (max-width: 768px) {
-    .availability-grid {
-        grid-template-columns: repeat(3, 1fr);
-    }
-}
-
-@media (max-width: 480px) {
-    .availability-grid {
-        grid-template-columns: 1fr;
-    }
-}
-</style>
-<script nonce="{{ csp_nonce }}">
-// Time slots from 8:00 AM to 10:00 PM (30-minute intervals)
-const TIME_SLOTS = [];
-for (let h = 8; h <= 22; h++) {
-    for (let m = 0; m < 60; m += 30) {
-        const timeStr = (h < 10 ? '0' : '') + h + ':' + (m < 10 ? '0' : '') + m;
-        const displayHour = h > 12 ? h - 12 : h;
-        const displayAmpm = h >= 12 ? 'PM' : 'AM';
-        const displayTime = displayHour + ':' + (m < 10 ? '0' : '') + m + ' ' + displayAmpm;
-        TIME_SLOTS.push({ time: timeStr, display: displayTime });
-    }
-}
-
-// Day names
-const DAYS = ['Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday', 'Sunday'];
-
-// Track selected slots: {day_of_week: [time_strings]}
-let selectedSlots = {};
-
-// Initialize
-document.addEventListener('DOMContentLoaded', function() {
-    loadExistingAvailability();
-    renderGrid();
-});
-
-function loadExistingAvailability() {
-    // Load from existing data
-    {% for av in existing_availability %}
-    if (!selectedSlots[{{ av.day_of_week }}]) {
-        selectedSlots[{{ av.day_of_week }}] = [];
-    }
-    selectedSlots[{{ av.day_of_week }}].push('{{ av.start_time.strftime('%H:%M') }}');
-    {% endfor %}
-}
-
-function renderGrid() {
-    const grid = document.getElementById('availability-grid');
-    let html = '';
-    
-    DAYS.forEach((day, dayIndex) => {
-        html += '<div class="day-column">';
-        html += '<div class="day-header">' + day.substring(0, 3) + '</div>';
-        
-        TIME_SLOTS.forEach(slot => {
-            const isSelected = selectedSlots[dayIndex] && selectedSlots[dayIndex].includes(slot.time);
-            const cssClass = isSelected ? 'time-slot selected' : 'time-slot';
-            html += '<div class="' + cssClass + '" data-day="' + dayIndex + '" data-time="' + slot.time + '" data-action="toggle-slot">' + slot.display + '</div>';
-        });
-        
-        html += '</div>';
-    });
-    
-    grid.innerHTML = html;
-}
-
-function toggleSlot(element) {
-    const dayOfWeek = Number(element.getAttribute('data-day'));
-    const timeStr = element.getAttribute('data-time');
-    if (!selectedSlots[dayOfWeek]) {
-        selectedSlots[dayOfWeek] = [];
-    }
-    
-    const index = selectedSlots[dayOfWeek].indexOf(timeStr);
-    if (index === -1) {
-        selectedSlots[dayOfWeek].push(timeStr);
-        element.classList.add('selected');
-    } else {
-        selectedSlots[dayOfWeek].splice(index, 1);
-        element.classList.remove('selected');
-    }
-}
-
-function saveAvailability() {
-    const slots = [];
-    for (let day in selectedSlots) {
-        selectedSlots[day].forEach(time => {
-            slots.push({ day_of_week: parseInt(day), start_time: time });
-        });
-    }
-    
-    fetch('{{ url_for("users.manage_coach_availability") }}', {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            'X-CSRFToken': '{{ csrf_token() }}'
-        },
-        body: JSON.stringify({ slots: slots })
-    })
-    .then(response => response.json())
-    .then(data => {
-        if (data.success) {
-            flash('Availability saved!', 'success');
-        } else {
-            flash(data.error || 'Error saving availability.', 'danger');
-        }
-    })
-    .catch(function(error) {
-        console.error('Save error:', error);
-        flash('Error saving availability.', 'danger');
-    });
-}
-
-function clearAllAvailability() {
-    if (!confirm('Are you sure you want to clear all your availability slots?')) {
-        return;
-    }
-    
-    fetch('{{ url_for("users.clear_coach_availability") }}', {
-        method: 'POST',
-        headers: { 'X-CSRFToken': '{{ csrf_token() }}' }
-    })
-    .then(response => response.json())
-    .then(data => {
-        if (data.success) {
-            selectedSlots = {};
-            renderGrid();
-            flash('Availability cleared!', 'success');
-        }
-    });
-}
-
-function flash(message, type) {
-    const flashContainer = document.querySelector('.flash-messages');
-    const alert = document.createElement('div');
-    alert.className = 'alert alert-' + type + ' alert-dismissible';
-    const text = document.createElement('span');
-    text.textContent = message;
-    const close = document.createElement('button');
-    close.type = 'button';
-    close.className = 'alert-close';
-    close.dataset.action = 'remove-element';
-    close.textContent = '×';
-    alert.append(text, close);
-    flashContainer.appendChild(alert);
-}
-
-// Auto-save on change (debounced)
-let saveTimeout;
-document.addEventListener('click', function(e) {
-    if (e.target.classList.contains('time-slot')) {
-        clearTimeout(saveTimeout);
-        saveTimeout = setTimeout(saveAvailability, 1000);
-    }
-});
-
-// Behaviours are declared in the markup with data-action / data-change and
-// dispatched by the delegated listener in main.js. This replaces inline
-// onclick attributes, which no CSP nonce is able to authorise.
-registerActions({
-    'save-availability': saveAvailability,
-    'clear-availability': clearAllAvailability,
-    'toggle-slot': toggleSlot,
-});
-</script>
-{% endblock %}

app/templates/pages/contracts.html

@@ -94,8 +94,8 @@
                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                 <div class="form-group">
                     <label for="signed_file">{{ _('Select Signed Contract File') }}</label>
-                    <input type="file" id="signed_file" name="signed_file" accept=".pdf,.doc,.docx,.jpg,.jpeg,.png" required>
+                    <input type="file" id="signed_file" name="signed_file" accept=".pdf" required>
-                    <small class="form-text text-muted">{{ _('Accepted formats: PDF, DOC, DOCX, JPG, PNG') }}</small>
+                    <small class="form-text text-muted">{{ _('Accepted format: PDF') }}</small>
                 </div>
                 <div class="form-actions">
                     <button type="button" class="btn btn-secondary" data-action="hide-upload-signed">{{ _('Cancel') }}</button>

app/templates/pages/objective_form.html

@@ -0,0 +1,348 @@
+{% extends "layouts/base.html" %}
+{% block title %}{% if edit_mode %}{{ _('Edit Objective') }}{% else %}{{ _('New Objective') }}{% endif %} - UdeS team manager{% endblock %}
+{% block page_title %}{% if edit_mode %}{{ _('Edit Objective') }}{% else %}{{ _('New Objective') }}{% endif %}{% endblock %}
+{% block breadcrumb %}<span class="breadcrumb">{{ _('Home') }} / <a href="{{ url_for('objectives.list_objectives') }}">{{ _('Objectives') }}</a> / {% if edit_mode %}{{ _('Edit') }}{% else %}{{ _('New') }}{% endif %}</span>{% endblock %}
+{% block content %}
+<div class="objective-editor">
+  <div class="objective-editor-form">
+    <div class="card">
+      <div class="card-header"><h3><i class="fas fa-edit"></i> {% if edit_mode %}{{ _('Edit Objective') }}{% else %}{{ _('Create Objective') }}{% endif %}</h3></div>
+      <div class="card-body">
+        <form method="POST" action="{% if edit_mode %}{{ url_for('objectives.update_objective', objective_id=objective.id) }}{% else %}{{ url_for('objectives.create_objective') }}{% endif %}" class="form" id="objForm">
+          <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+          <div class="form-section">
+            <h4><i class="fas fa-info-circle"></i> {{ _('1. General Information') }}</h4>
+            <div class="form-row">
+              <div class="form-group col-6">
+                <label for="obj_type">{{ _('Type') }}</label>
+                <select name="type" id="obj_type" class="form-select" onchange="updatePreview();toggleAssignment()">
+                  {% for val, label in objective_types %}<option value="{{ val }}"{% if objective and objective.type == val %} selected{% endif %}>{{ label }}</option>{% endfor %}
+                </select>
+              </div>
+              <div class="form-group col-6">
+                <label for="obj_status">{{ _('Status') }}</label>
+                <select name="status" id="obj_status" class="form-select" onchange="updatePreview()">
+                  {% for val, label in objective_statuses %}<option value="{{ val }}"{% if objective and objective.status == val %} selected{% endif %}>{{ label }}</option>{% endfor %}
+                </select>
+              </div>
+            </div>
+            <div class="form-group">
+              <label for="obj_title">{{ _('Title') }} <span class="required">*</span></label>
+              <input type="text" name="title" id="obj_title" class="form-input" required value="{{ objective.title if objective else '' }}" placeholder="{{ _('e.g. Improve headshot accuracy') }}" oninput="updatePreview()">
+            </div>
+            <div class="form-group">
+              <label for="obj_description">{{ _('Description') }}</label>
+              <textarea name="description" id="obj_description" rows="3" class="form-textarea" placeholder="{{ _('Describe the objective...') }}" oninput="updatePreview()">{{ objective.description if objective else '' }}</textarea>
+            </div>
+            <div class="form-row">
+              <div class="form-group col-6" id="playerField">
+                <label for="obj_player_id">{{ _('Assigned to (Player)') }}</label>
+                <select name="player_id" id="obj_player_id" class="form-select" onchange="updatePreview()">
+                  <option value="">{{ _('-- Select a player --') }}</option>
+                  {% for p in players %}<option value="{{ p.id }}"{% if objective and objective.player_id == p.id %} selected{% endif %}>{{ p.username }}</option>{% endfor %}
+                </select>
+              </div>
+              <div class="form-group col-6" id="teamField">
+                <label for="obj_team_id">{{ _('Team') }}</label>
+                <select name="team_id" id="obj_team_id" class="form-select" onchange="updatePreview()">
+                  <option value="">{{ _('-- Select a team --') }}</option>
+                  {% for t in teams %}<option value="{{ t.id }}"{% if objective and objective.team_id == t.id %} selected{% endif %}>{{ t.name }}</option>{% endfor %}
+                </select>
+              </div>
+            </div>
+            <div class="form-group">
+              <label class="checkbox-label"><input type="checkbox" name="is_template" id="obj_is_template" value="1"{% if objective and objective.is_template %} checked{% endif %} onchange="updatePreview();toggleAssignment()"> {{ _('This is a template (reusable pattern)') }}</label>
+            </div>
+          </div>
+          <div class="form-section">
+            <h4><i class="fas fa-chart-line"></i> {{ _('2. KPI & Target') }}</h4>
+            <div class="form-row">
+              <div class="form-group col-4">
+                <label for="obj_kpi_metric">{{ _('KPI metric') }}</label>
+                <input type="text" name="kpi_metric" id="obj_kpi_metric" class="form-input" value="{{ objective.kpi_metric if objective else '' }}" placeholder="{{ _('e.g. HS rate, KDA, CS/min') }}" oninput="updatePreview()">
+              </div>
+              <div class="form-group col-4">
+                <label for="obj_kpi_target">{{ _('Target value') }}</label>
+                <input type="number" step="0.01" name="kpi_target" id="obj_kpi_target" class="form-input" value="{{ objective.kpi_target if objective else '' }}" placeholder="{{ _('e.g. 40') }}" oninput="updatePreview()">
+              </div>
+              <div class="form-group col-4">
+                <label for="obj_kpi_unit">{{ _('Unit') }}</label>
+                <input type="text" name="kpi_unit" id="obj_kpi_unit" class="form-input" value="{{ objective.kpi_unit if objective else '' }}" placeholder="{{ _('e.g. points, percentage') }}" oninput="updatePreview()">
+              </div>
+            </div>
+          </div>
+          <div class="form-section">
+            <h4><i class="fas fa-calendar-alt"></i> {{ _('3. Deadline & Priority') }}</h4>
+            <div class="form-row">
+              <div class="form-group col-4">
+                <label for="obj_start_date">{{ _('Start date') }}</label>
+                <input type="date" name="start_date" id="obj_start_date" class="form-input" value="{{ objective.start_date.strftime('%Y-%m-%d') if objective and objective.start_date else '' }}" onchange="updatePreview()">
+              </div>
+              <div class="form-group col-4">
+                <label for="obj_due_date">{{ _('Deadline') }} <span class="required">*</span></label>
+                <input type="date" name="due_date" id="obj_due_date" class="form-input" required value="{{ objective.due_date.strftime('%Y-%m-%d') if objective else '' }}" onchange="updatePreview()">
+              </div>
+              <div class="form-group col-4">
+                <label for="obj_priority">{{ _('Priority') }}</label>
+                <select name="priority" id="obj_priority" class="form-select" onchange="updatePreview()">
+                  {% for val, label in objective_priorities %}<option value="{{ val }}"{% if objective and objective.priority == val %} selected{% endif %}>{{ label }}</option>{% endfor %}
+                </select>
+              </div>
+            </div>
+          </div>
+          <div class="form-section">
+            <h4><i class="fas fa-bell"></i> {{ _('4. Tracking & Alerts') }}</h4>
+            <div class="form-row">
+              <div class="form-group col-6">
+                <label for="obj_check_frequency">{{ _('Check frequency') }}</label>
+                <select name="check_frequency" id="obj_check_frequency" class="form-select">
+                  <option value="">{{ _('-- None --') }}</option>
+                  {% for val, label in objective_frequencies %}<option value="{{ val }}"{% if objective and objective.check_frequency == val %} selected{% endif %}>{{ label }}</option>{% endfor %}
+                </select>
+              </div>
+              <div class="form-group col-6">
+                <label for="obj_progress">{{ _('Progress') }} (<span id="progressVal">{{ objective.progress if objective else 0 }}</span>%)</label>
+                <input type="range" id="obj_progress" name="progress" min="0" max="100" value="{{ objective.progress if objective else 0 }}" class="form-range" oninput="document.getElementById('progressVal').textContent=this.value;updatePreview()">
+              </div>
+            </div>
+          </div>
+          <div class="form-section">
+            <h4><i class="fas fa-cog"></i> {{ _('5. Advanced Settings') }}</h4>
+            <div class="form-group">
+              <label for="obj_category">{{ _('Category') }}</label>
+              <input type="text" name="category" id="obj_category" class="form-input" value="{{ objective.category if objective else '' }}" placeholder="{{ _('e.g. Mechanics, Teamplay, Communication') }}">
+            </div>
+            <div class="form-group">
+              <label for="obj_tags">{{ _('Tags') }}</label>
+              <input type="text" name="tags" id="obj_tags" class="form-input" value="{{ objective.tags if objective else '' }}" placeholder="{{ _('Separate with commas') }}">
+            </div>
+          </div>
+          <div class="form-actions">
+            <a href="{{ url_for('objectives.list_objectives') }}" class="btn btn-secondary">{{ _('Cancel') }}</a>
+            <button type="submit" class="btn btn-primary"><i class="fas fa-save"></i> {% if edit_mode %}{{ _('Update') }}{% else %}{{ _('Create') }}{% endif %}</button>
+          </div>
+        </form>
+      </div>
+    </div>
+  </div>
+  <div class="objective-editor-preview">
+    <div class="card mb-4" id="previewCard">
+      <div class="card-header"><h3><i class="fas fa-eye"></i> {{ _('Player Preview') }}</h3></div>
+      <div class="card-body">
+        <div id="previewContent">
+          <h4 id="previewTitle">{{ objective.title if objective else _('Objective title') }}</h4>
+          <p id="previewDesc" class="text-muted small">{{ objective.description if objective else '' }}</p>
+          <div class="objective-tags" id="previewTags">{% if objective and objective.tags %}{% for tag in objective.tags.split(',') %}<span class="badge badge-light">{{ tag.strip() }}</span>{% endfor %}{% endif %}</div>
+          <div class="preview-stats">
+            <div class="preview-stat"><span class="preview-label">{{ _('Assigned to') }}</span><span id="previewAssignee" class="preview-value">{% if objective and objective.player %}{{ objective.player.username }}{% else %}-{% endif %}</span></div>
+            <div class="preview-stat"><span class="preview-label">{{ _('KPI') }}</span><span id="previewKpi" class="preview-value">{% if objective and objective.kpi_metric %}{{ objective.kpi_metric }}: {{ objective.kpi_target }}{{ objective.kpi_unit }}{% else %}-{% endif %}</span></div>
+            <div class="preview-stat"><span class="preview-label">{{ _('Deadline') }}</span><span id="previewDeadline" class="preview-value">{% if objective and objective.due_date %}{{ objective.due_date.strftime('%Y-%m-%d') }}{% endif %}</span></div>
+          </div>
+          <div class="progress-section">
+            <span class="preview-label">{{ _('Progress') }}</span>
+            <div class="progress-bar-container" style="width:100%"><div class="progress-bar" id="previewBar" style="width:{{ objective.progress if objective else 0 }}%"></div></div>
+            <strong><span id="previewProgress">{{ objective.progress if objective else 0 }}</span>%</strong>
+          </div>
+        </div>
+        <div class="mt-3">
+          <span id="previewStatusBadge" class="badge">{% if objective %}{% for val, label in objective_statuses %}{% if val == objective.status %}{{ label }}{% endif %}{% endfor %}{% else %}{{ _('Active') }}{% endif %}</span>
+          <span id="previewPriorityBadge" class="badge">{% if objective %}{{ {'high':_('High'),'medium':_('Medium'),'low':_('Low')}.get(objective.priority,objective.priority) }}{% else %}{{ _('Medium') }}{% endif %}</span>
+        </div>
+      </div>
+    </div>
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-chart-line"></i> {{ _('KPI Progression') }}</h3></div>
+      <div class="card-body">
+        <svg id="progressChart" viewBox="0 0 400 200" style="width:100%;height:auto;" xmlns="http://www.w3.org/2000/svg"></svg>
+        {% if edit_mode and objective.kpi_target %}
+        <div class="mt-2 text-center" id="predictionInfo"></div>
+        {% endif %}
+      </div>
+    </div>
+    {% if edit_mode %}
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-database"></i> {{ _('KPI Measurements') }}</h3></div>
+      <div class="card-body">
+        <form method="POST" action="{{ url_for('objectives.add_entry', objective_id=objective.id) }}" class="form-inline">
+          <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+          <div class="form-group" style="flex:1;">
+            <input type="number" step="0.01" name="value" class="form-input" placeholder="{{ _('Value') }}" required>
+          </div>
+          <div class="form-group" style="flex:2;">
+            <input type="text" name="note" class="form-input" placeholder="{{ _('Note (optional)') }}">
+          </div>
+          <button type="submit" class="btn btn-sm btn-primary"><i class="fas fa-plus"></i> {{ _('Record') }}</button>
+        </form>
+        {% if entries %}
+        <table class="table mt-2">
+          <thead><tr><th>{{ _('Date') }}</th><th>{{ _('Value') }}</th><th>{{ _('Note') }}</th></tr></thead>
+          <tbody>
+            {% for e in entries %}
+            <tr><td>{{ e.recorded_at.strftime('%Y-%m-%d %H:%M') }}</td><td><strong>{{ e.value }}</strong></td><td class="text-muted small">{{ e.note or '' }}</td></tr>
+            {% endfor %}
+          </tbody>
+        </table>
+        {% endif %}
+      </div>
+    </div>
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-comments"></i> {{ _('Comments') }}</h3></div>
+      <div class="card-body">
+        <form method="POST" action="{{ url_for('objectives.add_comment', objective_id=objective.id) }}" class="form">
+          <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+          <div class="form-group">
+            <textarea name="content" rows="2" class="form-textarea" placeholder="{{ _('Add a comment...') }}" required></textarea>
+          </div>
+          <button type="submit" class="btn btn-sm btn-primary"><i class="fas fa-paper-plane"></i> {{ _('Comment') }}</button>
+        </form>
+        {% if comments %}
+        <div class="comments-list mt-2">
+          {% for c in comments %}
+          <div class="comment-item">
+            <strong>{{ c.coach.username }}</strong> <span class="text-muted small">{{ c.created_at.strftime('%Y-%m-%d %H:%M') }}</span>
+            <p>{{ c.content }}</p>
+          </div>
+          {% endfor %}
+        </div>
+        {% endif %}
+      </div>
+    </div>
+    {% if personal_notes or team_notes %}
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-sticky-note"></i> {{ _('Related Notes') }}</h3></div>
+      <div class="card-body">
+        {% if personal_notes %}
+        <h5>{{ _('Player Notes') }}</h5>
+        {% for n in personal_notes %}
+        <div class="comment-item">
+          <strong>{{ n.coach.username }}</strong> <span class="text-muted small">{{ n.created_at.strftime('%Y-%m-%d') }}</span>
+          <p>{{ n.content[:200] }}</p>
+        </div>
+        {% endfor %}
+        {% endif %}
+        {% if team_notes %}
+        <h5 class="mt-2">{{ _('Team Notes') }}</h5>
+        {% for n in team_notes %}
+        <div class="comment-item">
+          <strong>{{ n.coach.username }}</strong> <span class="text-muted small">{{ n.created_at.strftime('%Y-%m-%d') }}</span>
+          <p>{{ n.content[:200] }}</p>
+        </div>
+        {% endfor %}
+        {% endif %}
+      </div>
+    </div>
+    {% endif %}
+    {% endif %}
+    {% if templates %}
+    <div class="card">
+      <div class="card-header"><h3><i class="fas fa-copy"></i> {{ _('Templates') }}</h3></div>
+      <div class="card-body" id="templatesList">
+        {% for t in templates %}
+        <div class="template-item">
+          <h5>{{ t.title }}</h5>
+          <p class="text-muted small">{{ t.description[:120] if t.description else '' }}</p>
+          <button type="button" class="btn btn-sm btn-outline-primary use-template-btn" onclick="applyTemplate({{ t.id }})"><i class="fas fa-arrow-right"></i> {{ _('Use this template') }}</button>
+        </div>
+        {% endfor %}
+      </div>
+    </div>
+    {% endif %}
+  </div>
+</div>
+{% endblock %}
+{% block scripts %}
+<script>
+var templateDataUrl = '{{ url_for("objectives.objective_data", objective_id=0) }}';
+var templates = {};
+{% for t in templates %}
+(function(id) {
+  fetch(templateDataUrl.replace('/0/', '/' + id + '/')).then(function(r) { return r.json(); }).then(function(d) { templates[id] = d; });
+})({{ t.id }});
+{% endfor %}
+
+function toggleAssignment() {
+  var t = document.getElementById('obj_type').value;
+  var isTmpl = document.getElementById('obj_is_template').checked;
+  var pf = document.getElementById('playerField');
+  var tf = document.getElementById('teamField');
+  if (isTmpl) { pf.style.display = 'none'; tf.style.display = 'none'; return; }
+  pf.style.display = t === 'team' ? 'none' : '';
+  tf.style.display = t === 'individual' ? 'none' : '';
+}
+function applyTemplate(id) {
+  var t = templates[id]; if (!t) return;
+  document.getElementById('obj_title').value = t.title || '';
+  document.getElementById('obj_description').value = t.description || '';
+  document.getElementById('obj_type').value = t.type || 'individual';
+  document.getElementById('obj_status').value = t.status || 'active';
+  document.getElementById('obj_priority').value = t.priority || 'medium';
+  document.getElementById('obj_kpi_metric').value = t.kpi_metric || '';
+  document.getElementById('obj_kpi_target').value = t.kpi_target || '';
+  document.getElementById('obj_kpi_unit').value = t.kpi_unit || '';
+  document.getElementById('obj_start_date').value = t.start_date || '';
+  document.getElementById('obj_due_date').value = '';
+  document.getElementById('obj_check_frequency').value = t.check_frequency || '';
+  document.getElementById('obj_category').value = t.category || '';
+  document.getElementById('obj_tags').value = t.tags || '';
+  document.getElementById('obj_progress').value = 0;
+  document.getElementById('progressVal').textContent = '0';
+  toggleAssignment(); updatePreview();
+}
+function updatePreview() {
+  var title = document.getElementById('obj_title').value || '';
+  var desc = document.getElementById('obj_description').value || '';
+  var status = document.getElementById('obj_status').value;
+  var priority = document.getElementById('obj_priority').value;
+  var kpiMetric = document.getElementById('obj_kpi_metric').value;
+  var kpiTarget = document.getElementById('obj_kpi_target').value;
+  var kpiUnit = document.getElementById('obj_kpi_unit').value;
+  var deadline = document.getElementById('obj_due_date').value;
+  var progress = document.getElementById('obj_progress').value;
+  var sel = document.getElementById('obj_player_id');
+  var playerName = sel.options[sel.selectedIndex] ? sel.options[sel.selectedIndex].text : '-';
+  document.getElementById('previewTitle').textContent = title || '{{ _('Objective title') | e }}';
+  document.getElementById('previewDesc').textContent = desc;
+  document.getElementById('previewAssignee').textContent = playerName;
+  document.getElementById('previewKpi').textContent = kpiMetric ? kpiMetric + ': ' + kpiTarget + (kpiUnit || '') : '-';
+  document.getElementById('previewDeadline').textContent = deadline;
+  document.getElementById('previewBar').style.width = progress + '%';
+  document.getElementById('previewProgress').textContent = progress;
+  var sl = {}, sc = {'active':'badge-success','pending':'badge-warning','completed':'badge-info','overdue':'badge-danger'};
+  var pl = {}, pc = {'high':'badge-danger','medium':'badge-warning','low':'badge-secondary'};
+  {% for val, label in objective_statuses %}sl['{{ val }}'] = '{{ label | e }}';{% endfor %}
+  {% for val, label in objective_priorities %}pl['{{ val }}'] = '{{ label | e }}';{% endfor %}
+  document.getElementById('previewStatusBadge').textContent = sl[status] || status;
+  document.getElementById('previewStatusBadge').className = 'badge ' + (sc[status] || 'badge-secondary');
+  document.getElementById('previewPriorityBadge').textContent = pl[priority] || priority;
+  document.getElementById('previewPriorityBadge').className = 'badge ' + (pc[priority] || 'badge-secondary');
+  drawChart(progress, kpiTarget);
+}
+function drawChart(progress, target) {
+  var svg = document.getElementById('progressChart');
+  var w = 400, h = 200, pt = 20, pr = 20, pb = 30, pl = 40;
+  var cw = w - pl - pr, ch = h - pt - pb;
+  var prog = Math.min(parseInt(progress) || 0, 100);
+  var py = pt + ch * (1 - prog / 100);
+  var tgt = parseFloat(target) || 100;
+  var tgtScale = Math.max(tgt, prog);
+  var tgtNorm = tgt / (tgtScale);
+  var ty = pt + ch * (1 - tgtNorm);
+  var html = '<rect x="0" y="0" width="' + w + '" height="' + h + '" fill="transparent"/>';
+  html += '<line x1="' + pl + '" y1="' + (pt + ch) + '" x2="' + (pl + cw) + '" y2="' + (pt + ch) + '" stroke="#ddd" stroke-width="1"/>';
+  html += '<line x1="' + pl + '" y1="' + pt + '" x2="' + pl + '" y2="' + (pt + ch) + '" stroke="#ddd" stroke-width="1"/>';
+  html += '<text x="' + (pl - 30) + '" y="' + (pt + 5) + '" fill="#999" font-size="10">' + tgtScale + '</text>';
+  html += '<text x="' + (pl - 30) + '" y="' + (pt + ch / 2 + 4) + '" fill="#999" font-size="10">' + (tgtScale / 2).toFixed(1) + '</text>';
+  html += '<text x="' + (pl - 30) + '" y="' + (pt + ch + 4) + '" fill="#999" font-size="10">0</text>';
+  html += '<text x="' + pl + '" y="' + (pt + ch + 18) + '" fill="#999" font-size="10">{{ _('Now') | e }}</text>';
+  html += '<text x="' + (pl + cw - 50) + '" y="' + (pt + ch + 18) + '" fill="#999" font-size="10">{{ _('Deadline') | e }}</text>';
+  html += '<line x1="' + pl + '" y1="' + ty + '" x2="' + (pl + cw) + '" y2="' + ty + '" stroke="#4CAF50" stroke-width="1.5" stroke-dasharray="4,3"/>';
+  html += '<text x="' + (pl + cw + 4) + '" y="' + (ty + 4) + '" fill="#4CAF50" font-size="9">{{ _('Target') | e }}</text>';
+  html += '<polygon points="' + pl + ',' + (pt + ch) + ' ' + pl + ',' + py + ' ' + (pl + (prog / 100) * cw) + ',' + py + ' ' + (pl + (prog / 100) * cw) + ',' + (pt + ch) + '" fill="rgba(59,130,246,0.15)"/>';
+  html += '<line x1="' + pl + '" y1="' + py + '" x2="' + (pl + (prog / 100) * cw) + '" y2="' + py + '" stroke="#3B82F6" stroke-width="2"/>';
+  html += '<circle cx="' + (pl + (prog / 100) * cw) + '" cy="' + py + '" r="4" fill="#3B82F6"/>';
+  html += '<text x="' + (pl + (prog / 100) * cw - 12) + '" y="' + (py - 8) + '" fill="#3B82F6" font-size="10" font-weight="bold">' + prog + '%</text>';
+  svg.innerHTML = html;
+}
+document.addEventListener('DOMContentLoaded', function() { toggleAssignment(); updatePreview(); });
+</script>
+{% endblock %}

app/templates/pages/objective_view.html

@@ -0,0 +1,125 @@
+{% extends "layouts/base.html" %}
+{% block title %}{{ objective.title }} - UdeS team manager{% endblock %}
+{% block page_title %}{{ objective.title }}{% endblock %}
+{% block breadcrumb %}<span class="breadcrumb">{{ _('Home') }} / <a href="{{ url_for('objectives.list_objectives') }}">{{ _('Objectives') }}</a> / {{ objective.title }}</span>{% endblock %}
+{% block content %}
+<div class="row">
+  <div class="col-8">
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-bullseye"></i> {{ objective.title }}</h3></div>
+      <div class="card-body">
+        <p>{{ objective.description or '' }}</p>
+        <div class="preview-stats">
+          <div class="preview-stat"><span class="preview-label">{{ _('Type') }}</span><span class="preview-value">{% for val, label in objective_types %}{% if val == objective.type %}{{ label }}{% endif %}{% endfor %}</span></div>
+          <div class="preview-stat"><span class="preview-label">{{ _('Assigned to') }}</span><span class="preview-value">{% if objective.player %}{{ objective.player.username }}{% elif objective.team %}{{ objective.team.name }}{% else %}-{% endif %}</span></div>
+          <div class="preview-stat"><span class="preview-label">{{ _('Category') }}</span><span class="preview-value">{{ objective.category or '-' }}</span></div>
+        </div>
+        <div class="mt-3">
+          <span id="statusBadge" class="badge">{% for val, label in objective_statuses %}{% if val == objective.status %}{{ label }}{% endif %}{% endfor %}</span>
+          <span id="priorityBadge" class="badge">{% set pl = {'high':_('High'),'medium':_('Medium'),'low':_('Low')} %}{{ pl.get(objective.priority,objective.priority) }}</span>
+        </div>
+      </div>
+    </div>
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-chart-line"></i> {{ _('KPI Progression') }}</h3></div>
+      <div class="card-body">
+        <svg id="progressChart" viewBox="0 0 400 200" style="width:100%;height:auto;" xmlns="http://www.w3.org/2000/svg"></svg>
+        {% if objective.kpi_target %}<div class="mt-2 text-center" id="predictionInfo"></div>{% endif %}
+      </div>
+    </div>
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-database"></i> {{ _('KPI Measurements') }}</h3></div>
+      <div class="card-body">
+        <form method="POST" action="{{ url_for('objectives.add_entry', objective_id=objective.id) }}" class="form-inline">
+          <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+          <div class="form-group" style="flex:1;"><input type="number" step="0.01" name="value" class="form-input" placeholder="{{ _('Value (optional)') }}"></div>
+          <div class="form-group" style="flex:2;"><input type="text" name="note" class="form-input" placeholder="{{ _('Note or comment') }}"></div>
+          <button type="submit" class="btn btn-sm btn-primary"><i class="fas fa-plus"></i> {{ _('Record') }}</button>
+        </form>
+        {% if entries %}<table class="table mt-2"><thead><tr><th>{{ _('Date') }}</th><th>{{ _('Value') }}</th><th>{{ _('Note') }}</th></tr></thead><tbody>
+{% for e in entries %}<tr><td>{{ e.recorded_at.strftime('%Y-%m-%d %H:%M') }}</td><td><strong>{% if e.value is not none %}{{ e.value }}{% else %}-{% endif %}</strong></td><td class="text-muted small">{{ e.note or '' }}</td></tr>{% endfor %}</tbody></table>{% else %}<p class="text-muted mt-2">{{ _('No measurements recorded yet.') }}</p>{% endif %}
+      </div>
+    </div>
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-comments"></i> {{ _('Comments') }}</h3></div>
+      <div class="card-body">{% if comments %}<div class="comments-list">{% for c in comments %}<div class="comment-item"><strong>{{ c.coach.username }}</strong> <span class="text-muted small">{{ c.created_at.strftime('%Y-%m-%d %H:%M') }}</span><p>{{ c.content }}</p></div>{% endfor %}</div>{% else %}<p class="text-muted">{{ _('No comments yet.') }}</p>{% endif %}</div>
+    </div>
+  </div>
+  <div class="col-4">
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-info-circle"></i> {{ _('Details') }}</h3></div>
+      <div class="card-body">
+        <div class="preview-stats">
+          <div class="preview-stat"><span class="preview-label">{{ _('Priority') }}</span><span class="preview-value">{% set pl = {'high':_('High'),'medium':_('Medium'),'low':_('Low')} %}{{ pl.get(objective.priority,objective.priority) }}</span></div>
+          <div class="preview-stat"><span class="preview-label">{{ _('Status') }}</span><span class="preview-value">{% for val, label in objective_statuses %}{% if val == objective.status %}{{ label }}{% endif %}{% endfor %}</span></div>
+          <div class="preview-stat"><span class="preview-label">{{ _('Start date') }}</span><span class="preview-value">{{ objective.start_date.strftime('%Y-%m-%d') if objective.start_date else '-' }}</span></div>
+          <div class="preview-stat"><span class="preview-label">{{ _('Deadline') }}</span><span class="preview-value">{{ objective.due_date.strftime('%Y-%m-%d') if objective.due_date else '-' }}</span></div>
+          <div class="preview-stat"><span class="preview-label">{{ _('Progress') }}</span><span class="preview-value">{{ objective.progress }}%</span></div>
+        </div>
+        {% if objective.kpi_target %}<div class="progress-section mt-2"><span class="preview-label">{{ _('KPI Target') }}</span><strong>{{ objective.kpi_target }}{% if objective.kpi_unit %}{{ objective.kpi_unit }}{% endif %}</strong></div>{% endif %}
+        {% if can_edit %}<a href="{{ url_for('objectives.edit_objective', objective_id=objective.id) }}" class="btn btn-sm btn-primary mt-3"><i class="fas fa-edit"></i> {{ _('Edit') }}</a>{% endif %}
+      </div>
+    </div>
+    {% if personal_notes or team_notes %}<div class="card mb-4"><div class="card-header"><h3><i class="fas fa-sticky-note"></i> {{ _('Related Notes') }}</h3></div><div class="card-body">{% if personal_notes %}<h5>{{ _('Personal Notes') }}</h5>{% for n in personal_notes %}<div class="comment-item"><strong>{{ n.coach.username }}</strong> <span class="text-muted small">{{ n.created_at.strftime('%Y-%m-%d') }}</span><p>{{ n.content[:200] }}</p></div>{% endfor %}{% endif %}{% if team_notes %}<h5 class="mt-2">{{ _('Team Notes') }}</h5>{% for n in team_notes %}<div class="comment-item"><strong>{{ n.coach.username }}</strong> <span class="text-muted small">{{ n.created_at.strftime('%Y-%m-%d') }}</span><p>{{ n.content[:200] }}</p></div>{% endfor %}{% endif %}</div></div>{% endif %}
+  </div>
+</div>{% endblock %}
+{% block scripts %}
+<script>
+function drawChart(progress, target) {
+  var svg = document.getElementById('progressChart');
+  if (!svg) return;
+  var w = 400, h = 200, pt = 20, pr = 20, pb = 30, pl = 40;
+  var cw = w - pl - pr, ch = h - pt - pb;
+  var prog = Math.min(parseInt(progress) || 0, 100);
+  var py = pt + ch * (1 - prog / 100);
+  var tgt = parseFloat(target) || 100;
+  var tgtScale = Math.max(tgt, prog);
+  var ty = pt + ch * (1 - tgt / tgtScale);
+  var html = '<rect x="0" y="0" width="' + w + '" height="' + h + '" fill="transparent"/>';
+  html += '<line x1="' + pl + '" y1="' + (pt + ch) + '" x2="' + (pl + cw) + '" y2="' + (pt + ch) + '" stroke="#ddd" stroke-width="1"/>';
+  html += '<line x1="' + pl + '" y1="' + pt + '" x2="' + pl + '" y2="' + (pt + ch) + '" stroke="#ddd" stroke-width="1"/>';
+  html += '<text x="' + (pl - 30) + '" y="' + (pt + 5) + '" fill="#999" font-size="10">' + tgtScale + '</text>';
+  html += '<text x="' + (pl - 30) + '" y="' + (pt + ch / 2 + 4) + '" fill="#999" font-size="10">' + (tgtScale / 2).toFixed(1) + '</text>';
+  html += '<text x="' + (pl - 30) + '" y="' + (pt + ch + 4) + '" fill="#999" font-size="10">0</text>';
+  html += '<line x1="' + pl + '" y1="' + ty + '" x2="' + (pl + cw) + '" y2="' + ty + '" stroke="#4CAF50" stroke-width="1.5" stroke-dasharray="4,3"/>';
+  html += '<text x="' + (pl + cw + 4) + '" y="' + (ty + 4) + '" fill="#4CAF50" font-size="9">{{ _('Target') | e }}</text>';
+  html += '<polygon points="' + pl + ',' + (pt + ch) + ' ' + pl + ',' + py + ' ' + (pl + (prog / 100) * cw) + ',' + py + ' ' + (pl + (prog / 100) * cw) + ',' + (pt + ch) + '" fill="rgba(59,130,246,0.15)"/>';
+  html += '<line x1="' + pl + '" y1="' + py + '" x2="' + (pl + (prog / 100) * cw) + '" y2="' + py + '" stroke="#3B82F6" stroke-width="2"/>';
+  html += '<circle cx="' + (pl + (prog / 100) * cw) + '" cy="' + py + '" r="4" fill="#3B82F6"/>';
+  svg.innerHTML = html;
+  fetchTrendAndEntries();
+}
+function fetchTrendAndEntries() {
+  var trendUrl = '{{ url_for("objectives.trend_data", objective_id=objective.id) }}';
+  var entriesUrl = '{{ url_for("objectives.list_entries", objective_id=objective.id) }}';
+  Promise.all([fetch(trendUrl).then(function(r){return r.json()}), fetch(entriesUrl).then(function(r){return r.json()})]).then(function(results) {
+    var trend = results[0], entries = results[1];
+    var infoEl = document.getElementById('predictionInfo');
+    if (trend.predicted_achievement_date) {
+      infoEl.innerHTML = '<strong>{{ _("Predicted achievement") }}:</strong> ' + new Date(trend.predicted_achievement_date).toLocaleDateString() + ' - <span class=\"' + (trend.confidence > 0.6 ? 'confidence-high' : trend.confidence > 0.3 ? 'confidence-medium' : 'confidence-low') + '\">{{ _("Confidence") }}: ' + (trend.confidence * 100).toFixed(0) + '%</span>';
+    }
+    if (entries && entries.length > 1) {
+      var svg = document.getElementById('progressChart');
+      var html = svg.innerHTML;
+      var w = 400, pl = 40, pt = 20, cw = 320, ch = 150;
+      var entryValues = entries.map(function(e){return parseFloat(e.value)||0;});
+      var maxVal = Math.max.apply(null, entryValues);
+      var range = maxVal || 1;
+      var stepX = cw / (entries.length - 1);
+      entryValues.forEach(function(v, i) {
+        var ex = pl + i * stepX;
+        var ey = pt + ch * (1 - v / range);
+        html += '<circle cx="' + ex + '" cy="' + ey + '" r="3" fill="#8B5CF6"/>';
+        if (i > 0) {
+          var pex = pl + (i - 1) * stepX;
+          var pey = pt + ch * (1 - entryValues[i-1] / range);
+          html += '<line x1="' + pex + '" y1="' + pey + '" x2="' + ex + '" y2="' + ey + '" stroke="#8B5CF6" stroke-width="1.5"/>';
+        }
+      });
+      svg.innerHTML = html;
+    }
+  }).catch(function(){});
+}
+document.addEventListener('DOMContentLoaded', function() { drawChart({{ objective.progress }}, '{{ objective.kpi_target if objective.kpi_target else '' }}'); });
+</script>
+{% endblock %}

app/templates/pages/objectives.html

@@ -0,0 +1,64 @@
+{% extends "layouts/base.html" %}
+{% import 'layouts/_pagination.html' as pager %}
+{% block title %}{{ _('Objectives') }} - UdeS team manager{% endblock %}
+{% block page_title %}{{ _('Objective Management') }}{% endblock %}
+{% block breadcrumb %}<span class="breadcrumb">{{ _('Home') }} / {{ _('Objectives') }}</span>{% endblock %}
+{% block content %}
+<div class="stats-grid mb-4">
+    <div class="stat-card"><div class="stat-icon bg-primary"><i class="fas fa-flag-checkered"></i></div><div class="stat-info"><h3>{{ count_total }}</h3><p>{{ _('Total') }}</p></div></div>
+    <div class="stat-card"><div class="stat-icon bg-info"><i class="fas fa-chart-line"></i></div><div class="stat-info"><h3>{{ count_kpi }}</h3><p>{{ _('Custom KPIs') }}</p></div></div>
+    <div class="stat-card"><div class="stat-icon bg-secondary"><i class="fas fa-copy"></i></div><div class="stat-info"><h3>{{ count_templates }}</h3><p>{{ _('Templates') }}</p></div></div>
+    <div class="stat-card"><div class="stat-icon bg-success"><i class="fas fa-percentage"></i></div><div class="stat-info"><h3>{{ success_rate }}%</h3><p>{{ _('Success rate') }}</p></div></div>
+</div>
+<div class="card mb-4"><div class="card-body"><div class="objectives-toolbar">
+<nav class="objectives-tabs" role="tablist">
+<a href="{{ url_for('objectives.list_objectives', tab='all') }}" class="tab-link {% if tab == 'all' %}active{% endif %}">{{ _('All') }} ({{ count_total }})</a>
+<a href="{{ url_for('objectives.list_objectives', tab='kpi') }}" class="tab-link {% if tab == 'kpi' %}active{% endif %}">{{ _('Custom KPIs') }} ({{ count_kpi }})</a>
+<a href="{{ url_for('objectives.list_objectives', tab='modeles') }}" class="tab-link {% if tab in ('modeles','templates') %}active{% endif %}">{{ _('Templates') }} ({{ count_templates }})</a>
+</nav>
+<form method="GET" action="{{ url_for('objectives.list_objectives') }}" class="objectives-search-bar">
+<input type="hidden" name="tab" value="{{ tab }}">
+<div class="form-inline">
+<div class="form-group" style="flex:1;min-width:200px;"><input type="text" name="search" class="form-input" placeholder="{{ _('Search an objective...') }}"></div>
+<div class="form-group"><select name="status" class="form-select"><option value="">{{ _('Status') }}</option>{% for val, label in objective_statuses %}<option value="{{ val }}"{% if f_status == val %} selected{% endif %}>{{ label }}</option>{% endfor %}</select></div>
+<div class="form-group"><select name="priority" class="form-select"><option value="">{{ _('Priority') }}</option>{% for val, label in objective_priorities %}<option value="{{ val }}"{% if f_priority == val %} selected{% endif %}>{{ label }}</option>{% endfor %}</select></div>
+<div class="form-group"><select name="type" class="form-select"><option value="">{{ _('Type') }}</option>{% for val, label in objective_types %}<option value="{{ val }}"{% if f_type == val %} selected{% endif %}>{{ label }}</option>{% endfor %}</select></div>
+<div class="form-group"><select name="team" class="form-select"><option value="">{{ _('Team') }}</option>{% for t in teams %}<option value="{{ t.id }}"{% if f_team == t.id %} selected{% endif %}>{{ t.name }}</option>{% endfor %}</select></div>
+<button type="submit" class="btn btn-sm btn-primary"><i class="fas fa-filter"></i> {{ _('Filters') }}</button>
+</div></form>
+</div></div></div>
+<div class="card"><div class="card-header"><h3><i class="fas fa-bullseye"></i> {{ _('Objectives') }}</h3>{% if can_edit %}<a href="{{ url_for('objectives.new_objective') }}" class="btn btn-sm btn-primary"><i class="fas fa-plus"></i> {{ _('New Objective') }}</a>{% endif %}</div>
+<div class="card-body"><div class="table-container"><table class="table objectives-table"><thead><tr>
+<th>{{ _('Objective') }}</th><th>{{ _('Assigned to') }}</th><th>{{ _('Team') }}</th><th>{{ _('Priority') }}</th><th>{{ _('Status') }}</th><th>{{ _('Target KPI') }}</th><th>{{ _('Progress') }}</th><th>{{ _('Deadline') }}</th>{% if can_edit %}<th>{{ _('Actions') }}</th>{% endif %}
+</tr></thead><tbody>
+{% for obj in objectives.items %}<tr data-objective-id="{{ obj.id }}">
+<td><strong>{{ obj.title }}</strong>{% if obj.tags %}<div class="objective-tags">{% for tag in obj.tags.split(',') %}<span class="badge badge-light">{{ tag.strip() }}</span>{% endfor %}</div>{% endif %}{% if obj.kpi_metric %}<small class="text-muted d-block">{{ obj.kpi_metric }}</small>{% endif %}</td>
+<td>{% if obj.player %}<span class="user-avatar avatar-sm">{{ obj.player.username[:2]|upper }}</span> {{ obj.player.username }}{% else %}<span class="text-muted">-</span>{% endif %}</td>
+<td>{% if obj.team %}{{ obj.team.name }}{% else %}<span class="text-muted">-</span>{% endif %}</td>
+<td>{% set pc = {'high':'badge-danger','medium':'badge-warning','low':'badge-secondary'} %}<span class="badge {{ pc.get(obj.priority,'badge-secondary') }}">{{ {'high':_('High'),'medium':_('Medium'),'low':_('Low')}.get(obj.priority,obj.priority) }}</span></td>
+<td>{% set sc = {'active':'badge-success','pending':'badge-warning','completed':'badge-info','overdue':'badge-danger'} %}<span class="badge {{ sc.get(obj.status,'badge-secondary') }}">{% for val, label in objective_statuses %}{% if val == obj.status %}{{ label }}{% endif %}{% endfor %}</span></td>
+<td>{% if obj.kpi_target is not none %}{{ obj.kpi_target }}{% if obj.kpi_unit %}{{ obj.kpi_unit }}{% endif %}{% else %}<span class="text-muted">-</span>{% endif %}</td>
+<td><div class="progress-bar-container"><div class="progress-bar" style="width:{{ obj.progress }}%"></div></div><small>{{ obj.progress }}%</small></td>
+<td>{% if obj.is_template %}-{% elif obj.due_date %}{{ obj.due_date.strftime('%Y-%m-%d') }}{% endif %}</td>
+{% if can_edit %}<td class="actions-cell"><a href="{{ url_for('objectives.edit_objective', objective_id=obj.id) }}" class="btn btn-sm btn-outline-primary" title="{{ _('Edit') }}"><i class="fas fa-edit"></i></a> <a href="{{ url_for('objectives.view_objective', objective_id=obj.id) }}" class="btn btn-sm btn-outline-info" title="{{ _('View') }}"><i class="fas fa-eye"></i></a> <button class="btn btn-sm btn-outline-danger delete-obj-btn" data-obj-id="{{ obj.id }}" data-obj-title="{{ obj.title }}" title="{{ _('Delete') }}"><i class="fas fa-trash"></i></button></td>{% elif current_user.role == 'player' %}<td><a href="{{ url_for('objectives.view_objective', objective_id=obj.id) }}" class="btn btn-sm btn-outline-info"><i class="fas fa-eye"></i> {{ _('View') }}</a></td>{% endif %}
+</tr>{% else %}
+<tr><td colspan="{{ 9 if can_edit else 8 }}" class="text-center"><div class="empty-state"><i class="fas fa-bullseye"></i><h3>{{ _('No objectives yet') }}</h3><p>{{ _('Create your first objective to start tracking player evolution.') }}</p></div></td></tr>{% endfor %}
+</tbody></table></div>{{ pager.controls(pagination) }}</div></div>
+<div id="deleteModal" class="modal hidden"><div class="modal-backdrop" onclick="hideDeleteModal();"></div><div class="modal-content"><div class="modal-header"><h3><i class="fas fa-trash-alt"></i> {{ _('Delete Objective') }}</h3><button class="modal-close" onclick="hideDeleteModal();">&times;</button></div><div class="modal-body"><p>{{ _('Are you sure you want to delete this objective?') }}</p><p><strong id="deleteObjTitle"></strong></p><form id="deleteForm" method="POST" action=""><input type="hidden" name="csrf_token" value="{{ csrf_token() }}"><div class="form-actions"><button type="button" class="btn btn-secondary" onclick="hideDeleteModal();">{{ _('Cancel') }}</button><button type="submit" class="btn btn-danger"><i class="fas fa-trash"></i> {{ _('Delete') }}</button></div></form></div></div></div>
+{% endblock %}
+{% block scripts %}<script>
+document.addEventListener('DOMContentLoaded', function() {
+    document.querySelectorAll('.delete-obj-btn').forEach(function(btn) {
+        btn.addEventListener('click', function() {
+            var id = this.getAttribute('data-obj-id');
+            var title = this.getAttribute('data-obj-title');
+            document.getElementById('deleteObjTitle').textContent = title;
+            document.getElementById('deleteForm').action = '{{ url_for("objectives.delete_objective", objective_id=0) }}'.replace('/0/', '/' + id + '/');
+            document.getElementById('deleteModal').classList.remove('hidden');
+        });
+    });
+    document.getElementById('deleteModal').querySelector('.modal-backdrop').addEventListener('click', hideDeleteModal);
+});
+function hideDeleteModal(){document.getElementById('deleteModal').classList.add('hidden');}
+document.addEventListener('keydown',function(e){if(e.key==='Escape'){hideDeleteModal();}});
+</script>{% endblock %}

app/templates/pages/players_to_evaluate.html

@@ -15,7 +15,7 @@
                 <table class="table">
                     <thead>
                         <tr>
-                            <th><input type="checkbox" id="select-all" onclick="toggleAll(this)"></th>
+                            <th><input type="checkbox" id="select-all" data-action="toggle-all"></th>
                             <th>Player</th>
                             <th>Contact</th>
                             <th>Attendance</th>
@@ -70,12 +70,20 @@
     </div>
 </div>
 
-<script>
+{% endblock %}
-function toggleAll(master) {
+
+{% block scripts %}
+<script nonce="{{ csp_nonce }}">
+function toggleAll() {
     var boxes = document.querySelectorAll('.player-check');
+    var master = document.getElementById('select-all');
     for (var i = 0; i < boxes.length; i++) {
         boxes[i].checked = master.checked;
     }
 }
+
+registerActions({
+    'toggle-all': toggleAll,
+});
 </script>
 {% endblock %}

app/templates/pages/profile.html

@@ -393,6 +393,13 @@ document.addEventListener('DOMContentLoaded', function() {
     loadCoachAvailability();
     renderCoachGrid();
 });
+
+// Behaviours are declared in the markup with data-action / data-change and
+// dispatched by the delegated listener in main.js. This replaces inline
+// onclick attributes, which no CSP nonce is able to authorise.
+registerActions({
+    'clear-availability': clearAllAvailability,
+});
 </script>
 {% endif %}
 
@@ -608,7 +615,6 @@ document.addEventListener('DOMContentLoaded', function() {
 // onclick attributes, which no CSP nonce is able to authorise.
 registerActions({
     'clear-disponibilities': clearDisponibilities,
-    'clear-availability': clearAllAvailability,
 });
 </script>
 {% endif %}

app/templates/pages/teams.html

@@ -300,6 +300,9 @@
     </div>
 </div>
 
+{% endblock %}
+
+{% block scripts %}
 <script nonce="{{ csp_nonce }}">
 function showCreateForm() {
     document.getElementById('createTeamForm').classList.remove('hidden');

app/templates/pages/tryout_form.html

@@ -67,15 +67,22 @@
                     </select>
                 </div>
                 <div class="form-group col-6">
-                    <label for="manager_id">{{ _('Assigned Manager') }}</label>
+                    <label>{{ _('Assigned Managers') }}</label>
-                    <select id="manager_id" name="manager_id" class="form-select">
+                    <div class="checkbox-grid">
-                        <option value="">{{ _('-- No manager assigned --') }}</option>
                         {% for manager in managers %}
-                        <option value="{{ manager.id }}" {% if tryout and tryout.manager_id == manager.id %}selected{% endif %}>
+                        {% set is_checked = false %}
-{{ manager.username }}
+                        {% if tryout %}
-                        </option>
+                            {% for m in tryout.get_managers() %}
+                                {% if m.id == manager.id %}{% set is_checked = true %}{% endif %}
+                            {% endfor %}
+                        {% endif %}
+                        <label class="checkbox-label">
+                            <input type="checkbox" name="manager_ids" value="{{ manager.id }}" {% if is_checked %}checked{% endif %}>
+                            <span>{{ manager.username }}</span>
+                        </label>
                         {% endfor %}
-                    </select>
+                    </div>
+                    <small class="text-muted">{{ _('Select one or more managers for this tryout.') }}</small>
                 </div>
             </div>
             <div class="form-row">

app/templates/pages/upload_contract.html

@@ -24,8 +24,8 @@
             
             <div class="form-group">
                 <label for="contract_file">{{ _('Contract File') }}</label>
-                <input type="file" id="contract_file" name="contract_file" accept=".pdf,.doc,.docx,.jpg,.jpeg,.png" required>
+                <input type="file" id="contract_file" name="contract_file" accept=".pdf" required>
-                <small class="form-text text-muted">{{ _('Accepted formats: PDF, DOC, DOCX, JPG, PNG') }}</small>
+                <small class="form-text text-muted">{{ _('Accepted format: PDF') }}</small>
             </div>
             
             <div class="form-group">

app/templates/pages/users.html

@@ -21,6 +21,7 @@
                         <th>{{ _('Username') }}</th>
                         <th>{{ _('Email') }}</th>
                         <th>{{ _('Role') }}</th>
+                        <th>{{ _('Hours') }}</th>
                         <th>{{ _('Status') }}</th>
                         <th>{{ _('Joined') }}</th>
                         <th>{{ _('Actions') }}</th>
@@ -38,6 +39,13 @@
                         <td>{{ u.username }}</td>
                         <td>{{ u.email }}</td>
                         <td><span class="badge badge-{{ u.role }}">{{ u.role | capitalize }}</span></td>
+                        <td>
+                            {% if u.role in ('player', 'coach') %}
+                            {{ '%.1f'|format(hours.get(u.id, 0.0)) }}
+                            {% else %}
+                            —
+                            {% endif %}
+                        </td>
                         <td>
                             {% if u.is_active_account %}
                             <span class="badge badge-success">Active</span>

app/templates/pages/view_tryout.html

@@ -70,16 +70,22 @@
                     <span class="detail-value">{{ tryout.target_org_team.name if tryout.target_org_team else 'Not specified' }}</span>
                 </div>
                 <div class="detail-item">
-                    <span class="detail-label">Manager</span>
+                    <span class="detail-label">Manager(s)</span>
-                    <span class="detail-value">{{ tryout.manager.username if tryout.manager else 'Not assigned' }}</span>
+                    <span class="detail-value">
+                        {% set mgrs = tryout.get_managers() %}
+                        {% if mgrs %}
+                            {{ mgrs | map(attribute='username') | join(', ') }}
+                        {% else %}
+                            Not assigned
+                        {% endif %}
+                    </span>
                 </div>
                 <div class="detail-item">
                     <span class="detail-label">Coaches</span>
                     <span class="detail-value">
-                        {% if tryout.coaches %}
+                        {% set cos = tryout.get_coaches() %}
-                            {{ tryout.coaches | map(attribute='username') | join(', ') }}
+                        {% if cos %}
-                        {% elif tryout.coach %}
+                            {{ cos | map(attribute='username') | join(', ') }}
-                            {{ tryout.coach.username }}
                         {% else %}
                             Not assigned
                         {% endif %}
@@ -534,6 +540,9 @@
     {% endif %}
 </div>
 
+{% endblock %}
+
+{% block scripts %}
 <style>
 .presence-toggle-btn {
     padding: 2px 7px;

app/templates/pages/view_user.html

@@ -81,6 +81,31 @@
             </table>
         </div>
         {% endif %}
+
+        {% if profile_user.role in ('player', 'coach') and availability %}
+        <hr class="my-4">
+        <h4 class="mb-3"><i class="fas fa-clock"></i> {{ _('Availability') }}
+            <small class="text-muted">({{ '%.1f'|format(availability_hours or 0.0) }} h)</small>
+        </h4>
+        <div class="readonly-availability-grid">
+            {% set day_names = ['Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday', 'Sunday'] %}
+            {% for day_idx in range(7) %}
+            <div class="ra-day-column">
+                <div class="ra-day-header">{{ day_names[day_idx][:3] }}</div>
+                {% set day_slots = availability | selectattr('day_of_week', 'equalto', day_idx) | list %}
+                {% if day_slots %}
+                    {% for slot in day_slots | sort(attribute='start_time') %}
+                    <div class="ra-slot selected">
+                        {{ slot.start_time.strftime('%H:%M') }}–{{ slot.end_time.strftime('%H:%M') }}
+                    </div>
+                    {% endfor %}
+                {% else %}
+                    <div class="ra-slot ra-empty">—</div>
+                {% endif %}
+            </div>
+            {% endfor %}
+        </div>
+        {% endif %}
     </div>
 </div>
 {% endblock %}

app/timeslots.py

@@ -58,3 +58,39 @@ def day_name(day_of_week):
     if 0 <= day_of_week < len(DAY_NAMES):
         return DAY_NAMES[day_of_week]
     return f'Day {day_of_week}'
+
+
+def slot_duration_minutes(start_time, end_time):
+    """Minutes a slot spans, wrapping past midnight like slot_end does.
+
+    Works on SQLite where ``Time`` columns are stored as text — the
+    arithmetic stays in pure Python so it is portable across databases.
+
+    Args:
+        start_time: A ``datetime.time``.
+        end_time: A ``datetime.time`` (may be earlier if the slot wraps
+            past midnight).
+
+    Returns:
+        int: Duration in whole minutes.
+    """
+    anchor = date_cls(2000, 1, 1)
+    start_dt = datetime.combine(anchor, start_time)
+    end_dt = datetime.combine(anchor, end_time)
+    if end_dt <= start_dt:
+        end_dt += timedelta(days=1)
+    return int((end_dt - start_dt).total_seconds() // 60)
+
+
+def total_hours(slots):
+    """Aggregate slot durations into a single float, rounded to one decimal.
+
+    Args:
+        slots: Iterable of objects with ``start_time`` and ``end_time``
+            attributes (``PlayerDisponibility`` or ``CoachAvailability``).
+
+    Returns:
+        float: Total hours across all slots, e.g. ``8.5``.
+    """
+    total_minutes = sum(slot_duration_minutes(s.start_time, s.end_time) for s in slots)
+    return round(total_minutes / 60, 1)

app/validators.py

@@ -23,7 +23,15 @@ from marshmallow import (
     validates_schema,
 )
 
-from app.models import ESPORT_GAMES, GAME_PLATFORMS, USER_TYPES
+from app.models import (
+    ESPORT_GAMES,
+    GAME_PLATFORMS,
+    OBJECTIVE_CHECK_FREQUENCIES,
+    OBJECTIVE_PRIORITIES,
+    OBJECTIVE_STATUSES,
+    OBJECTIVE_TYPES,
+    USER_TYPES,
+)
 
 # =============================================================================
 # Custom Validators
@@ -949,6 +957,7 @@ class TryoutSchema(StripMixin):
     target_org_team_id = fields.Integer(allow_none=True, load_default=None)
     manager_id = fields.Integer(allow_none=True, load_default=None)
     coach_ids = fields.List(fields.Integer(), load_default=list)
+    manager_ids = fields.List(fields.Integer(), load_default=list)
 
     @validates_schema
     def validate_span(self, data, **kwargs):
@@ -1048,3 +1057,137 @@ class EvaluationSchema(StripMixin):
         allow_none=True,
         load_default=None,
     )
+
+
+# =============================================================================
+# Player Evolution — Objective / Plan Schema
+# =============================================================================
+
+
+class ObjectiveSchema(StripMixin):
+    """A player-evolution objective — individual or team KPI goal.
+
+    Validates the form payload from the create / edit modal on the
+    objectives management page.
+    """
+
+    title = fields.String(
+        required=True,
+        validate=validate.Length(min=1, max=200, error=_l('Le titre est obligatoire.')),
+        error_messages={'required': _l('Le titre est obligatoire.')},
+    )
+    description = fields.String(
+        allow_none=True,
+        load_default=None,
+        validate=validate.Length(max=5000),
+    )
+    type = fields.String(
+        validate=validate.OneOf(
+            [v for v, _ in OBJECTIVE_TYPES],
+            error=_l("Type d'objectif invalide."),
+        ),
+        load_default='individual',
+    )
+    status = fields.String(
+        validate=validate.OneOf(
+            [v for v, _ in OBJECTIVE_STATUSES],
+            error=_l('Statut invalide.'),
+        ),
+        load_default='active',
+    )
+    priority = fields.String(
+        validate=validate.OneOf(
+            [v for v, _ in OBJECTIVE_PRIORITIES],
+            error=_l('Priorité invalide.'),
+        ),
+        load_default='medium',
+    )
+    category = fields.String(
+        allow_none=True,
+        load_default=None,
+        validate=validate.Length(max=50),
+    )
+    is_template = fields.Boolean(load_default=False)
+    player_id = fields.Integer(
+        allow_none=True,
+        load_default=None,
+        validate=validate.Range(min=1),
+        error_messages={'invalid': _l('Joueur invalide.')},
+    )
+    team_id = fields.Integer(
+        allow_none=True,
+        load_default=None,
+        validate=validate.Range(min=1),
+        error_messages={'invalid': _l('Équipe invalide.')},
+    )
+    kpi_metric = fields.String(
+        allow_none=True,
+        load_default=None,
+        validate=validate.Length(max=120),
+    )
+    kpi_target = fields.Decimal(
+        allow_none=True,
+        load_default=None,
+        places=2,
+        error_messages={'invalid': _l('Cible KPI invalide.')},
+    )
+    kpi_unit = fields.String(
+        allow_none=True,
+        load_default=None,
+        validate=validate.Length(max=20),
+    )
+    kpi_precision = fields.Integer(
+        allow_none=True,
+        load_default=None,
+        validate=validate.Range(min=0, max=10),
+    )
+    start_date = fields.Date(
+        allow_none=True,
+        load_default=None,
+        format='%Y-%m-%d',
+        error_messages={'invalid': _l('Date de début invalide (AAAA-MM-JJ).')},
+    )
+    due_date = fields.Date(
+        required=True,
+        format='%Y-%m-%d',
+        error_messages={
+            'required': _l('La date d\'échéance est obligatoire.'),
+            'invalid': _l('Date d\'échéance invalide (AAAA-MM-JJ).'),
+        },
+    )
+    check_frequency = fields.String(
+        allow_none=True,
+        load_default=None,
+        validate=validate.OneOf(
+            [''] + [v for v, _ in OBJECTIVE_CHECK_FREQUENCIES],
+            error=_l('Fréquence de vérification invalide.'),
+        ),
+    )
+    progress = fields.Integer(
+        load_default=0,
+        validate=validate.Range(
+            min=0, max=100, error=_l('La progression doit être entre 0 et 100.')
+        ),
+    )
+    tags = fields.String(
+        allow_none=True,
+        load_default=None,
+        validate=validate.Length(max=255),
+    )
+
+    @validates_schema
+    def validate_assignment(self, data, **kwargs):
+        """Type-aware assignment: coerce to a clean state.
+
+        - Templates → no player or team.
+        - Team objectives → clear player_id.
+        - Individual objectives → clear team_id.
+        """
+        if data.get('is_template'):
+            data['player_id'] = None
+            data['team_id'] = None
+            return
+        if data.get('type') == 'team':
+            data['player_id'] = None
+        else:
+            data['team_id'] = None

docs/database-restore.md

@@ -15,6 +15,7 @@ incident.
 |---|---|---|
 | `db_backup_<timestamp>.dump` | Full PostgreSQL dump, custom format | Every account, tryout, evaluation, note and contract record |
 | `documents_backup_<timestamp>.zip` | `documents/` directory | The contract **files** themselves — they exist only on disk, the database stores paths |
+| `documents_backup_drive_<timestamp>.zip` | Google Drive contract folder | Drive-stored contracts downloaded and archived when `DOCUMENT_STORAGE_BACKEND=google_drive` |
 
 Losing either one alone loses data. A database restore without the document
 archive leaves contract rows pointing at files that no longer exist.

docs/deployment.md

@@ -67,6 +67,28 @@ documents every variable. Copying it verbatim gives a configuration that
 refuses to start until `SECRET_KEY` and `DATABASE_URL` are filled in, rather
 than one that starts and is wide open (OPS-003).
 
+### Google Drive contract storage
+
+New contracts are stored in the owner's personal Google Drive when
+`DOCUMENT_STORAGE_BACKEND=google_drive`. Enable the Google Drive API in a
+Google Cloud project, create an OAuth client for the owner, and authorize it
+once with the `drive.file` scope. Configure the resulting values outside the
+repository:
+
+```text
+DOCUMENT_STORAGE_BACKEND=google_drive
+GOOGLE_DRIVE_FOLDER_ID=<owner folder id>
+GOOGLE_DRIVE_CLIENT_ID=<OAuth client id>
+GOOGLE_DRIVE_CLIENT_SECRET=<OAuth client secret>
+GOOGLE_DRIVE_REFRESH_TOKEN=<owner refresh token>
+```
+
+The refresh token can create, download, and delete contracts created by this
+application. Keep all four values out of source control. The database stores
+only `gdrive://<file-id>` references, so existing local-file rows continue to
+work after the change. Use `DOCUMENT_STORAGE_BACKEND=local` only for tests,
+local development, or while migrating legacy files.
+
 ### Binding and proxy trust — read this before going live (OPS-002)
 
 Two variables decide whether the rate limiter, the account lockout and the

docs/security-checklist.md

@@ -82,8 +82,9 @@ Run through this checklist before deploying to production.
 
 - [ ] Upload size limited to 16MB (`MAX_CONTENT_LENGTH`)
 - [ ] File extensions restricted to PDF only
+- [ ] File content validated by parsing with pypdf (`PdfReader`) — header (`%PDF-`) + at least one parseable page
 - [ ] Files stored with UUID filenames (not original names)
-- [ ] Upload directory outside web root
+- [ ] Upload directory outside web root (or Google Drive in production)
 
 ## Phase 13 — Logging & Monitoring
 

docs/translations.md

@@ -170,8 +170,8 @@ was marked by the automated pass. Jinja escaped it to `×`, so
 the button would have shown the literal text `×` instead of ×.
 Anything that is markup rather than prose must stay out of `_()`.
 
-**Strings inside `<script>` blocks.** Eight remain, in `match_form.html`,
+**Strings inside `<script>` blocks.** Seven remain, in `match_form.html` and
-`one_on_one.html` and `coach_availability.html`. They work, but they are
+`one_on_one.html`. They work, but they are
 fragile: Jinja escapes `& < > " '` inside a script block, and those
 entities are *not* decoded there — a translation containing an apostrophe
 would land in the JavaScript string as `&#39;`. The French wording uses

pyproject.toml

@@ -31,7 +31,7 @@ show_missing = true
 
 [tool.ruff]
 line-length = 100
-target-version = "py312"
+target-version = "py313"
 exclude = [".venv", "venv", "migrations", "docs"]
 
 [tool.ruff.lint]

requirements.txt

@@ -24,6 +24,9 @@ Flask-SQLAlchemy==3.1.1
 Flask-WTF==1.3.0
 frozenlist==1.8.0
 greenlet==3.5.4
+google-api-python-client==2.198.0
+google-auth==2.56.3
+pypdf==6.16.2
 idna==3.18
 itsdangerous==2.2.0
 Jinja2==3.1.6

run.py

@@ -25,9 +25,57 @@ import sys
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
 from app.app import create_app  # noqa: E402
+from app.extensions import db as _db  # noqa: E402
+from app.extensions import hash_password  # noqa: E402
+from app.local_postgres import start as start_local_pg  # noqa: E402
+from app.models import Admin, Coach, Manager, Player  # noqa: E402
+
+# ==========================================================================
+# Local PostgreSQL (development only)
+# ==========================================================================
+if os.getenv('LOCAL_PG', '').lower() == 'true':
+    os.environ['DATABASE_URL'] = start_local_pg()
+
+# ==========================================================================
 
 if __name__ == '__main__':
     app = create_app()
+
+    # --- Seed the database with default test users (idempotent) ---------
+    with app.app_context():
+        if not Admin.query.first():
+            print('[INFO] Seeding database with default test users ...')
+            users = [
+                Admin(username='admin', role='admin', full_name='Admin', email='[email protected]'),
+                Coach(
+                    username='coach',
+                    role='coach',
+                    full_name='Coach Test',
+                    email='[email protected]',
+                ),
+                Manager(
+                    username='manager',
+                    role='manager',
+                    full_name='Manager Test',
+                    email='[email protected]',
+                ),
+                Player(
+                    username='player',
+                    role='player',
+                    full_name='Player Test',
+                    email='[email protected]',
+                ),
+            ]
+            for u in users:
+                u.password_hash = hash_password('password')
+                _db.session.add(u)
+            _db.session.commit()
+            print('[INFO] Seeded 4 default users (password for all: password).')
+
+        # Seed default objective templates (idempotent)
+        from app.routes.objectives import seed_default_templates
+        seed_default_templates()
+
     debug_mode = os.getenv('FLASK_DEBUG', 'false').lower() == 'true'
     if debug_mode:
         app.logger.warning(

scripts/gen_list_page.py

@@ -0,0 +1,62 @@
+import pathlib
+tmpl = '''{% extends "layouts/base.html" %}
+{% import 'layouts/_pagination.html' as pager %}
+{% block title %}{{ _('Objectives') }} - UdeS team manager{% endblock %}
+{% block page_title %}{{ _('Objective Management') }}{% endblock %}
+{% block breadcrumb %}<span class="breadcrumb">{{ _('Home') }} / {{ _('Objectives') }}</span>{% endblock %}
+{% block content %}
+<div class="stats-grid mb-4">
+    <div class="stat-card"><div class="stat-icon bg-primary"><i class="fas fa-flag-checkered"></i></div><div class="stat-info"><h3>{{ count_total }}</h3><p>{{ _('Total') }}</p></div></div>
+    <div class="stat-card"><div class="stat-icon bg-info"><i class="fas fa-chart-line"></i></div><div class="stat-info"><h3>{{ count_kpi }}</h3><p>{{ _('Custom KPIs') }}</p></div></div>
+    <div class="stat-card"><div class="stat-icon bg-secondary"><i class="fas fa-copy"></i></div><div class="stat-info"><h3>{{ count_templates }}</h3><p>{{ _('Templates') }}</p></div></div>
+    <div class="stat-card"><div class="stat-icon bg-success"><i class="fas fa-percentage"></i></div><div class="stat-info"><h3>{{ success_rate }}%</h3><p>{{ _('Success rate') }}</p></div></div>
+</div>
+<div class="card mb-4"><div class="card-body"><div class="objectives-toolbar">
+<nav class="objectives-tabs" role="tablist">
+<a href="{{ url_for('objectives.list_objectives', tab='all') }}" class="tab-link {% if tab == 'all' %}active{% endif %}">{{ _('All') }} ({{ count_total }})</a>
+<a href="{{ url_for('objectives.list_objectives', tab='kpi') }}" class="tab-link {% if tab == 'kpi' %}active{% endif %}">{{ _('Custom KPIs') }} ({{ count_kpi }})</a>
+<a href="{{ url_for('objectives.list_objectives', tab='modeles') }}" class="tab-link {% if tab in ('modeles','templates') %}active{% endif %}">{{ _('Templates') }} ({{ count_templates }})</a>
+</nav>
+<form method="GET" action="{{ url_for('objectives.list_objectives') }}" class="objectives-search-bar">
+<input type="hidden" name="tab" value="{{ tab }}">
+<div class="form-inline">
+<div class="form-group" style="flex:1;min-width:200px;"><input type="text" name="search" class="form-input" placeholder="{{ _('Search an objective...') }}"></div>
+<div class="form-group"><select name="status" class="form-select"><option value="">{{ _('Status') }}</option>{% for val, label in objective_statuses %}<option value="{{ val }}"{% if f_status == val %} selected{% endif %}>{{ label }}</option>{% endfor %}</select></div>
+<div class="form-group"><select name="priority" class="form-select"><option value="">{{ _('Priority') }}</option>{% for val, label in objective_priorities %}<option value="{{ val }}"{% if f_priority == val %} selected{% endif %}>{{ label }}</option>{% endfor %}</select></div>
+<div class="form-group"><select name="type" class="form-select"><option value="">{{ _('Type') }}</option>{% for val, label in objective_types %}<option value="{{ val }}"{% if f_type == val %} selected{% endif %}>{{ label }}</option>{% endfor %}</select></div>
+<div class="form-group"><select name="team" class="form-select"><option value="">{{ _('Team') }}</option>{% for t in teams %}<option value="{{ t.id }}"{% if f_team == t.id %} selected{% endif %}>{{ t.name }}</option>{% endfor %}</select></div>
+<button type="submit" class="btn btn-sm btn-primary"><i class="fas fa-filter"></i> {{ _('Filters') }}</button>
+</div></form>
+</div></div></div>
+<div class="card"><div class="card-header"><h3><i class="fas fa-bullseye"></i> {{ _('Objectives') }}</h3>{% if can_edit %}<a href="{{ url_for('objectives.new_objective') }}" class="btn btn-sm btn-primary"><i class="fas fa-plus"></i> {{ _('New Objective') }}</a>{% endif %}</div>
+<div class="card-body"><div class="table-container"><table class="table objectives-table"><thead><tr>
+<th>{{ _('Objective') }}</th><th>{{ _('Assigned to') }}</th><th>{{ _('Team') }}</th><th>{{ _('Priority') }}</th><th>{{ _('Status') }}</th><th>{{ _('Target KPI') }}</th><th>{{ _('Progress') }}</th><th>{{ _('Deadline') }}</th>{% if can_edit %}<th>{{ _('Actions') }}</th>{% endif %}
+</tr></thead><tbody>
+'''
+pathlib.Path('app/templates/pages/objectives.html').write_text(tmpl, encoding='utf-8')
+print('LIST_PAGE_PART1_OK')
+
+tmpl2 = '''{% for obj in objectives.items %}<tr data-objective-id="{{ obj.id }}">
+<td><strong>{{ obj.title }}</strong>{% if obj.tags %}<div class="objective-tags">{% for tag in obj.tags.split(',') %}<span class="badge badge-light">{{ tag.strip() }}</span>{% endfor %}</div>{% endif %}{% if obj.kpi_metric %}<small class="text-muted d-block">{{ obj.kpi_metric }}</small>{% endif %}</td>
+<td>{% if obj.player %}<span class="user-avatar avatar-sm">{{ obj.player.username[:2]|upper }}</span> {{ obj.player.username }}{% else %}<span class="text-muted">-</span>{% endif %}</td>
+<td>{% if obj.team %}{{ obj.team.name }}{% else %}<span class="text-muted">-</span>{% endif %}</td>
+<td>{% set pc = {'high':'badge-danger','medium':'badge-warning','low':'badge-secondary'} %}<span class="badge {{ pc.get(obj.priority,'badge-secondary') }}">{{ {'high':_('High'),'medium':_('Medium'),'low':_('Low')}.get(obj.priority,obj.priority) }}</span></td>
+<td>{% set sc = {'active':'badge-success','pending':'badge-warning','completed':'badge-info','overdue':'badge-danger'} %}<span class="badge {{ sc.get(obj.status,'badge-secondary') }}">{% for val, label in objective_statuses %}{% if val == obj.status %}{{ label }}{% endif %}{% endfor %}</span></td>
+<td>{% if obj.kpi_target is not none %}{{ obj.kpi_target }}{% if obj.kpi_unit %}{{ obj.kpi_unit }}{% endif %}{% else %}<span class="text-muted">-</span>{% endif %}</td>
+<td><div class="progress-bar-container"><div class="progress-bar" style="width:{{ obj.progress }}%"></div></div><small>{{ obj.progress }}%</small></td>
+<td>{% if obj.due_date %}{{ obj.due_date.strftime('%Y-%m-%d') }}{% endif %}</td>
+{% if can_edit %}<td class="actions-cell"><a href="{{ url_for('objectives.edit_objective', objective_id=obj.id) }}" class="btn btn-sm btn-outline-primary" title="{{ _('Edit') }}"><i class="fas fa-edit"></i></a> <button class="btn btn-sm btn-outline-danger" onclick="showDeleteModal({{ obj.id }}, '{{ obj.title|e }}')" title="{{ _('Delete') }}"><i class="fas fa-trash"></i></button></td>{% endif %}
+</tr>{% else %}
+<tr><td colspan="{{ 9 if can_edit else 8 }}" class="text-center"><div class="empty-state"><i class="fas fa-bullseye"></i><h3>{{ _('No objectives yet') }}</h3><p>{{ _('Create your first objective to start tracking player evolution.') }}</p></div></td></tr>{% endfor %}
+</tbody></table></div>{{ pager.controls(pagination) }}</div></div>
+<div id="deleteModal" class="modal hidden"><div class="modal-backdrop" onclick="hideDeleteModal();"></div><div class="modal-content"><div class="modal-header"><h3><i class="fas fa-trash-alt"></i> {{ _('Delete Objective') }}</h3><button class="modal-close" onclick="hideDeleteModal();">&times;</button></div><div class="modal-body"><p>{{ _('Are you sure you want to delete this objective?') }}</p><p><strong id="deleteObjTitle"></strong></p><form id="deleteForm" method="POST" action=""><input type="hidden" name="csrf_token" value="{{ csrf_token() }}"><div class="form-actions"><button type="button" class="btn btn-secondary" onclick="hideDeleteModal();">{{ _('Cancel') }}</button><button type="submit" class="btn btn-danger"><i class="fas fa-trash"></i> {{ _('Delete') }}</button></div></form></div></div></div>
+{% endblock %}
+{% block scripts %}<script>
+function showDeleteModal(i,t){document.getElementById('deleteObjTitle').textContent=t;document.getElementById('deleteForm').action='{{ url_for("objectives.delete_objective", objective_id=0) }}'.replace('/0/','/'+i+'/');document.getElementById('deleteModal').classList.remove('hidden');}
+function hideDeleteModal(){document.getElementById('deleteModal').classList.add('hidden');}
+document.addEventListener('keydown',function(e){if(e.key==='Escape'){hideDeleteModal();}});
+</script>{% endblock %}
+'''
+with open('app/templates/pages/objectives.html', 'a', encoding='utf-8') as f:
+    f.write(tmpl2)
+print('LIST_PAGE_DONE')

scripts/gen_view_page.py

@@ -0,0 +1,69 @@
+import pathlib
+t = """{% extends "layouts/base.html" %}
+{% block title %}{{ objective.title }} - UdeS team manager{% endblock %}
+{% block page_title %}{{ objective.title }}{% endblock %}
+{% block breadcrumb %}<span class="breadcrumb">{{ _('Home') }} / <a href="{{ url_for('objectives.list_objectives') }}">{{ _('Objectives') }}</a> / {{ objective.title }}</span>{% endblock %}
+{% block content %}
+<div class="row">
+  <div class="col-8">
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-bullseye"></i> {{ objective.title }}</h3></div>
+      <div class="card-body">
+        <p>{{ objective.description or '' }}</p>
+        <div class="preview-stats">
+          <div class="preview-stat"><span class="preview-label">{{ _('Type') }}</span><span class="preview-value">{% for val, label in objective_types %}{% if val == objective.type %}{{ label }}{% endif %}{% endfor %}</span></div>
+          <div class="preview-stat"><span class="preview-label">{{ _('Assigned to') }}</span><span class="preview-value">{% if objective.player %}{{ objective.player.username }}{% elif objective.team %}{{ objective.team.name }}{% else %}-{% endif %}</span></div>
+          <div class="preview-stat"><span class="preview-label">{{ _('Category') }}</span><span class="preview-value">{{ objective.category or '-' }}</span></div>
+        </div>
+        <div class="mt-3">
+          <span id="statusBadge" class="badge">{% for val, label in objective_statuses %}{% if val == objective.status %}{{ label }}{% endif %}{% endfor %}</span>
+          <span id="priorityBadge" class="badge">{% set pl = {'high':_('High'),'medium':_('Medium'),'low':_('Low')} %}{{ pl.get(objective.priority,objective.priority) }}</span>
+        </div>
+      </div>
+    </div>
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-chart-line"></i> {{ _('KPI Progression') }}</h3></div>
+      <div class="card-body">
+        <svg id="progressChart" viewBox="0 0 400 200" style="width:100%;height:auto;" xmlns="http://www.w3.org/2000/svg"></svg>
+        {% if objective.kpi_target %}<div class="mt-2 text-center" id="predictionInfo"></div>{% endif %}
+      </div>
+    </div>
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-database"></i> {{ _('KPI Measurements') }}</h3></div>
+      <div class="card-body">
+        <form method="POST" action="{{ url_for('objectives.add_entry', objective_id=objective.id) }}" class="form-inline">
+          <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+          <div class="form-group" style="flex:1;"><input type="number" step="0.01" name="value" class="form-input" placeholder="{{ _('Value (optional)') }}"></div>
+          <div class="form-group" style="flex:2;"><input type="text" name="note" class="form-input" placeholder="{{ _('Note or comment') }}"></div>
+          <button type="submit" class="btn btn-sm btn-primary"><i class="fas fa-plus"></i> {{ _('Record') }}</button>
+        </form>
+        {% if entries %}<table class="table mt-2"><thead><tr><th>{{ _('Date') }}</th><th>{{ _('Value') }}</th><th>{{ _('Note') }}</th></tr></thead><tbody>
+{% for e in entries %}<tr><td>{{ e.recorded_at.strftime('%%Y-%%m-%%d %%H:%%M') }}</td><td><strong>{% if e.value is not none %}{{ e.value }}{% else %}-{% endif %}</strong></td><td class="text-muted small">{{ e.note or '' }}</td></tr>{% endfor %}</tbody></table>{% else %}<p class="text-muted mt-2">{{ _('No measurements recorded yet.') }}</p>{% endif %}
+      </div>
+    </div>
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-comments"></i> {{ _('Comments') }}</h3></div>
+      <div class="card-body">{% if comments %}<div class="comments-list">{% for c in comments %}<div class="comment-item"><strong>{{ c.coach.username }}</strong> <span class="text-muted small">{{ c.created_at.strftime('%%Y-%%m-%%d %%H:%%M') }}</span><p>{{ c.content }}</p></div>{% endfor %}</div>{% else %}<p class="text-muted">{{ _('No comments yet.') }}</p>{% endif %}</div>
+    </div>
+  </div>
+  <div class="col-4">
+    <div class="card mb-4">
+      <div class="card-header"><h3><i class="fas fa-info-circle"></i> {{ _('Details') }}</h3></div>
+      <div class="card-body">
+        <div class="preview-stats">
+          <div class="preview-stat"><span class="preview-label">{{ _('Priority') }}</span><span class="preview-value">{% set pl = {'high':_('High'),'medium':_('Medium'),'low':_('Low')} %}{{ pl.get(objective.priority,objective.priority) }}</span></div>
+          <div class="preview-stat"><span class="preview-label">{{ _('Status') }}</span><span class="preview-value">{% for val, label in objective_statuses %}{% if val == objective.status %}{{ label }}{% endif %}{% endfor %}</span></div>
+          <div class="preview-stat"><span class="preview-label">{{ _('Start date') }}</span><span class="preview-value">{{ objective.start_date.strftime('%%Y-%%m-%%d') if objective.start_date else '-' }}</span></div>
+          <div class="preview-stat"><span class="preview-label">{{ _('Deadline') }}</span><span class="preview-value">{{ objective.due_date.strftime('%%Y-%%m-%%d') if objective.due_date else '-' }}</span></div>
+          <div class="preview-stat"><span class="preview-label">{{ _('Progress') }}</span><span class="preview-value">{{ objective.progress }}%</span></div>
+        </div>
+        {% if objective.kpi_target %}<div class="progress-section mt-2"><span class="preview-label">{{ _('KPI Target') }}</span><strong>{{ objective.kpi_target }}{% if objective.kpi_unit %}{{ objective.kpi_unit }}{% endif %}</strong></div>{% endif %}
+        {% if can_edit %}<a href="{{ url_for('objectives.edit_objective', objective_id=objective.id) }}" class="btn btn-sm btn-primary mt-3"><i class="fas fa-edit"></i> {{ _('Edit') }}</a>{% endif %}
+      </div>
+    </div>
+    {% if personal_notes or team_notes %}<div class="card mb-4"><div class="card-header"><h3><i class="fas fa-sticky-note"></i> {{ _('Related Notes') }}</h3></div><div class="card-body">{% if personal_notes %}<h5>{{ _('Personal Notes') }}</h5>{% for n in personal_notes %}<div class="comment-item"><strong>{{ n.coach.username }}</strong> <span class="text-muted small">{{ n.created_at.strftime('%%Y-%%m-%%d') }}</span><p>{{ n.content[:200] }}</p></div>{% endfor %}{% endif %}{% if team_notes %}<h5 class="mt-2">{{ _('Team Notes') }}</h5>{% for n in team_notes %}<div class="comment-item"><strong>{{ n.coach.username }}</strong> <span class="text-muted small">{{ n.created_at.strftime('%%Y-%%m-%%d') }}</span><p>{{ n.content[:200] }}</p></div>{% endfor %}{% endif %}</div></div>{% endif %}
+  </div>
+</div>{% endblock %}
+"""
+pathlib.Path('app/templates/pages/objective_view.html').write_text(t, encoding='utf-8')
+print('OK')

tests/conftest.py

@@ -80,6 +80,7 @@ def documents_in_a_throwaway_directory(tmp_path, monkeypatch):
     cannot leave a PDF in someone's working tree.
     """
     monkeypatch.setenv('DOCUMENTS_ROOT', str(tmp_path / 'documents'))
+    monkeypatch.setenv('DOCUMENT_STORAGE_BACKEND', 'local')
 
 
 @pytest.fixture
@@ -194,6 +195,11 @@ def as_role(app, client, make_user, login):
             from app.models import User
 
             username = _db.session.get(User, user_id).username
+        # The login route short-circuits when the client is already
+        # authenticated, so a previous as_role() call would otherwise leave
+        # the old identity in the session and the switch would silently not
+        # happen (ADMIN-010: coach/manager gate tests ran as admin).
+        client.post('/auth/logout', follow_redirects=False)
         response = login(username)
         assert response.status_code in (301, 302), (
             f'login for {username} did not redirect: {response.status_code}'

tests/test_admin_app_settings.py

@@ -0,0 +1,62 @@
+"""AppSettings key-value store — model behaviour.
+
+ADMIN-001. The admin panel relies on AppSettings for global toggles
+(tryouts_open, season_active, season_name, season_start, season_end).
+These tests verify the key-value store itself, independent of any route.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import AppSettings
+
+
+class TestAppSettingsGetSet:
+    def test_get_returns_default_for_missing_key(self, app):
+        with app.app_context():
+            assert AppSettings.get('nonexistent', 'fallback') == 'fallback'
+
+    def test_set_and_get_roundtrip(self, app):
+        with app.app_context():
+            AppSettings.set('test_key', 'hello')
+            assert AppSettings.get('test_key') == 'hello'
+
+    def test_set_overwrites_existing_key(self, app):
+        with app.app_context():
+            AppSettings.set('overwrite_key', 'first')
+            AppSettings.set('overwrite_key', 'second')
+            assert AppSettings.get('overwrite_key') == 'second'
+
+    def test_set_none_value_is_stored_as_none(self, app):
+        with app.app_context():
+            AppSettings.set('nullable_key', None)
+            assert AppSettings.get('nullable_key') is None
+
+
+class TestAppSettingsBool:
+    def test_get_bool_parses_true_values(self, app):
+        with app.app_context():
+            for val in ('true', 'True', 'TRUE', '1', 'yes', 'on'):
+                AppSettings.set('bool_test', val)
+                assert AppSettings.get_bool('bool_test'), f'{val!r} should be True'
+
+    def test_get_bool_parses_false_values(self, app):
+        with app.app_context():
+            for val in ('false', 'False', 'FALSE', '0', 'no', 'off', 'anything_else'):
+                AppSettings.set('bool_test', val)
+                assert not AppSettings.get_bool('bool_test'), f'{val!r} should be False'
+
+    def test_get_bool_defaults_to_false_for_missing_key(self, app):
+        with app.app_context():
+            assert not AppSettings.get_bool('does_not_exist')
+
+    def test_get_bool_respects_custom_default(self, app):
+        with app.app_context():
+            assert AppSettings.get_bool('does_not_exist', default=True)
+
+    def test_set_bool_stores_as_string(self, app):
+        with app.app_context():
+            AppSettings.set_bool('bool_key', True)
+            assert AppSettings.get('bool_key') == 'true'
+            AppSettings.set_bool('bool_key', False)
+            assert AppSettings.get('bool_key') == 'false'

tests/test_admin_audit_log.py

@@ -0,0 +1,61 @@
+"""AuditLog model — append-only admin action tracking.
+
+ADMIN-002. Every sensitive admin action (backup, restore, toggle, season,
+wipe) writes an AuditLog entry. These tests verify the model itself.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import AuditLog, User
+
+
+class TestAuditLogRecord:
+    def test_record_stores_all_fields(self, app, make_user):
+        admin_id = make_user('admin')
+        with app.app_context():
+            AuditLog.record(
+                user_id=admin_id,
+                action='test_action',
+                details='some details here',
+                ip_address='192.168.1.1',
+            )
+            entry = AuditLog.query.order_by(AuditLog.id.desc()).first()
+            assert entry is not None
+            assert entry.user_id == admin_id
+            assert entry.action == 'test_action'
+            assert entry.details == 'some details here'
+            assert entry.ip_address == '192.168.1.1'
+            assert entry.created_at is not None
+
+    def test_record_without_details_or_ip(self, app, make_user):
+        admin_id = make_user('admin')
+        with app.app_context():
+            AuditLog.record(user_id=admin_id, action='minimal')
+            entry = AuditLog.query.order_by(AuditLog.id.desc()).first()
+            assert entry.action == 'minimal'
+            assert entry.details is None
+            assert entry.ip_address is None
+
+    def test_entries_are_ordered_by_date_descending(self, app, make_user):
+        admin_id = make_user('admin')
+        with app.app_context():
+            AuditLog.record(user_id=admin_id, action='first')
+            AuditLog.record(user_id=admin_id, action='second')
+            AuditLog.record(user_id=admin_id, action='third')
+
+            entries = AuditLog.query.order_by(AuditLog.created_at.desc()).all()
+            actions = [e.action for e in entries]
+            assert actions == ['third', 'second', 'first']
+
+    def test_audit_log_survives_user_deletion(self, app, make_user):
+        admin_id = make_user('admin')
+        with app.app_context():
+            AuditLog.record(user_id=admin_id, action='before_delete')
+            user = db.session.get(User, admin_id)
+            db.session.delete(user)
+            db.session.commit()
+
+            entry = AuditLog.query.filter_by(action='before_delete').first()
+            assert entry is not None
+            assert entry.user_id is None  # FK set to NULL on delete

tests/test_admin_backup.py

@@ -0,0 +1,285 @@
+"""Admin backup — create, download, delete, restore, and audit trail.
+
+ADMIN-008. The backup buttons on the admin panel run pg_dump/pg_restore
+in production, but tests mock the subprocess boundary. These tests verify
+the route logic, the BackupRecord model, and audit logging.
+"""
+
+import os
+
+import pytest
+
+from app.extensions import db
+from app.models import AuditLog, BackupRecord
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+class TestBackupCreate:
+    def test_create_backup_succeeds(self, app, client, as_role, monkeypatch):
+        import app.routes.admin as admin_module
+        from app.supporting_scripts.backup import BackupError
+
+        def fake_create_backup_record(backup_type='manual', notes=None):
+            from app.models import BackupRecord
+
+            record = BackupRecord(
+                filename='db_backup_test.dump',
+                file_path='/tmp/db_backup_test.dump',
+                size_bytes=1234,
+                backup_type=backup_type,
+                notes=notes,
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            return record
+
+        monkeypatch.setattr(admin_module, '_create_backup_record', fake_create_backup_record)
+
+        as_role('admin')
+        response = client.post(
+            '/admin/backup/create', data={'notes': 'test backup'}, follow_redirects=False,
+        )
+        assert _redirected(response)
+
+        with app.app_context():
+            record = BackupRecord.query.filter_by(filename='db_backup_test.dump').first()
+            assert record is not None
+            assert record.notes == 'test backup'
+
+    def test_create_backup_failure_is_handled(self, app, client, as_role, monkeypatch):
+        import app.routes.admin as admin_module
+        from app.supporting_scripts.backup import BackupError
+
+        def fake_create_backup_record(backup_type='manual', notes=None):
+            raise BackupError('pg_dump not found')
+
+        monkeypatch.setattr(admin_module, '_create_backup_record', fake_create_backup_record)
+
+        as_role('admin')
+        response = client.post(
+            '/admin/backup/create', data={}, follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'Backup failed' in html
+
+    def test_create_backup_creates_audit_log(self, app, client, as_role, monkeypatch):
+        import app.routes.admin as admin_module
+
+        def fake_create_backup_record(backup_type='manual', notes=None):
+            from app.models import BackupRecord
+
+            record = BackupRecord(
+                filename='db_backup_test.dump',
+                file_path='/tmp/db_backup_test.dump',
+                size_bytes=1234,
+                backup_type=backup_type,
+                notes=notes,
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            return record
+
+        monkeypatch.setattr(admin_module, '_create_backup_record', fake_create_backup_record)
+
+        as_role('admin')
+        client.post('/admin/backup/create', data={}, follow_redirects=False)
+
+        with app.app_context():
+            entry = AuditLog.query.filter_by(action='backup_created').first()
+            assert entry is not None
+
+
+class TestBackupDownload:
+    def test_download_existing_backup(self, app, client, as_role, tmp_path):
+        from app.models import BackupRecord
+
+        backup_file = tmp_path / 'db_backup_test.dump'
+        backup_file.write_text('fake dump content')
+
+        as_role('admin')
+        with app.app_context():
+            record = BackupRecord(
+                filename='db_backup_test.dump',
+                file_path=str(backup_file),
+                size_bytes=18,
+                backup_type='manual',
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            record_id = record.id
+
+        response = client.get(f'/admin/backup/{record_id}/download')
+        assert response.status_code == 200
+        assert response.data == b'fake dump content'
+
+    def test_download_missing_backup_file(self, app, client, as_role):
+        from app.models import BackupRecord
+
+        as_role('admin')
+        with app.app_context():
+            record = BackupRecord(
+                filename='missing.dump',
+                file_path='/nonexistent/missing.dump',
+                size_bytes=0,
+                backup_type='manual',
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            record_id = record.id
+
+        response = client.get(
+            f'/admin/backup/{record_id}/download', follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'missing from disk' in html.lower()
+
+
+class TestBackupDelete:
+    def test_delete_backup_removes_record_and_file(self, app, client, as_role, tmp_path):
+        from app.models import BackupRecord
+
+        backup_file = tmp_path / 'db_backup_delete.dump'
+        backup_file.write_text('fake dump content')
+
+        as_role('admin')
+        with app.app_context():
+            record = BackupRecord(
+                filename='db_backup_delete.dump',
+                file_path=str(backup_file),
+                size_bytes=18,
+                backup_type='manual',
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            record_id = record.id
+
+        response = client.post(
+            f'/admin/backup/{record_id}/delete', follow_redirects=False,
+        )
+        assert _redirected(response)
+
+        with app.app_context():
+            assert BackupRecord.query.get(record_id) is None
+        assert not backup_file.exists()
+
+    def test_delete_backup_creates_audit_log(self, app, client, as_role, tmp_path):
+        from app.models import BackupRecord
+
+        backup_file = tmp_path / 'db_backup_delete2.dump'
+        backup_file.write_text('fake')
+
+        as_role('admin')
+        with app.app_context():
+            record = BackupRecord(
+                filename='db_backup_delete2.dump',
+                file_path=str(backup_file),
+                size_bytes=4,
+                backup_type='manual',
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            record_id = record.id
+
+        client.post(f'/admin/backup/{record_id}/delete', follow_redirects=False)
+
+        with app.app_context():
+            entry = AuditLog.query.filter_by(action='backup_deleted').first()
+            assert entry is not None
+
+
+class TestBackupRestore:
+    def test_restore_with_missing_file_fails(self, app, client, as_role):
+        from app.models import BackupRecord
+
+        as_role('admin')
+        with app.app_context():
+            record = BackupRecord(
+                filename='missing_restore.dump',
+                file_path='/nonexistent/missing_restore.dump',
+                size_bytes=0,
+                backup_type='manual',
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            record_id = record.id
+
+        response = client.post(
+            f'/admin/backup/{record_id}/restore', follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'missing from disk' in html.lower()
+
+    def test_restore_creates_safety_backup_first(
+        self, app, client, as_role, monkeypatch, tmp_path
+    ):
+        import app.routes.admin as admin_module
+
+        # The restore route parses DATABASE_URL outside its try block.
+        monkeypatch.setenv('DATABASE_URL', 'postgresql://appuser:[email protected]:5432/tryouts')
+
+        backup_file = tmp_path / 'db_backup_restore.dump'
+        backup_file.write_text('fake')
+
+        safety_file = tmp_path / 'db_backup_safety.dump'
+        safety_file.write_text('fake safety')
+
+        as_role('admin')
+        with app.app_context():
+            from app.models import BackupRecord
+
+            record = BackupRecord(
+                filename='db_backup_restore.dump',
+                file_path=str(backup_file),
+                size_bytes=4,
+                backup_type='manual',
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            record_id = record.id
+
+        def fake_create_backup_record(backup_type='pre_restore', notes=None):
+            from app.models import BackupRecord
+
+            record = BackupRecord(
+                filename='db_backup_safety.dump',
+                file_path=str(safety_file),
+                size_bytes=12,
+                backup_type=backup_type,
+                notes=notes,
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            return record
+
+        monkeypatch.setattr(admin_module, '_create_backup_record', fake_create_backup_record)
+
+        import subprocess
+
+        def fake_subprocess_run(cmd, env=None, capture_output=True, text=True, timeout=None):
+            class Result:
+                returncode = 0
+                stderr = ''
+                stdout = ''
+
+            return Result()
+
+        monkeypatch.setattr(subprocess, 'run', fake_subprocess_run)
+
+        client.post(f'/admin/backup/{record_id}/restore', follow_redirects=False)
+
+        with app.app_context():
+            safety = BackupRecord.query.filter_by(filename='db_backup_safety.dump').first()
+            assert safety is not None
+            assert safety.backup_type == 'pre_restore'

tests/test_admin_csrf.py

@@ -0,0 +1,56 @@
+"""Admin panel — CSRF protection on mutation endpoints.
+
+ADMIN-005. Every admin POST route must reject requests that lack a valid
+CSRF token. These tests use the app_with_csrf fixture where CSRF is
+enabled, unlike the default app fixture which disables it.
+"""
+
+import pytest
+
+
+ADMIN_POST_ROUTES = [
+    '/admin/backup/create',
+    '/admin/toggle-tryouts',
+    '/admin/season/start',
+    '/admin/season/end',
+    '/admin/teams/wipe',
+]
+
+
+class TestAdminCsrfProtection:
+    @pytest.mark.parametrize('route', ADMIN_POST_ROUTES)
+    def test_post_without_csrf_is_rejected(self, app_with_csrf, route):
+        """Every admin POST route must reject a missing CSRF token."""
+        # as_role uses the default app fixture, so we log in manually
+        # with the csrf-enabled app.
+        from app.extensions import db as _db
+        from app.models import User
+
+        client = app_with_csrf.test_client()
+
+        # Create and log in an admin on the CSRF-enabled app
+        with app_with_csrf.app_context():
+            from app.extensions import hash_password
+            from app.models import Admin
+
+            admin = Admin(
+                username='csrfadmin',
+                password_hash=hash_password('Password123'),
+                role='admin',
+                full_name='CSRF Admin',
+                email='[email protected]',
+            )
+            _db.session.add(admin)
+            _db.session.commit()
+
+        client.post(
+            '/auth/login',
+            data={'username': 'csrfadmin', 'password': 'Password123'},
+            follow_redirects=False,
+        )
+
+        response = client.post(route, data={}, follow_redirects=False)
+        # Flask-WTF returns 400 on missing CSRF token
+        assert response.status_code in (400, 302), (
+            f'{route} returned {response.status_code} without CSRF token'
+        )

tests/test_admin_document_uploads_toggle.py

@@ -0,0 +1,135 @@
+"""Admin document-upload toggle — enable/disable gate and enforcement
+on contract upload routes.
+
+ADMIN-006 style. The document_uploads_enabled setting gates every
+contract upload route for non-admins. Admins always bypass the lock.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import AppSettings, Contract, User
+
+NON_ADMIN_ROLES = ['manager', 'coach']
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+class TestDocumentUploadToggle:
+    """Toggle logic — on/off round-trip and audit log."""
+
+    def test_toggle_from_enabled_to_disabled(self, client, as_role):
+        as_role('admin')
+        # Default is enabled
+        client.post('/admin/toggle-document-uploads', data={}, follow_redirects=False)
+        with client.application.app_context():
+            assert not AppSettings.get_bool('document_uploads_enabled', default=True)
+
+    def test_toggle_from_disabled_to_enabled(self, client, as_role):
+        as_role('admin')
+        client.post('/admin/toggle-document-uploads', data={}, follow_redirects=False)
+        client.post('/admin/toggle-document-uploads', data={}, follow_redirects=False)
+        with client.application.app_context():
+            assert AppSettings.get_bool('document_uploads_enabled', default=True)
+
+    def test_toggle_creates_audit_log(self, client, as_role):
+        from app.models import AuditLog
+
+        as_role('admin')
+        client.post('/admin/toggle-document-uploads', data={}, follow_redirects=False)
+
+        with client.application.app_context():
+            entry = AuditLog.query.filter_by(action='document_uploads_toggled').first()
+            assert entry is not None
+
+    def test_default_is_enabled(self, app):
+        with app.app_context():
+            assert AppSettings.get_bool('document_uploads_enabled', default=True)
+
+
+class TestDocumentUploadGateEnforcement:
+    """Non-admin roles are blocked when the toggle is off."""
+
+    def _contract_for(self, app, player_id):
+        """Create a minimal contract for enforcement tests."""
+        from datetime import datetime
+
+        with app.app_context():
+            admin = User.query.filter_by(role='admin').first()
+            contract = Contract(
+                player_id=player_id,
+                uploaded_by_id=admin.id,
+                original_filename='test.pdf',
+                stored_filename='test.pdf',
+                file_path='contrats signes/test.pdf',
+                status='pending_player_signing',
+                uploaded_at=datetime.utcnow(),
+            )
+            db.session.add(contract)
+            db.session.commit()
+            return contract.id
+
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_upload_contract_when_disabled(
+        self, app, client, as_role, make_user, role
+    ):
+        as_role('admin')
+        client.post('/admin/toggle-document-uploads', data={})  # disable
+        as_role(role)
+
+        response = client.post(
+            '/users/contracts/upload',
+            data={'player_id': '', 'contract_file': ''},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        # Default locale is French — the flash message says "désactivés"
+        assert 'désactivés' in html or 'disabled' in html.lower()
+
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_admin_can_always_upload_contract(self, client, as_role, role):
+        as_role('admin')
+        # Pre-create a player for the contract
+
+        as_role('player')
+        client.post('/admin/toggle-document-uploads', data={})  # disable
+
+        # Admin should still be able to reach the upload page
+        response = client.get('/users/contracts/upload', follow_redirects=False)
+        assert _redirected(response) or response.status_code == 200
+
+    def test_player_cannot_upload_signed_when_disabled(self, app, client, as_role, make_user):
+        as_role('admin')
+        client.post('/admin/toggle-document-uploads', data={})  # disable while logged in as admin
+        player_id = make_user('player')
+        contract_id = self._contract_for(app, player_id)
+
+        # Log in as the player
+        with app.app_context():
+            username = db.session.get(User, player_id).username
+        client.post('/auth/login', data={'username': username, 'password': 'Password123'})
+
+        response = client.post(
+            f'/users/contracts/{contract_id}/upload_signed',
+            data={'signed_file': ''},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'désactivés' in html or 'disabled' in html.lower()
+
+    def test_admin_can_always_upload(self, app, client, as_role):
+        as_role('admin')
+        client.post('/admin/toggle-document-uploads', data={})  # disable
+
+        # Admin GET the upload page — should be allowed (not redirected away)
+        response = client.get('/users/contracts/upload', follow_redirects=False)
+        # The admin bypasses the lock so they see the upload form (200)
+        # or get redirected (if no players exist, etc). Either way is fine
+        # as long as it's not the flash about uploads being disabled.
+        body = response.data.decode() if response.status_code == 200 else ''
+        # The toggle flash ("désactivés") could still be present, but the
+        # upload-disabled message ("désactivés") must not appear in the body.
+        # We check for the French lock message specifically.
+        assert 'actuellement désactivés' not in body

tests/test_admin_panel.py

@@ -0,0 +1,150 @@
+"""Admin panel — access control, dashboard rendering, and template integrity.
+
+ADMIN-004. The admin panel at /admin must only be reachable by admins,
+must render all expected sections, and must serve static assets correctly.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import User
+
+
+NON_ADMIN_ROLES = ['player', 'coach', 'manager', 'scout']
+
+ADMIN_MUTATION_ROUTES = [
+    '/admin/backup/create',
+    '/admin/toggle-tryouts',
+    '/admin/season/start',
+    '/admin/season/end',
+    '/admin/teams/wipe',
+]
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+# ---------------------------------------------------------------------------
+# Access control
+# ---------------------------------------------------------------------------
+
+
+class TestAdminAccessControl:
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_is_redirected_from_dashboard(self, client, as_role, role):
+        as_role(role)
+        response = client.get('/admin', follow_redirects=False)
+        assert _redirected(response), f'{role} reached /admin'
+
+    def test_admin_reaches_dashboard(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        assert response.status_code == 200
+
+    @pytest.mark.parametrize('route', ADMIN_MUTATION_ROUTES)
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_post_to_admin_routes(self, client, as_role, role, route):
+        as_role(role)
+        response = client.post(route, data={}, follow_redirects=False)
+        assert _redirected(response), f'{role} reached {route}'
+
+
+# ---------------------------------------------------------------------------
+# Dashboard rendering
+# ---------------------------------------------------------------------------
+
+
+class TestAdminDashboardRendering:
+    def test_dashboard_shows_stats(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        assert 'Total Users' in html
+        assert 'Players' in html
+        assert 'Org Teams' in html
+        assert 'Active Tryouts' in html
+
+    def test_dashboard_shows_tryout_status(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        # Either OPEN or CLOSED badge must be present
+        assert 'OPEN' in html or 'CLOSED' in html
+
+    def test_dashboard_shows_season_info(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        assert 'Season Management' in html
+        assert 'Name:' in html
+
+    def test_dashboard_shows_audit_log_section(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        assert 'Audit Log' in html
+
+    def test_dashboard_shows_backup_section(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        assert 'Manual Backup' in html
+        assert 'Backup History' in html
+
+
+# ---------------------------------------------------------------------------
+# Template integrity
+# ---------------------------------------------------------------------------
+
+
+class TestAdminTemplateIntegrity:
+    def test_page_returns_200(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        assert response.status_code == 200
+
+    def test_page_has_html_doctype(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert '<!DOCTYPE html>' in html or '<!doctype html>' in html.lower()
+
+    def test_all_buttons_are_present(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        # Key buttons that must exist
+        assert 'Create Backup Now' in html
+        assert 'Wipe Team Rosters' in html
+        # Toggle button text depends on state
+        assert 'Tryouts' in html or 'tryouts' in html.lower()
+
+    def test_all_forms_have_csrf_tokens(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        # Count <form> tags and csrf_token occurrences
+        form_count = html.count('<form ')
+        csrf_count = html.count('csrf_token')
+        assert form_count > 0, 'No forms found on admin page'
+        assert csrf_count >= form_count, (
+            f'Found {form_count} forms but only {csrf_count} csrf_token(s)'
+        )
+
+    def test_static_css_loads(self, client):
+        response = client.get('/static/css/style.css')
+        assert response.status_code == 200
+        assert 'text/css' in response.content_type
+
+    def test_static_js_loads(self, client):
+        response = client.get('/static/js/main.js')
+        assert response.status_code == 200
+        assert 'javascript' in response.content_type or 'text/' in response.content_type

tests/test_admin_route_map.py

@@ -0,0 +1,50 @@
+"""Admin route registration — every endpoint must exist and require login.
+
+ADMIN-003. The admin blueprint registers 10 routes. If one is accidentally
+removed or renamed, the admin panel breaks silently. These tests walk the
+URL map to catch that.
+"""
+
+import pytest
+
+
+ADMIN_ROUTES = [
+    '/admin',
+    '/admin/backup/create',
+    '/admin/toggle-tryouts',
+    '/admin/toggle-document-uploads',
+    '/admin/season/start',
+    '/admin/season/end',
+    '/admin/teams/wipe',
+]
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+class TestAdminRouteRegistration:
+    @pytest.mark.parametrize('route', ADMIN_ROUTES)
+    def test_route_is_registered(self, app, route):
+        """Every admin endpoint must appear in the URL map."""
+        adapter = app.url_map.bind('localhost')
+        try:
+            adapter.match(route, method='GET')
+        except Exception:
+            # Some routes are POST-only; try POST
+            try:
+                adapter.match(route, method='POST')
+            except Exception as exc:
+                pytest.fail(f'Route {route} is not registered: {exc}')
+
+    @pytest.mark.parametrize('route', ADMIN_ROUTES)
+    def test_route_requires_login(self, client, route):
+        """Unauthenticated access must redirect to login."""
+        response = client.get(route, follow_redirects=False)
+        # POST-only routes return 405 on GET, which is fine — the point is
+        # they don't return 200 to an anonymous caller.
+        if response.status_code == 405:
+            return
+        assert _redirected(response), (
+            f'{route} answered {response.status_code} to an anonymous caller'
+        )

tests/test_admin_season.py

@@ -0,0 +1,170 @@
+"""Admin season lifecycle — start/end and gate on team matches.
+
+ADMIN-007. The season_active setting gates regular-season match scheduling
+for non-admins. These tests verify start/end season and the gate.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import AppSettings, OrgTeam, TeamMatch, User
+
+
+NON_ADMIN_ROLES = ['manager', 'coach']
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+# ---------------------------------------------------------------------------
+# Season lifecycle
+# ---------------------------------------------------------------------------
+
+
+class TestSeasonLifecycle:
+    def test_start_season_sets_fields(self, client, as_role):
+        as_role('admin')
+        client.post(
+            '/admin/season/start',
+            data={'season_name': 'Fall 2026', 'season_start': '2026-09-01'},
+            follow_redirects=False,
+        )
+        with client.application.app_context():
+            assert AppSettings.get('season_name') == 'Fall 2026'
+            assert AppSettings.get('season_start') == '2026-09-01'
+            assert AppSettings.get_bool('season_active', default=False)
+
+    def test_cannot_start_season_when_already_active(self, client, as_role):
+        as_role('admin')
+        client.post(
+            '/admin/season/start',
+            data={'season_name': 'Fall 2026', 'season_start': '2026-09-01'},
+        )
+        # Second start should be rejected
+        response = client.post(
+            '/admin/season/start',
+            data={'season_name': 'Spring 2027', 'season_start': '2027-01-01'},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'already active' in html.lower()
+
+    def test_start_season_creates_audit_log(self, client, as_role):
+        from app.models import AuditLog
+
+        as_role('admin')
+        client.post(
+            '/admin/season/start',
+            data={'season_name': 'Fall 2026', 'season_start': '2026-09-01'},
+        )
+        with client.application.app_context():
+            entry = AuditLog.query.filter_by(action='season_started').first()
+            assert entry is not None
+
+    def test_end_season_sets_end_date_and_deactivates(self, client, as_role):
+        as_role('admin')
+        client.post(
+            '/admin/season/start',
+            data={'season_name': 'Fall 2026', 'season_start': '2026-09-01'},
+        )
+        client.post(
+            '/admin/season/end',
+            data={'season_end': '2026-12-15'},
+            follow_redirects=False,
+        )
+        with client.application.app_context():
+            assert AppSettings.get('season_end') == '2026-12-15'
+            assert not AppSettings.get_bool('season_active', default=False)
+
+    def test_cannot_end_season_when_inactive(self, client, as_role):
+        as_role('admin')
+        # No season started
+        response = client.post(
+            '/admin/season/end',
+            data={'season_end': '2026-12-15'},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'no season is currently active' in html.lower()
+
+    def test_end_season_creates_audit_log(self, client, as_role):
+        from app.models import AuditLog
+
+        as_role('admin')
+        client.post(
+            '/admin/season/start',
+            data={'season_name': 'Fall 2026', 'season_start': '2026-09-01'},
+        )
+        client.post('/admin/season/end', data={'season_end': '2026-12-15'})
+        with client.application.app_context():
+            entry = AuditLog.query.filter_by(action='season_ended').first()
+            assert entry is not None
+
+
+# ---------------------------------------------------------------------------
+# Gate enforcement on team matches
+# ---------------------------------------------------------------------------
+
+
+class TestSeasonGateEnforcement:
+    @pytest.fixture
+    def org_team(self, app, client, as_role):
+        as_role('admin')
+        client.post(
+            '/teams/create',
+            data={'name': 'Varsity Test'},
+            follow_redirects=False,
+        )
+        with app.app_context():
+            return OrgTeam.query.filter_by(name='Varsity Test').first().id
+
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_create_match_when_season_inactive(
+        self, client, as_role, org_team, role
+    ):
+        as_role(role)
+        response = client.get(
+            f'/team-matches/{org_team}/create',
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'season is not active' in html.lower() or 'begin a season' in html.lower()
+
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_delete_match_when_season_inactive(
+        self, app, client, as_role, org_team, role, make_user
+    ):
+        # Create a match as admin (season active not required for admin)
+        as_role('admin')
+        # Start season so match can be created
+        client.post(
+            '/admin/season/start',
+            data={'season_name': 'Fall', 'season_start': '2026-09-01'},
+        )
+        client.post(
+            f'/team-matches/{org_team}/create',
+            data={'title': 'Match Test', 'date': '2026-10-01', 'start_time': '10:00'},
+            follow_redirects=False,
+        )
+        with app.app_context():
+            match_id = TeamMatch.query.filter_by(title='Match Test').first().id
+        # End season
+        client.post('/admin/season/end', data={'season_end': '2026-12-15'})
+
+        as_role(role)
+        response = client.post(
+            f'/team-matches/{match_id}/delete', data={}, follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'season is not active' in html.lower() or 'begin a season' in html.lower()
+
+    def test_admin_can_always_schedule_match(self, client, as_role, org_team):
+        as_role('admin')
+        # No season active
+        response = client.post(
+            f'/team-matches/{org_team}/create',
+            data={'title': 'Admin Match', 'date': '2026-10-01', 'start_time': '10:00'},
+            follow_redirects=False,
+        )
+        assert _redirected(response)  # success, not blocked

tests/test_admin_template.py

@@ -0,0 +1,87 @@
+"""Admin panel UI — buttons, forms, tables, and image loading.
+
+ADMIN-010. This verifies the admin panel HTML structure: the stats grid,
+the tryout toggle button, the season form fields, the wipe confirmation
+input, and the backup/audit tables, plus that the logo image is served.
+"""
+
+import pytest
+
+
+class TestAdminStatsGrid:
+    def test_stats_grid_has_five_cards(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        # Each stat card contains a stat-icon and stat-info
+        assert html.count('stat-card') >= 5
+
+
+class TestAdminButtons:
+    def test_tryout_toggle_button_present(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'Open Tryouts' in html or 'Close Tryouts' in html
+
+    def test_backup_button_present(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'Create Backup Now' in html
+
+    def test_wipe_button_present(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'Wipe Team Rosters' in html
+
+    def test_season_button_present(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'Begin Season' in html or 'End Season' in html
+
+
+class TestAdminForms:
+    def test_season_form_has_name_and_date_fields(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'season_name' in html
+        assert 'season_start' in html or 'season_end' in html
+
+    def test_wipe_form_has_confirm_input(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'name="confirm"' in html
+        assert 'WIPE' in html
+
+
+class TestAdminTables:
+    def test_backup_table_columns(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'Filename' in html
+        assert 'Size' in html
+        assert 'Type' in html
+
+    def test_audit_log_table_columns(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'Action' in html
+        assert 'Details' in html
+
+
+class TestAdminImages:
+    def test_logo_image_loads(self, client):
+        response = client.get('/static/images/UdeS_logo.png')
+        assert response.status_code == 200
+
+    def test_esports_logo_image_loads(self, client):
+        # The original logo may still be referenced
+        response = client.get('/static/images/UdeS_logo.png')
+        assert response.status_code == 200

tests/test_admin_tryout_toggle.py

@@ -0,0 +1,156 @@
+"""Admin tryout toggle — open/close gate and enforcement on tryout routes.
+
+ADMIN-006. The tryouts_open setting gates every tryout mutation route for
+non-admins. Admins always bypass the lock. These tests verify the toggle
+itself and the gate on each affected route.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import AppSettings, Tryout, User
+
+
+NON_ADMIN_ROLES = ['manager', 'coach']
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+# ---------------------------------------------------------------------------
+# Toggle logic
+# ---------------------------------------------------------------------------
+
+
+class TestTryoutToggle:
+    def test_toggle_from_open_to_closed(self, client, as_role):
+        as_role('admin')
+        # Default is open
+        client.post('/admin/toggle-tryouts', data={}, follow_redirects=False)
+        # Now should be closed
+        with client.application.app_context():
+            assert not AppSettings.get_bool('tryouts_open', default=True)
+
+    def test_toggle_from_closed_to_open(self, client, as_role):
+        as_role('admin')
+        # Close first
+        client.post('/admin/toggle-tryouts', data={}, follow_redirects=False)
+        # Open again
+        client.post('/admin/toggle-tryouts', data={}, follow_redirects=False)
+        with client.application.app_context():
+            assert AppSettings.get_bool('tryouts_open', default=True)
+
+    def test_toggle_creates_audit_log(self, client, as_role):
+        from app.models import AuditLog
+
+        as_role('admin')
+        client.post('/admin/toggle-tryouts', data={}, follow_redirects=False)
+
+        with client.application.app_context():
+            entry = AuditLog.query.filter_by(action='tryouts_toggled').first()
+            assert entry is not None
+
+    def test_default_is_open(self, app):
+        with app.app_context():
+            assert AppSettings.get_bool('tryouts_open', default=True)
+
+
+# ---------------------------------------------------------------------------
+# Gate enforcement on tryout routes
+# ---------------------------------------------------------------------------
+
+
+class TestTryoutGateEnforcement:
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_create_tryout_when_closed(self, client, as_role, role):
+        as_role('admin')
+        client.post('/admin/toggle-tryouts', data={})  # close
+        as_role(role)
+        response = client.post(
+            '/tryouts/create',
+            data={'title': 'Test', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'closed' in html.lower() or 'open tryouts' in html.lower()
+
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_edit_tryout_when_closed(
+        self, app, client, as_role, make_user, role
+    ):
+        # Create a tryout as admin first
+        as_role('admin')
+        client.post(
+            '/tryouts/create',
+            data={'title': 'Edit Test', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=False,
+        )
+        with app.app_context():
+            tryout_id = Tryout.query.filter_by(title='Edit Test').first().id
+
+        # Close tryouts
+        client.post('/admin/toggle-tryouts', data={})
+
+        # Try to edit as non-admin
+        as_role(role)
+        response = client.post(
+            f'/tryouts/{tryout_id}/edit',
+            data={'title': 'Hacked', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'closed' in html.lower() or 'open tryouts' in html.lower()
+
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_delete_tryout_when_closed(
+        self, app, client, as_role, make_user, role
+    ):
+        as_role('admin')
+        client.post(
+            '/tryouts/create',
+            data={'title': 'Delete Test', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=False,
+        )
+        with app.app_context():
+            tryout_id = Tryout.query.filter_by(title='Delete Test').first().id
+
+        client.post('/admin/toggle-tryouts', data={})  # close
+
+        as_role(role)
+        response = client.post(
+            f'/tryouts/{tryout_id}/delete', data={}, follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'closed' in html.lower() or 'open tryouts' in html.lower()
+
+    def test_admin_can_always_create_tryout(self, client, as_role):
+        as_role('admin')
+        # Close tryouts
+        client.post('/admin/toggle-tryouts', data={})
+        # Admin should still be able to create
+        response = client.post(
+            '/tryouts/create',
+            data={'title': 'Admin Test', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=False,
+        )
+        assert _redirected(response)  # success redirect, not blocked
+
+    def test_admin_can_always_edit_tryout(self, app, client, as_role):
+        as_role('admin')
+        client.post(
+            '/tryouts/create',
+            data={'title': 'Admin Edit', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=False,
+        )
+        with app.app_context():
+            tryout_id = Tryout.query.filter_by(title='Admin Edit').first().id
+
+        client.post('/admin/toggle-tryouts', data={})  # close
+
+        response = client.post(
+            f'/tryouts/{tryout_id}/edit',
+            data={'title': 'Admin Edited', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=False,
+        )
+        assert _redirected(response)  # success, not blocked

tests/test_admin_wipe.py

@@ -0,0 +1,119 @@
+"""Admin team wipe — confirmation flow, data removal, and safety backup.
+
+ADMIN-009. The "Wipe Team Rosters" button must require typing WIPE,
+create a safety backup, and remove TeamPlayer + TeamMatch records while
+preserving OrgTeam structures.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import (
+    AuditLog, BackupRecord, OrgTeam, TeamMatch, TeamMatchParticipant, TeamPlayer,
+)
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+class TestWipeConfirmation:
+    def test_wipe_without_confirmation_fails(self, app, client, as_role):
+        as_role('admin')
+        response = client.post(
+            '/admin/teams/wipe', data={}, follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'WIPE' in html
+
+    def test_wipe_with_wrong_confirmation_fails(self, app, client, as_role):
+        as_role('admin')
+        response = client.post(
+            '/admin/teams/wipe', data={'confirm': 'yes'}, follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'WIPE' in html
+
+
+class TestWipeDataRemoval:
+    @pytest.fixture
+    def seeded_teams(self, app, client, as_role, make_user, monkeypatch):
+        import app.routes.admin as admin_module
+
+        # Mock the backup so the wipe proceeds without a real pg_dump.
+        def fake_create_backup_record(backup_type='pre_wipe', notes=None):
+            from app.models import BackupRecord
+
+            record = BackupRecord(
+                filename='db_backup_pre_wipe.dump',
+                file_path='/tmp/db_backup_pre_wipe.dump',
+                size_bytes=100,
+                backup_type=backup_type,
+                notes=notes,
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            return record
+
+        monkeypatch.setattr(admin_module, '_create_backup_record', fake_create_backup_record)
+
+        as_role('admin')
+        # Create an org team
+        client.post('/teams/create', data={'name': 'Wipe Team'}, follow_redirects=False)
+        with app.app_context():
+            team_id = OrgTeam.query.filter_by(name='Wipe Team').first().id
+
+        # Add a player to the team
+        player_id = make_user('player')
+        client.post(
+            f'/teams/{team_id}/add_player',
+            data={'player_id': str(player_id)},
+            follow_redirects=False,
+        )
+
+        # Create a team match
+        client.post(
+            f'/team-matches/{team_id}/create',
+            data={'title': 'Wipe Match', 'date': '2026-10-01', 'start_time': '10:00'},
+            follow_redirects=False,
+        )
+
+        return team_id
+
+    def test_wipe_removes_team_players(self, app, client, as_role, seeded_teams):
+        as_role('admin')
+        client.post('/admin/teams/wipe', data={'confirm': 'WIPE'}, follow_redirects=False)
+
+        with app.app_context():
+            assert TeamPlayer.query.count() == 0
+
+    def test_wipe_removes_team_matches(self, app, client, as_role, seeded_teams):
+        as_role('admin')
+        client.post('/admin/teams/wipe', data={'confirm': 'WIPE'}, follow_redirects=False)
+
+        with app.app_context():
+            assert TeamMatch.query.count() == 0
+
+    def test_wipe_preserves_org_team_structures(self, app, client, as_role, seeded_teams):
+        as_role('admin')
+        client.post('/admin/teams/wipe', data={'confirm': 'WIPE'}, follow_redirects=False)
+
+        with app.app_context():
+            assert OrgTeam.query.filter_by(name='Wipe Team').first() is not None
+
+    def test_wipe_creates_safety_backup(self, app, client, as_role, seeded_teams):
+        as_role('admin')
+        client.post('/admin/teams/wipe', data={'confirm': 'WIPE'}, follow_redirects=False)
+
+        with app.app_context():
+            safety = BackupRecord.query.filter_by(backup_type='pre_wipe').first()
+            assert safety is not None
+
+    def test_wipe_creates_audit_log(self, app, client, as_role, seeded_teams):
+        as_role('admin')
+        client.post('/admin/teams/wipe', data={'confirm': 'WIPE'}, follow_redirects=False)
+
+        with app.app_context():
+            entry = AuditLog.query.filter_by(action='teams_wiped').first()
+            assert entry is not None

tests/test_availability_views.py

@@ -0,0 +1,116 @@
+"""Tests for the hours column in the user list and the read-only
+availability grid on public profiles."""
+
+from datetime import time
+
+from app.extensions import db
+from app.models import (
+    CoachAvailability,
+    PlayerDisponibility,
+)
+
+
+class TestHoursColumn:
+    """The manage-users table shows available hours for players/coaches."""
+
+    def test_admin_sees_hours_header(self, app, client, as_role):
+        as_role('admin')
+        body = client.get('/users').get_data(as_text=True)
+        # Default locale is French, so _("Hours") renders as "Heures"
+        assert 'Heures' in body
+
+    def test_player_without_slots_shows_0(self, app, client, as_role, make_user):
+        as_role('admin')
+        make_user('player')  # create a player but stay logged in as admin
+        body = client.get('/users').get_data(as_text=True)
+        assert '0.0' in body
+
+    def test_player_with_slots_shows_hours(self, app, client, as_role, make_user):
+        as_role('admin')
+        player_id = make_user('player')
+        with app.app_context():
+            db.session.add(
+                PlayerDisponibility(
+                    player_id=player_id,
+                    day_of_week=0,
+                    start_time=time(17, 0),
+                    end_time=time(19, 0),
+                )
+            )
+            db.session.add(
+                PlayerDisponibility(
+                    player_id=player_id,
+                    day_of_week=1,
+                    start_time=time(18, 0),
+                    end_time=time(20, 0),
+                )
+            )
+            db.session.commit()
+
+        body = client.get('/users').get_data(as_text=True)
+        # 2h + 2h = 4.0
+        assert '4.0' in body
+
+    def test_coach_without_slots_shows_0(self, app, client, as_role, make_user):
+        as_role('admin')
+        make_user('coach')
+        body = client.get('/users').get_data(as_text=True)
+        assert '0.0' in body
+
+    def test_admin_roles_show_dash(self, app, client, as_role, make_user):
+        as_role('admin')
+        make_user('manager')
+        make_user('scout')
+        body = client.get('/users').get_data(as_text=True)
+        # managers and scouts should show mdash
+        assert '\u2014' in body
+
+
+class TestAvailabilityOnPublicProfile:
+    """view_user renders a weekly availability grid for players/coaches."""
+
+    def test_player_without_availability_shows_no_grid(self, app, client, as_role):
+        as_role('admin')
+        player_id = as_role('player')
+        body = client.get(f'/users/{player_id}/view').get_data(as_text=True)
+        # Default locale is French
+        assert 'Disponibilit\u00e9s' not in body
+
+    def test_player_with_slots_shows_grid(self, app, client, as_role, make_user):
+        as_role('admin')
+        player_id = make_user('player')
+        with app.app_context():
+            db.session.add(
+                PlayerDisponibility(
+                    player_id=player_id,
+                    day_of_week=2,
+                    start_time=time(18, 0),
+                    end_time=time(18, 30),
+                )
+            )
+            db.session.commit()
+        body = client.get(f'/users/{player_id}/view').get_data(as_text=True)
+        assert 'Disponibilit\u00e9s' in body
+        assert '18:00' in body
+
+    def test_coach_with_slots_shows_grid(self, app, client, as_role, make_user):
+        as_role('admin')
+        coach_id = make_user('coach')
+        with app.app_context():
+            db.session.add(
+                CoachAvailability(
+                    coach_id=coach_id,
+                    day_of_week=3,
+                    start_time=time(10, 0),
+                    end_time=time(10, 30),
+                )
+            )
+            db.session.commit()
+        body = client.get(f'/users/{coach_id}/view').get_data(as_text=True)
+        assert 'Disponibilit\u00e9s' in body
+        assert '10:00' in body
+
+    def test_admin_profile_shows_no_grid(self, app, client, as_role):
+        admin_id = as_role('admin')
+        body = client.get(f'/users/{admin_id}/view').get_data(as_text=True)
+        assert 'Disponibilit\u00e9s' not in body

tests/test_contract_uploads.py

@@ -14,13 +14,25 @@ import io
 import os
 
 import pytest
+from pypdf import PdfWriter as _Pw
 
 from app.extensions import db
 from app.models import Contract
 
-PDF_BYTES = b'%PDF-1.7\n1 0 obj\n<<>>\nendobj\ntrailer\n%%EOF\n'
+
+def _valid_pdf_bytes():
+    w = _Pw()
+    w.add_blank_page(612, 792)
+    buf = io.BytesIO()
+    w.write(buf)
+    return buf.getvalue()
+
+
+_PDF_BYTES = _valid_pdf_bytes()
 NOT_PDF_BYTES = b'MZ\x90\x00\x03\x00\x00\x00'  # a Windows executable header
 
+PDF_HEADER_ONLY_BYTES = b'%PDF-1.7\n' + b'MZ' * 100  # PDF header over non-PDF content
+
 
 @pytest.fixture
 def contract_for(app, tmp_path):
@@ -29,7 +41,7 @@ def contract_for(app, tmp_path):
     def _make(player_id, uploader_id):
         stored = 'deadbeef.pdf'
         path = tmp_path / stored
-        path.write_bytes(PDF_BYTES)
+        path.write_bytes(_PDF_BYTES)
         with app.app_context():
             contract = Contract(
                 player_id=player_id,
@@ -89,7 +101,7 @@ class TestSignedUpload:
 
         client.post(
             f'/users/contracts/{contract_id}/upload_signed',
-            data={'signed_file': (io.BytesIO(PDF_BYTES), 'signed.pdf')},
+            data={'signed_file': (io.BytesIO(_PDF_BYTES), 'signed.pdf')},
             content_type='multipart/form-data',
             follow_redirects=True,
         )
@@ -110,7 +122,7 @@ class TestSignedUpload:
 
         client.post(
             f'/users/contracts/{contract_id}/upload_signed',
-            data={'signed_file': (io.BytesIO(PDF_BYTES), 'signed.pdf')},
+            data={'signed_file': (io.BytesIO(_PDF_BYTES), 'signed.pdf')},
             content_type='multipart/form-data',
             follow_redirects=True,
         )
@@ -118,6 +130,31 @@ class TestSignedUpload:
         with app.app_context():
             assert db.session.get(Contract, contract_id).status != 'signed'
 
+    def test_signed_upload_with_google_drive(
+        self, app, client, as_role, make_user, contract_for, monkeypatch
+    ):
+        """Signing with Drive backend stores gdrive://<id> in signed_file_path."""
+        monkeypatch.setenv('DOCUMENT_STORAGE_BACKEND', 'google_drive')
+        monkeypatch.setattr(
+            'app.storage.upload_google_drive_file',
+            lambda **_kwargs: 'drive-signed-456',
+        )
+        player_id = as_role('player')
+        admin_id = make_user('admin')
+        contract_id, directory = contract_for(player_id, admin_id)
+
+        client.post(
+            f'/users/contracts/{contract_id}/upload_signed',
+            data={'signed_file': (io.BytesIO(_PDF_BYTES), 'signed.pdf')},
+            content_type='multipart/form-data',
+            follow_redirects=True,
+        )
+
+        with app.app_context():
+            contract = db.session.get(Contract, contract_id)
+            assert contract.status == 'signed'
+            assert contract.signed_file_path == 'gdrive://drive-signed-456'
+
 
 class TestTheHelper:
     def test_it_reports_a_missing_file(self, app):
@@ -133,16 +170,27 @@ class TestTheHelper:
 
         from app.routes.users import ALLOWED_CONTRACT_EXTENSIONS, pdf_upload_error
 
-        upload = FileStorage(stream=io.BytesIO(PDF_BYTES), filename='c.pdf')
+        upload = FileStorage(stream=io.BytesIO(_PDF_BYTES), filename='c.pdf')
         with app.test_request_context('/'):
             assert pdf_upload_error(upload, ALLOWED_CONTRACT_EXTENSIONS) is None
-        assert upload.stream.read() == PDF_BYTES
+        assert upload.stream.read() == _PDF_BYTES
 
     def test_a_name_without_a_dot_is_refused(self, app):
         from werkzeug.datastructures import FileStorage
 
         from app.routes.users import ALLOWED_CONTRACT_EXTENSIONS, pdf_upload_error
 
-        upload = FileStorage(stream=io.BytesIO(PDF_BYTES), filename='pdf')
+        upload = FileStorage(stream=io.BytesIO(_PDF_BYTES), filename='pdf')
+        with app.test_request_context('/'):
+            assert pdf_upload_error(upload, ALLOWED_CONTRACT_EXTENSIONS)
+
+    def test_a_header_only_file_is_refused(self, app):
+        """A stream starting with %PDF- but holding non-PDF data is
+        rejected (the header check is not enough)."""
+        from werkzeug.datastructures import FileStorage
+
+        from app.routes.users import ALLOWED_CONTRACT_EXTENSIONS, pdf_upload_error
+
+        upload = FileStorage(stream=io.BytesIO(PDF_HEADER_ONLY_BYTES), filename='clever.pdf')
         with app.test_request_context('/'):
             assert pdf_upload_error(upload, ALLOWED_CONTRACT_EXTENSIONS)

tests/test_csp.py

@@ -126,14 +126,6 @@ class TestInlineHandlerRatchet:
         assert "' + playerName + '" not in content
         assert content.count('escapeHtml(playerName)') == 6
 
-    def test_api_messages_are_written_as_text(self):
-        template = os.path.join(TEMPLATE_ROOT, 'pages', 'coach_availability.html')
-        with open(template, encoding='utf-8') as handle:
-            content = handle.read()
-
-        assert 'text.textContent = message' in content
-        assert "alert.innerHTML = '<span>' + message" not in content
-
     @pytest.mark.parametrize('relative,full', list(_templates()))
     def test_a_template_never_gains_an_inline_handler(self, relative, full):
         allowed = HANDLER_BUDGET.get(relative, 0)

tests/test_database_url.py

@@ -1,17 +1,17 @@
 """Which PostgreSQL driver the application actually asks for — QUA-001.
 
 `postgresql://…` is not "whichever driver is installed". SQLAlchemy reads it
-as psycopg2 and imports that module when the engine is created.
+as psycopg2 unless the URL names a driver. requirements.txt declares psycopg
-requirements.txt pins psycopg 3 and no psycopg2, so a clean install against
+3, so create_app() must explicitly select it.
-the URL Render hands out — the same form docs/database-restore.md documents
-— fails before the first request:
 
-    ModuleNotFoundError: No module named 'psycopg2'
+The test suite must not assume that psycopg2 is absent: a developer's virtual
-
+environment can contain optional packages in addition to the declared
-create_app() now names the driver. These tests pin that down, and the last
+dependencies. These tests instead pin the application's selected driver and
-one proves the failure is real rather than theoretical.
+the dependency contract that production installs use.
 """
 
+from pathlib import Path
+
 import pytest
 from sqlalchemy import create_engine
 
@@ -80,16 +80,13 @@ class TestTheFactory:
         assert app.config['SQLALCHEMY_DATABASE_URI'].startswith('sqlite:///')
 
 
-class TestTheFailureIsReal:
+class TestDriverContract:
-    """Not a hypothetical: this is what the deployed configuration did."""
+    def test_production_dependencies_select_psycopg_3(self):
+        requirements = Path(__file__).resolve().parents[1] / 'requirements.txt'
+        declared = requirements.read_text(encoding='utf-8')
 
-    def test_psycopg2_is_not_installed(self):
+        assert 'psycopg[binary]==' in declared
-        with pytest.raises(ImportError):
+        assert 'psycopg2' not in declared
-            import psycopg2  # noqa: F401
-
-    def test_a_driverless_url_cannot_build_an_engine(self):
-        with pytest.raises(ModuleNotFoundError):
-            create_engine('postgresql://u:p@host/db')
 
     def test_the_normalised_url_can(self):
         engine = create_engine(normalise_database_url('postgresql://u:p@host/db'))

tests/test_storage.py

@@ -19,7 +19,27 @@ import os
 import pytest
 
 from app.extensions import db
-from app.storage import CONTRACTS_DIR, document_path, documents_root
+from app.storage import (
+    CONTRACTS_DIR,
+    GOOGLE_DRIVE_PATH_PREFIX,
+    document_path,
+    documents_root,
+    store_uploaded_document,
+)
+
+
+def _valid_pdf():
+    """A real one-page PDF that passes pypdf content validation."""
+    import io
+
+    from pypdf import PdfWriter
+
+    w = PdfWriter()
+    w.add_blank_page(612, 792)
+    buf = io.BytesIO()
+    w.write(buf)
+    buf.seek(0)
+    return buf
 
 
 class TestDocumentsRoot:
@@ -87,6 +107,22 @@ class TestDocumentPath:
         assert first_old == second_old, 'and must not move the ones already filed'
 
 
+class TestGoogleDriveStorage:
+    def test_new_uploads_store_an_opaque_drive_reference(self, monkeypatch):
+        from werkzeug.datastructures import FileStorage
+
+        monkeypatch.setenv('DOCUMENT_STORAGE_BACKEND', 'google_drive')
+        monkeypatch.setattr(
+            'app.storage.upload_google_drive_file',
+            lambda **_kwargs: 'drive-file-123',
+        )
+        upload = FileStorage(stream=_pdf(), filename='contract.pdf', content_type='application/pdf')
+
+        stored_path = store_uploaded_document(upload, os.path.join(CONTRACTS_DIR, 'new.pdf'))
+
+        assert stored_path == f'{GOOGLE_DRIVE_PATH_PREFIX}drive-file-123'
+
+
 class TestThroughTheUploadRoute:
     @pytest.fixture
     def uploaded(self, app, client, as_role, make_user):
@@ -143,10 +179,8 @@ class TestThroughTheUploadRoute:
 
 
 def _pdf():
-    """The smallest thing pdf_upload_error accepts."""
+    """The smallest valid one-page PDF that passes pypdf content validation."""
-    import io
+    return _valid_pdf()
-
-    return io.BytesIO(b'%PDF-1.4\n%%EOF\n')
 
 
 class TestDeletingAnAccountTakesItsDocuments: