test docu, non fonctionnel pour l'instant

Creation d'un fichier pour setup postgres en local pour dev

.gitignore

@@ -98,6 +98,9 @@ coverage.xml
 # =============================================================================
 # Base SQLite locale (une base de démo a déjà été committée par le passé,
 # voir l'historique du commit `4fd27ba`).
+# Données PostgreSQL locales — gérées par app/local_postgres.py
+instance/pgdata/
+instance/pg.log
 instance/
 *.db
 *.sqlite

app/.env.example

@@ -88,17 +88,28 @@ DISCORD_CLIENT_SECRET=
 DISCORD_REDIRECT_URI=https://your-domain/auth/discord/callback
 
 # =============================================================================
-# Optional — storage
+# Contract storage — Google Drive
 # =============================================================================
 
-# Where uploaded contracts live. Empty means `documents/` beside the
-# application. Set it to a path OUTSIDE the deployment directory if you move
-# to a release-directory layout, or a deployment will take the documents with
-# it (OPS-011, app/storage.py).
-#
-# IMPORTANT: the backup script reads this same variable. Before wave J it
-# did not, and archived `./documents` regardless — so setting this here and
-# nowhere else produced empty contract backups that still exited 0.
+# New contracts are uploaded to the owner's Google Drive. The OAuth client,
+# refresh token, and folder ID are secrets/configuration: do not commit them.
+# Use `local` only for isolated development and legacy-file maintenance.
+DOCUMENT_STORAGE_BACKEND=google_drive
+
+# Target folder in the owner's personal Drive. The application keeps every
+# contract directly in this folder and stores only each Drive file ID in the
+# database.
+GOOGLE_DRIVE_FOLDER_ID=
+
+# OAuth 2.0 credentials for the owner's Google account. Create a Google Cloud
+# Desktop OAuth client, authorize the Drive scope once, and place the resulting
+# refresh token here. See docs/deployment.md before enabling this in production.
+GOOGLE_DRIVE_CLIENT_ID=
+GOOGLE_DRIVE_CLIENT_SECRET=
+GOOGLE_DRIVE_REFRESH_TOKEN=
+
+# Local storage is retained only for historical rows and local test runs.
+# It is not used for new contracts while DOCUMENT_STORAGE_BACKEND=google_drive.
 DOCUMENTS_ROOT=
 
 # Where the log files go. Empty means `logs/` beside the application. Both
@@ -140,5 +151,14 @@ AUTO_CREATE_TABLES=true
 #   FORCE_HTTPS=false           no redirect to HTTPS
 #   DISCORD_REDIRECT_URI=http://localhost:5000/auth/discord/callback
 #
+#   LOCAL_PG=true               start a local PostgreSQL server (requires PostgreSQL
+#                               installed on the system). Uses port 5433,
+#                               data in instance/pgdata/, database team_tryouts.
+#
+#   LOCAL_PG_PORT=5433          override the PostgreSQL port
+#   LOCAL_PG_USER=team_tryouts_db   override the PostgreSQL user
+#   LOCAL_PG_DATABASE=team_tryouts_db  override the database name
+#
+#
 # `python run.py` reads DEV_HOST and DEV_PORT rather than HOST and PORT, so a
 # development session cannot accidentally inherit a production binding.

app/app.py

@@ -26,8 +26,10 @@ from sqlalchemy import text
 from werkzeug.exceptions import HTTPException
 
 from app import i18n
+from app.api import json_endpoint
 from app.extensions import babel, csrf, db, limiter, login_manager
 from app.pagination import page_url
+from app.responders import current_revision, is_ajax_submit
 
 load_dotenv()
 
@@ -347,6 +349,42 @@ def create_app(config=None):
         response.headers['X-Request-Id'] = g.get('request_id', '-')
         return response
 
+    @app.before_request
+    def reject_stale_ajax_write():
+        """Reject an AJAX edit whose view is stale, instead of overwriting.
+
+        The AJAX form handler in main.js sends the revision it last saw in the
+        X-Revision header. If another client has committed since then the
+        server's revision has moved on, and clobbering their change would be
+        silent last-write-wins. Answer 409 so the client asks the user to
+        reload the page first.
+        """
+        if request.method != 'POST':
+            return None
+        if not is_ajax_submit():
+            return None
+        sent = request.headers.get('X-Revision')
+        if sent is None:
+            return None
+        try:
+            sent = int(sent)
+        except (TypeError, ValueError):
+            return None
+        if sent != current_revision():
+            return (
+                jsonify(
+                    {
+                        'error': 'conflict',
+                        'message': _(
+                            'This page was changed by someone else. Reload to '
+                            'see the latest changes before saving.'
+                        ),
+                    }
+                ),
+                409,
+            )
+        return None
+
     @app.url_defaults
     def version_static_urls(endpoint, values):
         """Stamp every static URL with the file's modification time.
@@ -403,6 +441,7 @@ def create_app(config=None):
 
     configure_logging(app)
 
+    from app.routes.admin import admin_bp
     from app.routes.auth import auth_bp
     from app.routes.evaluations import evaluations_bp
     from app.routes.main import main_bp
@@ -420,6 +459,7 @@ def create_app(config=None):
     app.register_blueprint(teams_bp)
     app.register_blueprint(matches_bp)
     app.register_blueprint(team_matches_bp)
+    app.register_blueprint(admin_bp)
 
     # Register custom Jinja filters
     app.jinja_env.filters['nl2br'] = nl2br
@@ -529,6 +569,18 @@ def create_app(config=None):
 
         return jsonify(health_data), 200
 
+    @app.route('/api/revision')
+    @json_endpoint
+    def data_revision():
+        """The current dataset revision, for the AJAX form handler in main.js.
+
+        One primary-key lookup in app_settings. The client compares this with
+        the revision it last saw to decide whether a focus refresh is needed,
+        and sends it back with every AJAX mutation so a stale edit is rejected
+        with a 409 instead of overwriting someone else's change.
+        """
+        return jsonify({'revision': current_revision()})
+
     # =========================================================================
     # Custom Error Handlers
     # =========================================================================

app/discord_bot.py

@@ -492,6 +492,19 @@ class TeamTryoutsBot(commands.Bot):
                 await self._send_schedule_notification(**item['data'])
         elif kind == 'one_on_one_response':
             await self._send_one_on_one_response_dm(**item['data'])
+        elif kind == 'purge_pending':
+            participant_ids = item.get('data', {}).get('participant_ids', [])
+            if participant_ids:
+                changed = False
+                for msg_id, record in list(self.pending_requests.items()):
+                    if (
+                        record.get('type') == 'schedule_addition'
+                        and record.get('id') in participant_ids
+                    ):
+                        del self.pending_requests[msg_id]
+                        changed = True
+                if changed:
+                    self._save_pending()
         else:
             logger.error('Unknown queue item type %r; the notification was dropped', kind)
 
@@ -673,6 +686,7 @@ class TeamTryoutsBot(commands.Bot):
         event_date: str,
         event_time: str,
         reference_id: int,
+        change_kind: str = 'scheduled',
     ) -> int:
         """Send a schedule addition notification to a player.
 
@@ -683,6 +697,7 @@ class TeamTryoutsBot(commands.Bot):
             event_date: Date string.
             event_time: Time string.
             reference_id: ID of the MatchParticipant or TryoutRegistration record.
+            change_kind: 'scheduled' (new match / added player) or 'modified' (date/time changed).
         """
         # Look up the DB user to get their Discord user ID
         from app.extensions import db
@@ -699,16 +714,29 @@ class TeamTryoutsBot(commands.Bot):
 
         event_name = "Match" if event_type == 'match' else "Tryout"
 
-        message = (
-            f"📅 **{event_name} Scheduled**\n\n"
-            f"You have been added to the following {event_type}:\n"
-            f"**{event_title}**\n"
-            f"**Date:** {event_date}\n"
-            f"**Time:** {event_time}\n\n"
-            "Please confirm your attendance:\n"
-            f"{CHECK_EMOJI} - Confirm attendance\n"
-            f"{CROSS_EMOJI} - Decline"
-        )
+        if change_kind == 'modified':
+            message = (
+                f"📅 **{event_name} Modified**\n\n"
+                f"The {event_type} date and/or time has been modified for "
+                f"**{event_title}**.\n"
+                f"The new date and/or time is:\n"
+                f"**Date:** {event_date}\n"
+                f"**Time:** {event_time}\n\n"
+                "Please confirm your attendance:\n"
+                f"{CHECK_EMOJI} - Confirm attendance\n"
+                f"{CROSS_EMOJI} - Decline"
+            )
+        else:
+            message = (
+                f"📅 **{event_name} Scheduled**\n\n"
+                f"You have been added to the following {event_type}:\n"
+                f"**{event_title}**\n"
+                f"**Date:** {event_date}\n"
+                f"**Time:** {event_time}\n\n"
+                "Please confirm your attendance:\n"
+                f"{CHECK_EMOJI} - Confirm attendance\n"
+                f"{CROSS_EMOJI} - Decline"
+            )
 
         msg = await self._send_dm(
             db_user.discord_user_id,
@@ -992,6 +1020,12 @@ class TeamTryoutsBot(commands.Bot):
                         player.id,
                         reference_id,
                     )
+            else:
+                # The row no longer exists (e.g. match was edited, participant
+                # was deleted). Silently drop the stale pending entry so the
+                # reaction is not answerable again. No user-facing reply.
+                self._forget_pending(message_id)
+                return
         except SQLAlchemyError:
             db.session.rollback()
             logger.exception(
@@ -1040,6 +1074,11 @@ class TeamTryoutsBot(commands.Bot):
                     db.session.delete(row)
                 else:
                     row.status = 'no_show'
+            else:
+                # The row no longer exists. Silently drop the stale pending
+                # entry so the reaction is not answerable again.
+                self._forget_pending(message_id)
+                return
         except SQLAlchemyError:
             db.session.rollback()
             logger.exception(
@@ -1222,10 +1261,11 @@ class TeamTryoutsBot(commands.Bot):
 
     async def send_match_reminder(self, player, match):
         """Send match reminder to player. True if it was delivered."""
+        date_str = match.date.strftime('%A, %B %d, %Y') if match.date else 'TBD'
         message = (
             "🔔 **Match Reminder**\n\n"
             f"Your match **{match.title}** is scheduled for tomorrow:\n"
-            f"**Date:** {match.date.strftime('%A, %B %d, %Y')}\n"
+            f"**Date:** {date_str}\n"
             f"**Time:** {match.start_time.strftime('%I:%M %p') if match.start_time else 'TBD'} - "
             f"{match.end_time.strftime('%I:%M %p') if match.end_time else 'TBD'}\n"
             f"**Location:** {match.location or 'TBD'}\n\n"
@@ -1241,10 +1281,11 @@ class TeamTryoutsBot(commands.Bot):
 
     async def send_tryout_reminder(self, player, tryout):
         """Send tryout reminder to player. True if it was delivered."""
+        date_str = tryout.date.strftime('%A, %B %d, %Y') if tryout.date else 'TBD'
         message = (
             "🔔 **Tryout Reminder**\n\n"
             f"Your tryout **{tryout.title}** is scheduled for tomorrow:\n"
-            f"**Date:** {tryout.date.strftime('%A, %B %d, %Y')}\n"
+            f"**Date:** {date_str}\n"
             f"**Location:** {tryout.location or 'TBD'}\n\n"
             "Please confirm your attendance in the app."
         )
@@ -1314,10 +1355,11 @@ class TeamTryoutsBot(commands.Bot):
 
     async def send_one_on_one_reminder(self, player, session):
         """Send One on One reminder to player. True if it was delivered."""
+        date_str = session.date.strftime('%A, %B %d, %Y') if session.date else 'TBD'
         message = (
             "🔔 **One on One Reminder**\n\n"
             f"Your One on One session with **{session.coach.full_name}** is scheduled for tomorrow:\n"
-            f"**Date:** {session.date.strftime('%A, %B %d, %Y')}\n"
+            f"**Date:** {date_str}\n"
             f"**Time:** {session.start_time.strftime('%I:%M %p')} - {session.end_time.strftime('%I:%M %p')}\n"
             f"**Discussion Points:** {session.points or 'No specific points provided'}\n\n"
             "Please prepare for your session!"
@@ -1417,8 +1459,13 @@ def send_schedule_notification(
     event_date: str,
     event_time: str,
     reference_id: int,
+    change_kind: str = 'scheduled',
 ) -> bool:
-    """Queue a schedule addition notification to be sent by the bot."""
+    """Queue a schedule addition notification to be sent by the bot.
+
+    Args:
+        change_kind: 'scheduled' (new match / added player) or 'modified' (date/time changed).
+    """
     return _enqueue(
         'schedule_addition',
         {
@@ -1428,11 +1475,32 @@ def send_schedule_notification(
             'event_date': event_date,
             'event_time': event_time,
             'reference_id': reference_id,
+            'change_kind': change_kind,
         },
         description=f'the {event_type} notification for user {user_id}',
     )
 
 
+def purge_pending_for_participants(participant_ids):
+    """Queue a purge of pending Discord entries for stale participant rows.
+
+    Called after a match edit deletes participants. The bot thread removes
+    matching ``schedule_addition`` pending entries so that a reaction on an
+    old message cannot produce a false confirmation.
+
+    Args:
+        participant_ids: list[int] of MatchParticipant primary keys that no
+            longer exist.
+    """
+    if not participant_ids:
+        return None
+    return _enqueue(
+        'purge_pending',
+        {'participant_ids': participant_ids},
+        description=f'purge of {len(participant_ids)} stale participant records',
+    )
+
+
 def send_one_on_one_response(
     player_discord_id: str,
     player_full_name: str,

app/extensions.py

@@ -22,7 +22,7 @@ babel = Babel()
 # No storage is named here on purpose: it comes from RATELIMIT_STORAGE_URI in
 # app.config, which create_app fills from the environment and defaults to
 # `memory://` (SEC-WEB-004). Naming it in both places is how the two drift.
-limiter = Limiter(key_func=get_remote_address, default_limits=["200 per day", "50 per hour"])
+limiter = Limiter(key_func=get_remote_address, default_limits=["1000 per day", "200 per hour"])
 
 
 def hash_password(password):

app/google_drive.py

@@ -0,0 +1,209 @@
+"""Google Drive storage for contract PDFs.
+
+The application uses an OAuth refresh token for the owner's personal Google
+account. Tokens and client secrets come only from environment variables; the
+database stores opaque file IDs, never a credential or a shareable Drive URL.
+"""
+
+import io
+import os
+
+GOOGLE_DRIVE_FOLDER_ID_ENV = 'GOOGLE_DRIVE_FOLDER_ID'
+GOOGLE_DRIVE_CLIENT_ID_ENV = 'GOOGLE_DRIVE_CLIENT_ID'
+GOOGLE_DRIVE_CLIENT_SECRET_ENV = 'GOOGLE_DRIVE_CLIENT_SECRET'
+GOOGLE_DRIVE_REFRESH_TOKEN_ENV = 'GOOGLE_DRIVE_REFRESH_TOKEN'
+GOOGLE_DRIVE_SCOPE = 'https://www.googleapis.com/auth/drive.file'
+
+
+class GoogleDriveStorageError(RuntimeError):
+    """A configuration or API failure while storing a contract in Drive."""
+
+
+def _setting(name):
+    value = os.getenv(name)
+    if not value:
+        raise GoogleDriveStorageError(
+            f'{name} must be configured for Google Drive document storage.'
+        )
+    return value
+
+
+def root_folder_id():
+    """The configured Drive folder that holds every application document.
+
+    This is the folder the owner set up (the ``signés`` folder); new
+    documents land directly in it and signed copies are filed in nested
+    folders below it.
+    """
+    return _setting(GOOGLE_DRIVE_FOLDER_ID_ENV)
+
+
+def get_or_create_folder(name, parent_id):
+    """Return the Drive folder named *name* under *parent_id*, creating it.
+
+    Drive has no ``mkdir -p``; creating a folder is a write, so a signed
+    copy filed under ``<team>/<role>/<username>`` walks the chain once per
+    upload.  A folder already present is reused rather than duplicated.
+
+    Args:
+        name: Folder name to find or create.
+        parent_id: Drive id of the parent folder.
+
+    Returns:
+        str: The Drive id of the folder.
+    """
+    try:
+        service = _drive_service()
+        query = (
+            f"name='{name}' and mimeType='application/vnd.google-apps.folder' "
+            f"and '{parent_id}' in parents and trashed=false"
+        )
+        response = service.files().list(q=query, fields='files(id, name)', pageSize=10).execute()
+        existing = response.get('files', [])
+        if existing:
+            return existing[0]['id']
+        folder = (
+            service.files()
+            .create(
+                body={
+                    'name': name,
+                    'mimeType': 'application/vnd.google-apps.folder',
+                    'parents': [parent_id],
+                },
+                fields='id',
+            )
+            .execute()
+        )
+        return folder['id']
+    except GoogleDriveStorageError:
+        raise
+    except Exception as exc:  # Google client exceptions share no stable base class.
+        raise GoogleDriveStorageError('Google Drive could not create the document folder.') from exc
+
+
+def _drive_service():
+    """Build an authorized Drive client from the owner's refresh token."""
+    try:
+        from google.oauth2.credentials import Credentials
+        from googleapiclient.discovery import build
+    except ImportError as exc:
+        raise GoogleDriveStorageError(
+            'Google Drive dependencies are not installed. Install requirements.txt again.'
+        ) from exc
+
+    credentials = Credentials(
+        token=None,
+        refresh_token=_setting(GOOGLE_DRIVE_REFRESH_TOKEN_ENV),
+        token_uri='https://oauth2.googleapis.com/token',
+        client_id=_setting(GOOGLE_DRIVE_CLIENT_ID_ENV),
+        client_secret=_setting(GOOGLE_DRIVE_CLIENT_SECRET_ENV),
+        scopes=[GOOGLE_DRIVE_SCOPE],
+    )
+    return build('drive', 'v3', credentials=credentials, cache_discovery=False)
+
+
+def list_folder_files():
+    """Return (file_id, name) tuples for every file in the configured folder.
+
+    Used by the backup script to enumerate Drive-stored contracts. Returns
+    only files directly in the folder (not nested inside sub-folders).
+
+    Returns:
+        list[tuple[str, str]]: (file_id, name) for each file found.
+    """
+    try:
+        folder_id = _setting(GOOGLE_DRIVE_FOLDER_ID_ENV)
+        page_token = None
+        results = []
+        while True:
+            response = (
+                _drive_service()
+                .files()
+                .list(
+                    q=f"'{folder_id}' in parents and trashed=false",
+                    fields='nextPageToken, files(id, name)',
+                    pageToken=page_token,
+                    pageSize=1000,
+                )
+                .execute()
+            )
+            for f in response.get('files', []):
+                results.append((f['id'], f['name']))
+            page_token = response.get('nextPageToken')
+            if not page_token:
+                break
+        return results
+    except GoogleDriveStorageError:
+        raise
+    except Exception as exc:
+        raise GoogleDriveStorageError('Google Drive could not list folder contents.') from exc
+
+
+def upload_file(*, stream, filename, mimetype, parents=None):
+    """Upload a PDF to the configured owner folder and return its Drive ID.
+
+    Args:
+        stream: The binary stream to upload.
+        filename: Name used for the uploaded file.
+        mimetype: MIME type of the file.
+        parents: Drive ids of the parent folders.  Defaults to the root
+            folder when omitted, which is how the legacy contract flow
+            still works.
+    """
+    try:
+        from googleapiclient.http import MediaIoBaseUpload
+
+        stream.seek(0)
+        media = MediaIoBaseUpload(stream, mimetype=mimetype, resumable=True)
+        response = (
+            _drive_service()
+            .files()
+            .create(
+                body={
+                    'name': filename,
+                    'parents': parents or [root_folder_id()],
+                },
+                media_body=media,
+                fields='id',
+            )
+            .execute()
+        )
+    except GoogleDriveStorageError:
+        raise
+    except Exception as exc:  # Google client exceptions share no stable base class.
+        raise GoogleDriveStorageError('Google Drive rejected the contract upload.') from exc
+
+    file_id = response.get('id')
+    if not file_id:
+        raise GoogleDriveStorageError('Google Drive did not return an uploaded file identifier.')
+    return file_id
+
+
+def download_file(file_id):
+    """Download a Drive file into memory for Flask's authenticated response."""
+    try:
+        from googleapiclient.http import MediaIoBaseDownload
+
+        destination = io.BytesIO()
+        downloader = MediaIoBaseDownload(
+            destination,
+            _drive_service().files().get_media(fileId=file_id),
+        )
+        complete = False
+        while not complete:
+            _status, complete = downloader.next_chunk()
+        return destination.getvalue()
+    except GoogleDriveStorageError:
+        raise
+    except Exception as exc:  # Google client exceptions share no stable base class.
+        raise GoogleDriveStorageError('Google Drive could not download this contract.') from exc
+
+
+def delete_file(file_id):
+    """Permanently delete a Drive document when its contract record is deleted."""
+    try:
+        _drive_service().files().delete(fileId=file_id).execute()
+    except GoogleDriveStorageError:
+        raise
+    except Exception as exc:  # Google client exceptions share no stable base class.
+        raise GoogleDriveStorageError('Google Drive could not delete this contract.') from exc

app/local_postgres.py

@@ -0,0 +1,442 @@
+"""Manage a local PostgreSQL instance for development.
+
+Searches for PostgreSQL binaries on the system, initialises a data directory
+under ``instance/pgdata/``, starts the server on port 5433, creates the
+``team_tryouts`` database, and registers cleanup on exit.
+
+Usage from run.py::
+
+    if os.getenv('LOCAL_PG', '').lower() == 'true':
+        from app.local_postgres import start as start_local_pg
+        os.environ['DATABASE_URL'] = start_local_pg()
+
+Environment used (all optional):
+    LOCAL_PG_PORT        Port to bind (default 5433)
+    LOCAL_PG_USER        Database superuser name (default team_tryouts_dev)
+    LOCAL_PG_DATABASE    Database name (default team_tryouts)
+"""
+
+from __future__ import annotations
+
+import atexit
+import contextlib
+import logging
+import os
+import pathlib
+import shutil
+import signal
+import subprocess
+import sys
+import tempfile
+
+# ---------------------------------------------------------------------------
+# Configuration
+# ---------------------------------------------------------------------------
+
+DATADIR = pathlib.Path(__file__).resolve().parent.parent / 'instance' / 'pgdata'
+PG_LOG = DATADIR.parent / 'pg.log'
+
+PORT = int(os.getenv('LOCAL_PG_PORT', '5433'))
+_USER = os.getenv('LOCAL_PG_USER', 'team_tryouts_dev')
+_DATABASE = os.getenv('LOCAL_PG_DATABASE', 'team_tryouts')
+
+DATABASE_URL = f'postgresql://{_USER}@127.0.0.1:{PORT}/{_DATABASE}'
+
+_started = False
+
+#: Name of the system Windows PostgreSQL service we temporarily stopped.
+_stopped_system_service_name: str | None = None
+
+logger = logging.getLogger('app.local_postgres')
+# ---------------------------------------------------------------------------
+# Binary discovery
+# ---------------------------------------------------------------------------
+
+_WIN_PG_ROOTS = [
+    pathlib.Path(os.environ.get('PROGRAMFILES', 'C:\\Program Files')) / 'PostgreSQL',
+    pathlib.Path(os.environ.get('PROGRAMFILES(X86)', 'C:\\Program Files (x86)')) / 'PostgreSQL',
+]
+
+
+def _find_binary(name: str) -> pathlib.Path | None:
+    """Locate a PostgreSQL binary (pg_ctl, initdb, psql)."""
+    found = shutil.which(name)
+    if found:
+        return pathlib.Path(found)
+
+    if sys.platform == 'win32':
+        for root in _WIN_PG_ROOTS:
+            if not root.is_dir():
+                continue
+            versions = sorted(
+                (p for p in root.iterdir() if p.is_dir()),
+                key=lambda p: p.name,
+                reverse=True,
+            )
+            for version_dir in versions:
+                candidate = version_dir / 'bin' / f'{name}.exe'
+                if candidate.is_file():
+                    return candidate
+
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Windows service management
+# ---------------------------------------------------------------------------
+
+#: Path to the Windows service controller.
+_SC_EXE = pathlib.Path(os.environ.get('SYSTEMROOT', 'C:\\Windows')) / 'System32' / 'sc.exe'
+
+
+def _detect_system_service() -> str | None:
+    """Find a running Windows PostgreSQL service installed by the EDB installer.
+
+    Returns the service name (e.g. ``postgresql-x64-18``) or None.
+    """
+    if sys.platform != 'win32' or not _SC_EXE.is_file():
+        return None
+    for root in _WIN_PG_ROOTS:
+        if not root.is_dir():
+            continue
+        versions = sorted(
+            (p for p in root.iterdir() if p.is_dir()),
+            key=lambda p: p.name,
+            reverse=True,
+        )
+        for version_dir in versions:
+            srv = f'postgresql-x64-{version_dir.name}'
+            try:
+                result = subprocess.run(
+                    [str(_SC_EXE), 'query', srv],
+                    capture_output=True,
+                    text=True,
+                )
+                if result.returncode == 0 and 'RUNNING' in result.stdout:
+                    return srv
+            except (FileNotFoundError, OSError):
+                continue
+    return None
+
+
+def _stop_system_service(name: str):
+    """Stop a Windows system service."""
+    print(f'[INFO] Stopping system PostgreSQL service "{name}" ...')
+    try:
+        subprocess.run(
+            [str(_SC_EXE), 'stop', name],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except (FileNotFoundError, OSError) as exc:
+        print(f'[WARNING] Could not stop service "{name}": {exc}')
+
+
+def _start_system_service(name: str):
+    """Start a Windows system service."""
+    print(f'[INFO] Restarting system PostgreSQL service "{name}" ...')
+    try:
+        subprocess.run(
+            [str(_SC_EXE), 'start', name],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except (FileNotFoundError, OSError) as exc:
+        print(f'[WARNING] Could not restart service "{name}": {exc}')
+
+
+# ---------------------------------------------------------------------------
+# Data directory management
+# ---------------------------------------------------------------------------
+
+_TRUST_HBA = """\
+# Local development configuration — trust all local connections.
+# Installed by app/local_postgres.py.
+local   all   all                    trust
+host   all   all   127.0.0.1/32     trust
+host   all   all   ::1/128          trust
+"""
+
+
+def _init_cluster():
+    """Create the data directory if it does not exist yet."""
+    if DATADIR.is_dir() and (DATADIR / 'PG_VERSION').is_file():
+        return
+
+    initdb = _find_binary('initdb')
+    if not initdb:
+        print(
+            '[ERROR] PostgreSQL not found. Install it from:',
+            'https://www.postgresql.org/download/windows/',
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
+    print(f'[INFO] Initialising PostgreSQL data directory at {DATADIR} ...')
+    DATADIR.mkdir(parents=True, exist_ok=True)
+
+    # Write a non-empty password to a temporary file. PostgreSQL >= 18
+    # rejects an empty password (NUL device), and we immediately overwrite
+    # pg_hba.conf with trust auth anyway, so the value is irrelevant.
+    pw_file = tempfile.NamedTemporaryFile(  # noqa: SIM115 — delete=False needed for initdb --pwfile
+        mode='w',
+        delete=False,
+        suffix='.pw',
+        prefix='pg_',
+    )
+    pw_file.write('dev\n')
+    pw_file.close()
+
+    try:
+        subprocess.run(
+            [
+                str(initdb),
+                '--locale=C',
+                '--encoding=UTF8',
+                '--data-checksums',
+                '--username',
+                _USER,
+                '--pwfile',
+                pw_file.name,
+                '-D',
+                str(DATADIR),
+            ],
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+    except subprocess.CalledProcessError as exc:
+        print(f'[ERROR] initdb failed (exit {exc.returncode}):')
+        if exc.stderr:
+            print(exc.stderr)
+        if exc.stdout:
+            print(exc.stdout)
+        sys.exit(1)
+    finally:
+        with contextlib.suppress(OSError):
+            os.unlink(pw_file.name)
+
+    _set_postgresql_conf()
+
+    hba_path = DATADIR / 'pg_hba.conf'
+    hba_path.write_text(_TRUST_HBA, encoding='utf-8')
+    print('[INFO] pg_hba.conf set to trust local connections.')
+
+
+def _set_postgresql_conf():
+    """Write postgresql.conf to match our development settings."""
+    conf_path = DATADIR / 'postgresql.conf'
+    if not conf_path.is_file():
+        return
+
+    lines = conf_path.read_text(encoding='utf-8').splitlines()
+    lines.append('\n# ---- local_postgres.py overrides ----')
+    lines.append(f'port = {PORT}')
+    lines.append("listen_addresses = '127.0.0.1'")
+    lines.append("unix_socket_directories = ''")
+    lines.append('autovacuum = off')  # avoid DLL conflicts with system PostgreSQL service
+    lines.append('logging_collector = off')
+    lines.append('log_destination = stderr')
+    conf_path.write_text('\n'.join(lines), encoding='utf-8')
+
+
+# ---------------------------------------------------------------------------
+# Server start / stop
+# ---------------------------------------------------------------------------
+
+
+def _pg_ctl(args: list[str], cwd: str | None = None) -> subprocess.CompletedProcess:
+    """Run ``pg_ctl`` with the data directory pre-filled."""
+    pg_ctl = _find_binary('pg_ctl')
+    if not pg_ctl:
+        raise RuntimeError('pg_ctl binary not found')
+
+    return subprocess.run(
+        [str(pg_ctl), *args, '-D', str(DATADIR), '-w'],
+        capture_output=True,
+        text=True,
+        cwd=cwd or str(DATADIR),
+    )
+
+
+def _server_running() -> bool:
+    """Return True if the server is already up on our port."""
+    try:
+        result = _pg_ctl(['status'])
+        return result.returncode == 0
+    except (FileNotFoundError, RuntimeError):
+        return False
+
+
+def _create_database():
+    """Create the database if it does not exist."""
+    psql = _find_binary('psql')
+    if not psql:
+        raise RuntimeError('psql binary not found')
+
+    check = subprocess.run(
+        [
+            str(psql),
+            '-h',
+            '127.0.0.1',
+            '-p',
+            str(PORT),
+            '-U',
+            _USER,
+            '-d',
+            'postgres',
+            '-tAc',
+            f"SELECT 1 FROM pg_database WHERE datname = '{_DATABASE}'",
+        ],
+        capture_output=True,
+        text=True,
+        env={**os.environ, 'PGPASSWORD': ''},
+    )
+
+    if check.stdout.strip() == '1':
+        print(f'[INFO] Database "{_DATABASE}" already exists.')
+        return
+
+    subprocess.run(
+        [
+            str(psql),
+            '-h',
+            '127.0.0.1',
+            '-p',
+            str(PORT),
+            '-U',
+            _USER,
+            '-d',
+            'postgres',
+            '-c',
+            f'CREATE DATABASE "{_DATABASE}"',
+        ],
+        check=True,
+        capture_output=True,
+        text=True,
+        env={**os.environ, 'PGPASSWORD': ''},
+    )
+    print(f'[INFO] Created database "{_DATABASE}".')
+
+
+def _stop(*_args):
+    """Stop the PostgreSQL server with a fast shutdown.
+
+    Registered as an ``atexit`` handler so it fires on normal exit. Signal
+    handling goes through ``_handle_stop_signal``, which also stops the
+    server but then re-raises so the process actually exits.
+    """
+    global _started
+    global _stopped_system_service_name
+    if not _started:
+        return
+    _started = False
+
+    try:
+        result = _pg_ctl(['stop', '-m', 'fast'])
+        if result.returncode != 0:
+            logger.info('pg_ctl stop returned %d: %s', result.returncode, result.stderr.strip())
+        else:
+            logger.info('Local PostgreSQL stopped.')
+    except Exception as exc:  # noqa: BLE001 — shutdown must never raise
+        logger.warning('Failed to stop local PostgreSQL: %s', exc)
+
+    # Restart the system service if we stopped it earlier.
+    if _stopped_system_service_name:
+        srv = _stopped_system_service_name
+        _stopped_system_service_name = None
+        _start_system_service(srv)
+
+
+def _handle_stop_signal(signum, frame):
+    """Stop PostgreSQL, then let the interpreter shut down normally.
+
+    ``_stop`` alone would swallow Ctrl+C: it stops the server and restores the
+    system service, then returns without exiting, leaving the dev server
+    running against a stopped database and the terminal frozen. Re-raising
+    ``KeyboardInterrupt`` hands control back to the framework, which exits;
+    the ``atexit`` registration then runs ``_stop`` again (idempotent).
+    """
+    _stop()
+    raise KeyboardInterrupt
+
+
+# ---------------------------------------------------------------------------
+# Public API
+# ---------------------------------------------------------------------------
+
+
+def start() -> str:
+    """Start a local PostgreSQL server for development.
+
+    Returns the ``DATABASE_URL`` the application should use.
+
+    The caller is expected to set this on ``os.environ['DATABASE_URL']``
+    before invoking ``create_app()``.
+
+    This function is idempotent: if the server is already running and the
+    database exists, it returns immediately.
+    """
+    global _started
+    global _stopped_system_service_name
+
+    # On Windows, temporarily stop the system PostgreSQL service so its child
+    # processes (autovacuum, etc.) do not collide with our local instance.
+    if _stopped_system_service_name is None:  # only do this once per process
+        srv = _detect_system_service()
+        if srv:
+            _stop_system_service(srv)
+            _stopped_system_service_name = srv
+
+    # 1. Initialise if needed.
+    _init_cluster()
+
+    # 2. Start if not already running.
+    if not _server_running():
+        print(f'[INFO] Starting PostgreSQL on port {PORT} ...')
+        PG_LOG.parent.mkdir(parents=True, exist_ok=True)
+        pg_ctl = _find_binary('pg_ctl')
+        try:
+            subprocess.run(
+                [
+                    str(pg_ctl),
+                    'start',
+                    '-D',
+                    str(DATADIR),
+                    '-l',
+                    str(PG_LOG),
+                    '-w',  # wait for readiness
+                ],
+                check=True,
+            )
+        except subprocess.CalledProcessError:
+            print('[ERROR] pg_ctl start failed.')
+            # Also show the server log — it often has the real error.
+            try:
+                log_text = PG_LOG.read_text(encoding='utf-8')
+                if log_text.strip():
+                    print(f'Server log ({PG_LOG}):')
+                    print(log_text)
+            except Exception:  # noqa: BLE001
+                pass
+            sys.exit(1)
+        print(f'[INFO] PostgreSQL is up (pid in {PG_LOG}).')
+    else:
+        print(f'[INFO] PostgreSQL is already running on port {PORT}.')
+
+    # 3. Create the application database (idempotent).
+    _create_database()
+
+    # 4. Register cleanup.
+    if not _started:
+        _started = True
+        atexit.register(_stop)
+        with contextlib.suppress(ValueError, OSError):
+            signal.signal(signal.SIGINT, _handle_stop_signal)
+        with contextlib.suppress(AttributeError, ValueError, OSError):
+            signal.signal(signal.SIGBREAK, _handle_stop_signal)  # type: ignore[attr-defined]
+
+    logger.info('Local PostgreSQL ready — DATABASE_URL=%s', DATABASE_URL)
+    return DATABASE_URL

app/models/__init__.py

@@ -94,3 +94,20 @@ from app.models.contract import Contract
 from app.models.team_note import TeamNote
 from app.models.personal_note import PersonalNote
 from app.models.one_on_one_request import OneOnOneRequest
+from app.models.admin_settings import AppSettings
+from app.models.backup_record import BackupRecord
+from app.models.audit_log import AuditLog
+
+# =========================================================================
+# Layer 12: documents (canonical document + versions + assignments)
+# =========================================================================
+from app.models.document import (
+    ACKNOWLEDGMENT_KINDS,
+    ASSIGNMENT_STATUSES,
+    DOCUMENT_KIND_ROLES,
+    DOCUMENT_KINDS,
+    SIGNATURE_KINDS,
+    Document,
+    DocumentAssignment,
+    DocumentVersion,
+)

app/models/_constants.py

@@ -71,9 +71,9 @@ PLATFORM_DEFAULTS = {'Apex Legends': 'pc', 'Rainbow Six Siege': 'ubi', 'Rocket L
 
 TRN_URLS = {
     'Valorant': 'https://tracker.gg/valorant/profile/riot/{username}',
-    'League of Legends': 'https://tracker.gg/lol/profile/{username}',
+    'League of Legends': 'https://tracker.gg/lol/riot/profile/{username}',
     'Counter-Strike 2': 'https://tracker.gg/cs2/profile/steam/{username}',
-    'Apex Legends': 'https://tracker.gg/apex/profile/{platform}/{username}',
+    'Apex Legends': 'https://tracker.gg/apex/profile/{platform_code}/{username}',
     'Overwatch 2': 'https://tracker.gg/overwatch/profile/battlenet/{username}',
     'Rainbow Six Siege': 'https://r6.tracker.network/r6siege/profile/{platform_code}/{username}',
     'Rocket League': 'https://rocketleague.tracker.network/rocket-league/profile/{platform_code}/{username}',

app/models/admin_settings.py

@@ -0,0 +1,56 @@
+"""Global application settings stored as key-value pairs in the database."""
+
+from app.extensions import db
+
+
+class AppSettings(db.Model):
+    """Key-value store for global application settings.
+
+    Stores toggles and configuration that admins control through the
+    admin panel, such as whether tryouts are open, season state, etc.
+    """
+
+    __tablename__ = 'app_settings'
+
+    key = db.Column(db.String(100), primary_key=True)
+    value = db.Column(db.Text, nullable=True)
+
+    # ------------------------------------------------------------------
+    # Well-known keys (documented here for discoverability)
+    # ------------------------------------------------------------------
+    # tryouts_open             – "true" / "false"  (default: "true")
+    # document_uploads_enabled – "true" / "false"  (default: "true")
+    # season_active            – "true" / "false"  (default: "false")
+    # season_name              – e.g. "Fall 2026"
+    # season_start             – ISO date string
+    # season_end               – ISO date string
+
+    @staticmethod
+    def get(key, default=None):
+        """Return the value for *key*, or *default* if not set."""
+        row = db.session.get(AppSettings, key)
+        return row.value if row is not None else default
+
+    @staticmethod
+    def set(key, value):
+        """Upsert a setting."""
+        row = db.session.get(AppSettings, key)
+        if row is None:
+            row = AppSettings(key=key, value=str(value) if value is not None else None)
+            db.session.add(row)
+        else:
+            row.value = str(value) if value is not None else None
+        db.session.commit()
+
+    @staticmethod
+    def get_bool(key, default=False):
+        """Return a boolean setting."""
+        val = AppSettings.get(key)
+        if val is None:
+            return default
+        return val.lower() in ('true', '1', 'yes', 'on')
+
+    @staticmethod
+    def set_bool(key, value):
+        """Store a boolean setting as 'true' / 'false'."""
+        AppSettings.set(key, 'true' if value else 'false')

app/models/audit_log.py

@@ -0,0 +1,32 @@
+"""Audit log for tracking sensitive administrative actions."""
+
+from app.extensions import db
+from app.time_utils import utc_now_naive
+
+
+class AuditLog(db.Model):
+    """Append-only log of critical admin actions for accountability."""
+
+    __tablename__ = 'audit_logs'
+
+    id = db.Column(db.Integer, primary_key=True)
+    user_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=True)
+    action = db.Column(db.String(100), nullable=False)
+    details = db.Column(db.Text, nullable=True)
+    ip_address = db.Column(db.String(64), nullable=True)
+    created_at = db.Column(db.DateTime, default=utc_now_naive)
+
+    user = db.relationship('User', foreign_keys=[user_id], backref='audit_logs')
+
+    @staticmethod
+    def record(user_id, action, details=None, ip_address=None):
+        """Create a new audit log entry."""
+        entry = AuditLog(
+            user_id=user_id,
+            action=action,
+            details=details,
+            ip_address=ip_address,
+        )
+        db.session.add(entry)
+        db.session.commit()
+        return entry

app/models/backup_record.py

@@ -0,0 +1,21 @@
+"""Records of database backups created through the admin panel."""
+
+from app.extensions import db
+from app.time_utils import utc_now_naive
+
+
+class BackupRecord(db.Model):
+    """Metadata for a database backup stored on disk."""
+
+    __tablename__ = 'backup_records'
+
+    id = db.Column(db.Integer, primary_key=True)
+    filename = db.Column(db.String(255), nullable=False)
+    file_path = db.Column(db.String(500), nullable=False)
+    size_bytes = db.Column(db.BigInteger, nullable=True)
+    backup_type = db.Column(db.String(20), default='manual')  # 'manual' or 'auto'
+    notes = db.Column(db.Text, nullable=True)
+    created_by_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=True)
+    created_at = db.Column(db.DateTime, default=utc_now_naive)
+
+    creator = db.relationship('User', foreign_keys=[created_by_id], backref='backups')

app/models/document.py

@@ -0,0 +1,173 @@
+"""Documents, versions, and per-user assignments.
+
+The old contract flow stored one uploaded file per player even when the
+file was identical for everyone, and Drive received no team/role structure
+at all.  This module replaces that with three two-level concepts:
+
+- ``Document``          the canonical document (e.g. ``Contrat joueur``).
+                        One row per kind; the file is stored once, never
+                        once per person.
+- ``DocumentVersion``   an immutable published revision.  Uploading a new
+                        PDF is publishing a new version, which is the twice
+                        a year update cycle.
+- ``DocumentAssignment`` a per-person obligation.  ``UNIQUE(document_id,
+                        user_id)`` is what guarantees a player signs a
+                        document exactly once, whatever the number of teams
+                        they sit on.
+
+Signing obligations are role-scoped, not team-scoped: the team folder in
+Drive is a *filing* concern for the signed copy; the obligation itself is
+created once per eligible person.
+"""
+
+from app.extensions import db
+from app.time_utils import utc_now_naive
+
+#: Every document kind this application can hold.
+DOCUMENT_KINDS = (
+    'player',
+    'coach',
+    'manager',
+    'team',
+    'code_of_conduct',
+    'ethics_code',
+)
+
+#: Kinds whose completion is an uploaded signed PDF.
+SIGNATURE_KINDS = ('player', 'coach', 'manager', 'team')
+
+#: Kinds whose completion is read-and-acknowledge only (no file).
+ACKNOWLEDGMENT_KINDS = ('code_of_conduct', 'ethics_code')
+
+#: Kind -> set of roles eligible to complete it.  ``team`` and the two
+#: codes span roles; the three role contracts are single-role by nature.
+DOCUMENT_KIND_ROLES = {
+    'player': ('player',),
+    'coach': ('coach',),
+    'manager': ('manager',),
+    'team': ('player', 'coach', 'manager'),
+    'code_of_conduct': ('player', 'coach', 'manager'),
+    'ethics_code': ('player', 'coach', 'manager'),
+}
+
+#: Possible values for DocumentAssignment.status.
+ASSIGNMENT_STATUSES = ('pending', 'signed', 'acknowledged')
+
+
+class Document(db.Model):
+    """A canonical document, stored once, completed by eligible people."""
+
+    __tablename__ = 'documents'
+
+    id = db.Column(db.Integer, primary_key=True)
+    title = db.Column(db.String(255), nullable=False)
+    kind = db.Column(db.String(30), nullable=False, default='player')
+    #: Admins choose when the document is downloadable by team members.  The
+    #: old ``document_uploads_enabled`` global toggle is replaced by this
+    #: per-document switch for the new flow.
+    is_published = db.Column(db.Boolean, nullable=False, default=False)
+    current_version_id = db.Column(db.Integer, db.ForeignKey('document_versions.id'), nullable=True)
+    created_by = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=False)
+    created_at = db.Column(db.DateTime, default=utc_now_naive)
+
+    versions = db.relationship(
+        'DocumentVersion',
+        backref='document',
+        lazy='dynamic',
+        order_by='DocumentVersion.version',
+        foreign_keys='DocumentVersion.document_id',
+    )
+    current_version = db.relationship(
+        'DocumentVersion',
+        foreign_keys=[current_version_id],
+        uselist=False,
+    )
+    assignments = db.relationship(
+        'DocumentAssignment',
+        back_populates='document',
+        lazy='dynamic',
+        order_by='DocumentAssignment.created_at',
+        foreign_keys='DocumentAssignment.document_id',
+    )
+    creator = db.relationship('User', foreign_keys=[created_by])
+
+    @property
+    def requires_signature(self):
+        """Whether completion means an uploaded signed PDF."""
+        return self.kind in SIGNATURE_KINDS
+
+    def completion_counts(self):
+        """(completed, pending) over every assignment of this document.
+
+        ``completed`` covers both signed and acknowledged assignments.
+        """
+        rows = (
+            db.session.query(DocumentAssignment.status, db.func.count())
+            .filter(DocumentAssignment.document_id == self.id)
+            .group_by(DocumentAssignment.status)
+            .all()
+        )
+        totals = dict(rows)
+        completed = totals.get('signed', 0) + totals.get('acknowledged', 0)
+        return completed, totals.get('pending', 0)
+
+    def next_version_number(self):
+        """The version number a freshly published revision should carry."""
+        latest = self.versions.order_by(DocumentVersion.version.desc()).first()
+        return (latest.version + 1) if latest else 1
+
+
+class DocumentVersion(db.Model):
+    """One immutable published revision of a document."""
+
+    __tablename__ = 'document_versions'
+
+    id = db.Column(db.Integer, primary_key=True)
+    document_id = db.Column(db.Integer, db.ForeignKey('documents.id'), nullable=False)
+    version = db.Column(db.Integer, nullable=False)
+    original_filename = db.Column(db.String(255), nullable=False)
+    stored_filename = db.Column(db.String(255), nullable=False)
+    #: ``gdrive://<file-id>`` for Drive storage, or a path relative to the
+    #: document root for the local backend.
+    file_path = db.Column(db.String(500), nullable=False)
+    notes = db.Column(db.Text, nullable=True)
+    published_by = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=False)
+    published_at = db.Column(db.DateTime, default=utc_now_naive)
+
+    publisher = db.relationship('User', foreign_keys=[published_by])
+
+    __table_args__ = (
+        db.UniqueConstraint('document_id', 'version', name='unique_document_version'),
+    )
+
+
+class DocumentAssignment(db.Model):
+    """One person's obligation to sign or acknowledge a document."""
+
+    __tablename__ = 'document_assignments'
+
+    id = db.Column(db.Integer, primary_key=True)
+    document_id = db.Column(db.Integer, db.ForeignKey('documents.id'), nullable=False)
+    user_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=False)
+    completed_version_id = db.Column(
+        db.Integer, db.ForeignKey('document_versions.id'), nullable=True
+    )
+    status = db.Column(db.String(20), nullable=False, default='pending')
+    signed_filename = db.Column(db.String(255), nullable=True)
+    signed_file_path = db.Column(db.String(500), nullable=True)
+    completed_at = db.Column(db.DateTime, nullable=True)
+    #: The team whose Drive folder files the signed copy.  A member on
+    #: several teams still files under one canonical team only.
+    filed_team_id = db.Column(db.Integer, db.ForeignKey('org_teams.id'), nullable=True)
+    created_at = db.Column(db.DateTime, default=utc_now_naive)
+
+    document = db.relationship('Document', back_populates='assignments', foreign_keys=[document_id])
+    user = db.relationship('User', foreign_keys=[user_id], backref='document_assignments')
+    completed_version = db.relationship('DocumentVersion', foreign_keys=[completed_version_id])
+    filed_team = db.relationship('OrgTeam', foreign_keys=[filed_team_id])
+
+    __table_args__ = (db.UniqueConstraint('document_id', 'user_id', name='unique_document_user'),)
+
+    @property
+    def completed(self):
+        return self.status in ('signed', 'acknowledged')

app/models/match_model/base.py

@@ -11,7 +11,7 @@ class BaseMatch(db.Model):
 
     title = db.Column(db.String(200), nullable=False)
     description = db.Column(db.Text, nullable=True)
-    date = db.Column(db.Date, nullable=False)
+    date = db.Column(db.Date, nullable=False, index=True)
     start_time = db.Column(db.Time, nullable=True)
     end_time = db.Column(db.Time, nullable=True)
     location = db.Column(db.String(200), nullable=True)

app/models/one_on_one_request.py

@@ -12,7 +12,7 @@ class OneOnOneRequest(db.Model):
     player_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=False)
     coach_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=False)
     org_team_id = db.Column(db.Integer, db.ForeignKey('org_teams.id'), nullable=True)
-    date = db.Column(db.Date, nullable=False)
+    date = db.Column(db.Date, nullable=False, index=True)
     start_time = db.Column(db.Time, nullable=False)
     end_time = db.Column(db.Time, nullable=False)
     points = db.Column(db.Text, nullable=True)

app/models/tryout/tryout.py

@@ -13,21 +13,25 @@ class Tryout(db.Model):
     title = db.Column(db.String(200), nullable=False)
     description = db.Column(db.Text, nullable=True)
     game = db.Column(db.String(50), nullable=False)
-    date = db.Column(db.Date, nullable=False)
+    date = db.Column(db.Date, nullable=False, index=True)
     end_date = db.Column(db.Date, nullable=True)
     location = db.Column(db.String(200), nullable=True)
     status = db.Column(db.String(20), default='upcoming')
     max_players = db.Column(db.Integer, nullable=True)
     created_by = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=False)
     target_org_team_id = db.Column(db.Integer, db.ForeignKey('org_teams.id'), nullable=True)
-    manager_id = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=True)  # deprecated, kept for migration
+    manager_id = db.Column(
+        db.Integer, db.ForeignKey('users.id'), nullable=True
+    )  # deprecated, kept for migration
     coach_id = db.Column(
         db.Integer, db.ForeignKey('users.id'), nullable=True
     )  # deprecated, kept for migration
     created_at = db.Column(db.DateTime, default=utc_now_naive)
 
     creator = db.relationship('User', foreign_keys=[created_by], backref='created_tryouts')
-    manager = db.relationship('User', foreign_keys=[manager_id], backref='managed_tryouts')  # deprecated
+    manager = db.relationship(
+        'User', foreign_keys=[manager_id], backref='managed_tryouts'
+    )  # deprecated
     coach = db.relationship('User', foreign_keys=[coach_id], backref='_deprecated_coached_tryouts')
     coaches = db.relationship('User', secondary=tryout_coaches, backref='coached_tryouts')
     managers = db.relationship('User', secondary=tryout_managers, backref='managed_tryouts_m2m')

app/responders.py

@@ -0,0 +1,84 @@
+"""Helpers for mutating routes that should not force a full page reload.
+
+The site is server-rendered, and every mutating route used to end with
+``return redirect(url_for(...))``, so each change reloaded the whole page:
+scroll reset, open dialogs closed, and chaining several edits meant waiting
+for a full render between each one.
+
+These helpers let a route answer an AJAX submit (the ``data-ajax`` forms in
+main.js) with a small JSON payload instead of a redirect, while the plain
+HTML form path keeps behaving exactly as before. The client then fetches the
+page again and swaps only the content region, so the page never reloads.
+
+The counterpart that performs the swap lives in app/static/js/main.js.
+"""
+
+from flask import get_flashed_messages, jsonify, redirect, request, session
+
+from app.models import AppSettings
+
+#: Key holding a coarse, monotonically increasing stamp for the whole dataset.
+#: It advances after every committed mutation so a stale client can be told
+#: (with a 409) that someone else has changed what it is looking at.
+REVISION_KEY = 'data_revision'
+
+
+def is_ajax_submit():
+    """Whether this POST came from the fetch-based form handler in main.js."""
+    return request.headers.get('X-Requested-With') == 'XMLHttpRequest'
+
+
+def current_revision():
+    """The current revision stamp, as an int (0 when nothing has been bumped)."""
+    try:
+        return int(AppSettings.get(REVISION_KEY, '0') or '0')
+    except (TypeError, ValueError):
+        return 0
+
+
+def bump_revision():
+    """Advance the revision stamp after a committed change.
+
+    Stored through AppSettings so it survives restarts and is shared by every
+    worker, unlike a module-level counter.
+    """
+    AppSettings.set(REVISION_KEY, str(current_revision() + 1))
+
+
+def _flashed_success():
+    """Whether a success flash is pending, without consuming it.
+
+    The HTML path still redirects and must leave the flash for the next page
+    to render; peeking at the session is the only way to know without clearing
+    it. Only a successful commit advances the revision -- a rejected edit must
+    not make other users reload for nothing.
+    """
+    flashes = session.get('_flashes', [])
+    return any(category == 'success' for category, _message in flashes)
+
+
+def respond_after_change(redirect_url):
+    """Answer a committed (or rejected) mutation.
+
+    For a normal HTML form submit this is exactly the ``redirect(...)`` the
+    routes used to return. For an AJAX submit it returns JSON telling the
+    client where to fetch the refreshed fragment and which flash messages to
+    show, so the page can update in place instead of reloading.
+    """
+    if _flashed_success():
+        bump_revision()
+
+    if is_ajax_submit():
+        messages = [
+            {'category': category, 'text': message}
+            for category, message in get_flashed_messages(with_categories=True)
+        ]
+        return jsonify(
+            {
+                'ok': True,
+                'redirect': redirect_url,
+                'messages': messages,
+                'revision': current_revision(),
+            }
+        )
+    return redirect(redirect_url)

app/routes/admin.py

@@ -0,0 +1,613 @@
+"""Admin panel routes for system-level management.
+
+Provides backup/restore, tryout open/close toggling, season lifecycle
+management, team wiping, and audit log viewing. All routes are restricted
+to administrators.
+"""
+
+import os
+import uuid
+from datetime import datetime
+
+from flask import (
+    Blueprint,
+    flash,
+    redirect,
+    render_template,
+    request,
+    send_file,
+    url_for,
+)
+from flask_babel import gettext as _
+from flask_login import current_user, login_required
+from marshmallow import ValidationError
+from werkzeug.utils import secure_filename
+
+from app.extensions import db
+from app.forms import flash_validation_errors
+from app.models import (
+    DOCUMENT_KIND_ROLES,
+    DOCUMENT_KINDS,
+    Admin,
+    AppSettings,
+    AuditLog,
+    BackupRecord,
+    Document,
+    DocumentAssignment,
+    DocumentVersion,
+    OrgTeam,
+    TeamMatch,
+    TeamMatchParticipant,
+    TeamPlayer,
+    Tryout,
+    User,
+)
+from app.responders import respond_after_change
+from app.routes.users._shared import ALLOWED_CONTRACT_EXTENSIONS, pdf_upload_error
+from app.services.documents import backfill_assignments_for_document
+from app.storage import GoogleDriveStorageError, open_document, store_master_document
+from app.supporting_scripts.backup import (
+    BackupError,
+    backup_database,
+    create_backup_dir,
+    parse_database_url,
+)
+from app.validators import DocumentCreateSchema
+
+admin_bp = Blueprint('admin', __name__, url_prefix='/admin')
+
+
+def require_admin():
+    """Return True if current user is an Admin, else flash and redirect."""
+    if isinstance(current_user, Admin):
+        return True
+    flash('Only the president can access the admin panel.', 'danger')
+    return False
+
+
+def _client_ip():
+    """Best-effort client IP for audit logging."""
+    if request.headers.get('X-Forwarded-For'):
+        return request.headers.get('X-Forwarded-For').split(',')[0].strip()
+    return request.remote_addr
+
+
+def _log(action, details=None):
+    """Record an audit log entry for the current user."""
+    AuditLog.record(
+        user_id=current_user.id,
+        action=action,
+        details=details,
+        ip_address=_client_ip(),
+    )
+
+
+# ---------------------------------------------------------------------------
+# Dashboard
+# ---------------------------------------------------------------------------
+
+
+@admin_bp.route('')
+@login_required
+def dashboard():
+    """Render the admin panel dashboard."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    stats = {
+        'total_users': User.query.count(),
+        'total_players': User.query.filter_by(role='player').count(),
+        'total_org_teams': OrgTeam.query.count(),
+        'active_tryouts': Tryout.query.filter_by(status='in_progress').count(),
+        'upcoming_tryouts': Tryout.query.filter_by(status='upcoming').count(),
+    }
+
+    settings = {
+        'tryouts_open': AppSettings.get_bool('tryouts_open', default=True),
+        'document_uploads_enabled': AppSettings.get_bool('document_uploads_enabled', default=True),
+        'season_active': AppSettings.get_bool('season_active', default=False),
+        'season_name': AppSettings.get('season_name') or 'Not set',
+        'season_start': AppSettings.get('season_start') or 'Not set',
+        'season_end': AppSettings.get('season_end') or 'Not set',
+    }
+
+    backups = BackupRecord.query.order_by(BackupRecord.created_at.desc()).limit(20).all()
+    audit_logs = AuditLog.query.order_by(AuditLog.created_at.desc()).limit(20).all()
+
+    return render_template(
+        'pages/admin.html',
+        stats=stats,
+        settings=settings,
+        backups=backups,
+        audit_logs=audit_logs,
+    )
+
+
+# ---------------------------------------------------------------------------
+# Backups
+# ---------------------------------------------------------------------------
+
+
+def _create_backup_record(backup_type='manual', notes=None):
+    """Run a database backup and return a BackupRecord, or raise BackupError."""
+    create_backup_dir()
+    conn = parse_database_url(os.getenv('DATABASE_URL'))
+    file_path = backup_database(conn)
+    size = os.path.getsize(file_path) if os.path.exists(file_path) else 0
+    filename = os.path.basename(file_path)
+
+    record = BackupRecord(
+        filename=filename,
+        file_path=file_path,
+        size_bytes=size,
+        backup_type=backup_type,
+        notes=notes,
+        created_by_id=current_user.id,
+    )
+    db.session.add(record)
+    db.session.commit()
+    return record
+
+
+@admin_bp.route('/backup/create', methods=['POST'])
+@login_required
+def create_backup():
+    """Create a manual database backup."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    notes = request.form.get('notes', '').strip() or None
+    try:
+        record = _create_backup_record(backup_type='manual', notes=notes)
+    except BackupError as e:
+        flash(f'Backup failed: {e}', 'danger')
+        _log('backup_failed', f'Error: {e}')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    _log('backup_created', f'File: {record.filename} ({record.size_bytes} bytes)')
+    flash(f'Backup created successfully: {record.filename}', 'success')
+    return respond_after_change(url_for('admin.dashboard'))
+
+
+@admin_bp.route('/backup/<int:backup_id>/download')
+@login_required
+def download_backup(backup_id):
+    """Download a backup file."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    record = BackupRecord.query.get_or_404(backup_id)
+    if not os.path.exists(record.file_path):
+        flash('Backup file is missing from disk.', 'danger')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    _log('backup_downloaded', f'File: {record.filename}')
+    return send_file(record.file_path, as_attachment=True, download_name=record.filename)
+
+
+@admin_bp.route('/backup/<int:backup_id>/delete', methods=['POST'])
+@login_required
+def delete_backup(backup_id):
+    """Delete a backup file and its record."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    record = BackupRecord.query.get_or_404(backup_id)
+    if os.path.exists(record.file_path):
+        try:
+            os.remove(record.file_path)
+        except OSError as e:
+            flash(f'Could not remove backup file: {e}', 'danger')
+            return respond_after_change(url_for('admin.dashboard'))
+
+    _log('backup_deleted', f'File: {record.filename}')
+    db.session.delete(record)
+    db.session.commit()
+    flash(f'Backup {record.filename} deleted.', 'success')
+    return respond_after_change(url_for('admin.dashboard'))
+
+
+@admin_bp.route('/backup/<int:backup_id>/restore', methods=['POST'])
+@login_required
+def restore_backup(backup_id):
+    """Restore a selected backup.
+
+    A safety backup of the current state is created first, then the
+    selected dump is restored via pg_restore.
+    """
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    record = BackupRecord.query.get_or_404(backup_id)
+    if not os.path.exists(record.file_path):
+        flash('Backup file is missing from disk.', 'danger')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    # Create a safety backup of the current state before restoring.
+    try:
+        _create_backup_record(
+            backup_type='pre_restore',
+            notes='Automatic safety backup before restoring ' + record.filename,
+        )
+    except BackupError as e:
+        flash(f'Could not create safety backup, restore aborted: {e}', 'danger')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    # Restore using pg_restore
+    import subprocess
+
+    from app.supporting_scripts.backup import (
+        PG_RESTORE,
+        dump_environment,
+        parse_database_url,
+    )
+
+    conn = parse_database_url(os.getenv('DATABASE_URL'))
+    cmd = [
+        PG_RESTORE,
+        '--host',
+        conn['host'],
+        '--port',
+        conn['port'],
+        '--username',
+        conn['user'],
+        '--dbname',
+        conn['dbname'],
+        '--clean',
+        '--if-exists',
+        '--no-owner',
+        record.file_path,
+    ]
+    try:
+        result = subprocess.run(
+            cmd,
+            env=dump_environment(conn),
+            capture_output=True,
+            text=True,
+            timeout=900,
+        )
+        if result.returncode != 0:
+            raise RuntimeError(result.stderr.strip() or 'pg_restore failed')
+    except (subprocess.TimeoutExpired, FileNotFoundError, RuntimeError) as e:
+        flash(f'Restore failed: {e}', 'danger')
+        _log('backup_restore_failed', f'File: {record.filename}, Error: {e}')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    _log('backup_restored', f'File: {record.filename}')
+    flash(
+        f'Backup {record.filename} restored successfully. The database has been rolled back.',
+        'success',
+    )
+    return respond_after_change(url_for('admin.dashboard'))
+
+
+# ---------------------------------------------------------------------------
+# Tryouts open/close toggle
+# ---------------------------------------------------------------------------
+
+
+@admin_bp.route('/toggle-tryouts', methods=['POST'])
+@login_required
+def toggle_tryouts():
+    """Toggle the global tryout open/close state."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    current = AppSettings.get_bool('tryouts_open', default=True)
+    new_value = not current
+    AppSettings.set_bool('tryouts_open', new_value)
+
+    state = 'opened' if new_value else 'closed'
+    _log('tryouts_toggled', f'Tryouts {state}')
+    flash(f'Tryouts are now {state}.', 'success')
+    return respond_after_change(url_for('admin.dashboard'))
+
+
+# ---------------------------------------------------------------------------
+# Season lifecycle
+# ---------------------------------------------------------------------------
+
+
+@admin_bp.route('/season/start', methods=['POST'])
+@login_required
+def start_season():
+    """Begin a new regular season."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    if AppSettings.get_bool('season_active', default=False):
+        flash('A season is already active. End it before starting a new one.', 'danger')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    name = request.form.get('season_name', '').strip()
+    start_date = request.form.get('season_start', '').strip()
+    if not start_date:
+        flash('A season start date is required.', 'danger')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    try:
+        datetime.strptime(start_date, '%Y-%m-%d')
+    except ValueError:
+        flash('Invalid season start date format.', 'danger')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    AppSettings.set('season_name', name or 'Untitled Season')
+    AppSettings.set('season_start', start_date)
+    AppSettings.set('season_end', None)
+    AppSettings.set_bool('season_active', True)
+
+    _log('season_started', f'Season: {name or "Untitled Season"}, Start: {start_date}')
+    flash(f'Season "{name or "Untitled Season"}" has begun.', 'success')
+    return respond_after_change(url_for('admin.dashboard'))
+
+
+@admin_bp.route('/season/end', methods=['POST'])
+@login_required
+def end_season():
+    """End the current regular season."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    if not AppSettings.get_bool('season_active', default=False):
+        flash('No season is currently active.', 'danger')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    end_date = request.form.get('season_end', '').strip()
+    if not end_date:
+        flash('A season end date is required.', 'danger')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    try:
+        datetime.strptime(end_date, '%Y-%m-%d')
+    except ValueError:
+        flash('Invalid season end date format.', 'danger')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    name = AppSettings.get('season_name')
+    AppSettings.set('season_end', end_date)
+    AppSettings.set_bool('season_active', False)
+
+    _log('season_ended', f'Season: {name}, End: {end_date}')
+    flash(f'Season "{name}" has ended.', 'success')
+    return respond_after_change(url_for('admin.dashboard'))
+
+
+@admin_bp.route('/toggle-document-uploads', methods=['POST'])
+@login_required
+def toggle_document_uploads():
+    """Enable or disable document uploads for non-admin users."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    current = AppSettings.get_bool('document_uploads_enabled', default=True)
+    new_value = not current
+    AppSettings.set_bool('document_uploads_enabled', new_value)
+
+    state = 'enabled' if new_value else 'disabled'
+    _log('document_uploads_toggled', f'Document uploads {state}')
+    flash(f'Document uploads are now {state}.', 'success')
+    return respond_after_change(url_for('admin.dashboard'))
+
+
+# ---------------------------------------------------------------------------
+# Wipe teams for new season
+# ---------------------------------------------------------------------------
+
+
+@admin_bp.route('/teams/wipe', methods=['POST'])
+@login_required
+def wipe_teams():
+    """Wipe team rosters and season matches for a new season.
+
+    Players are removed from org teams (TeamPlayer records), regular-season
+    matches and their participants are deleted. OrgTeam structures, coaches,
+    and managers are preserved.
+    """
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    confirm = request.form.get('confirm', '').strip()
+    if confirm != 'WIPE':
+        flash("Type 'WIPE' in the confirmation box to proceed.", 'danger')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    # Safety backup before destructive operation
+    try:
+        _create_backup_record(
+            backup_type='pre_wipe',
+            notes='Automatic safety backup before wiping teams',
+        )
+    except BackupError as e:
+        flash(f'Wipe aborted — could not create safety backup: {e}', 'danger')
+        return respond_after_change(url_for('admin.dashboard'))
+
+    roster_count = TeamPlayer.query.count()
+    match_count = TeamMatch.query.count()
+
+    # Delete team match participants first (FK order)
+    TeamMatchParticipant.query.delete()
+    TeamMatch.query.delete()
+    TeamPlayer.query.delete()
+    db.session.commit()
+
+    _log('teams_wiped', f'Removed {roster_count} roster entries and {match_count} season matches')
+    flash(
+        f'Teams wiped for the new season. Removed {roster_count} roster entries '
+        f'and {match_count} regular-season matches.',
+        'success',
+    )
+    return respond_after_change(url_for('admin.dashboard'))
+
+
+# ---------------------------------------------------------------------------
+# Documents (canonical document store)
+# ---------------------------------------------------------------------------
+
+
+@admin_bp.route('/documents')
+@login_required
+def documents():
+    """List every document with its published flag and completion counts."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    documents = Document.query.order_by(Document.kind, Document.title).all()
+    return render_template(
+        'pages/admin_documents.html',
+        documents=documents,
+        kinds=DOCUMENT_KINDS,
+        kind_roles=DOCUMENT_KIND_ROLES,
+    )
+
+
+@admin_bp.route('/documents/create', methods=['POST'])
+@login_required
+def create_document():
+    """Create a new canonical document (no file yet; publish one next)."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    try:
+        data = DocumentCreateSchema().load(request.form)
+    except ValidationError as err:
+        flash_validation_errors(err)
+        return respond_after_change(url_for('admin.documents'))
+
+    document = Document(
+        title=data['title'],
+        kind=data['kind'],
+        created_by=current_user.id,
+    )
+    db.session.add(document)
+    db.session.commit()
+
+    _log('document_created', f'{data["kind"]}: {data["title"]}')
+    flash(_('Document "%(title)s" created.', title=data['title']), 'success')
+    return respond_after_change(url_for('admin.documents'))
+
+
+@admin_bp.route('/documents/<int:doc_id>/publish-version', methods=['POST'])
+@login_required
+def publish_document_version(doc_id):
+    """Store a new PDF once and record it as the current version."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    document = db.get_or_404(Document, doc_id)
+    file = request.files.get('version_file')
+    error = pdf_upload_error(file, ALLOWED_CONTRACT_EXTENSIONS)
+    if error:
+        flash(error, 'danger')
+        return respond_after_change(url_for('admin.document_detail', doc_id=document.id))
+
+    original_filename = secure_filename(file.filename)
+    stored_filename = f'{uuid.uuid4()}.pdf'
+
+    try:
+        stored_path = store_master_document(file, stored_filename)
+    except GoogleDriveStorageError:
+        flash(
+            _('Document storage is temporarily unavailable. Please try again later.'),
+            'danger',
+        )
+        return respond_after_change(url_for('admin.document_detail', doc_id=document.id))
+
+    version = DocumentVersion(
+        document_id=document.id,
+        version=document.next_version_number(),
+        original_filename=original_filename,
+        stored_filename=stored_filename,
+        file_path=stored_path,
+        notes=request.form.get('notes', '').strip() or None,
+        published_by=current_user.id,
+    )
+    db.session.add(version)
+    db.session.flush()
+    document.current_version_id = version.id
+    db.session.commit()
+
+    backfill_assignments_for_document(document)
+
+    _log('document_version_published', f'{document.title} v{version.version}')
+    flash(
+        _(
+            'Version %(number)s of "%(title)s" published.',
+            number=version.version,
+            title=document.title,
+        ),
+        'success',
+    )
+    return respond_after_change(url_for('admin.document_detail', doc_id=document.id))
+
+
+@admin_bp.route('/documents/<int:doc_id>/toggle-published', methods=['POST'])
+@login_required
+def toggle_document_published(doc_id):
+    """Flip whether team members can see and download the document."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    document = db.get_or_404(Document, doc_id)
+    document.is_published = not document.is_published
+    db.session.commit()
+
+    if document.is_published:
+        # Enabling a document must also backfill anyone who is nowadays
+        # eligible but was not when versions were published earlier.
+        created = backfill_assignments_for_document(document)
+        _log('document_published', f'{document.title} (assignments: {created})')
+        flash(
+            _('"%(title)s" is now downloadable by team members.', title=document.title),
+            'success',
+        )
+    else:
+        _log('document_unpublished', document.title)
+        flash(
+            _('"%(title)s" is no longer downloadable.', title=document.title),
+            'success',
+        )
+    return respond_after_change(url_for('admin.documents'))
+
+
+@admin_bp.route('/documents/version/<int:version_id>/download')
+@login_required
+def download_document_version(version_id):
+    """Admin download of a stored document revision."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    version = db.get_or_404(DocumentVersion, version_id)
+    try:
+        document = open_document(version.file_path)
+    except GoogleDriveStorageError:
+        flash(
+            _('Document storage is temporarily unavailable. Please try again later.'),
+            'danger',
+        )
+        return respond_after_change(url_for('admin.documents'))
+    return send_file(document, as_attachment=True, download_name=version.original_filename)
+
+
+@admin_bp.route('/documents/<int:doc_id>')
+@login_required
+def document_detail(doc_id):
+    """Revisions and per-person completion for one document."""
+    if not require_admin():
+        return redirect(url_for('main.dashboard'))
+
+    document = db.get_or_404(Document, doc_id)
+    versions = document.versions.order_by(DocumentVersion.version).all()
+    assignments = (
+        db.session.query(DocumentAssignment, User)
+        .join(User, User.id == DocumentAssignment.user_id)
+        .filter(DocumentAssignment.document_id == document.id)
+        .order_by(User.username)
+        .all()
+    )
+    return render_template(
+        'pages/admin_document_detail.html',
+        document=document,
+        versions=versions,
+        assignments=assignments,
+        kinds=DOCUMENT_KINDS,
+    )

app/routes/evaluations.py

@@ -3,33 +3,33 @@
 Uses polymorphic isinstance checks instead of role-string comparisons.
 """
 
+import math
+
 from flask import Blueprint, flash, redirect, render_template, request, url_for
 from flask_babel import gettext as _
 from flask_login import current_user, login_required
 from marshmallow import ValidationError
-from flask import Blueprint, render_template, redirect, url_for, flash, request
-from flask_login import login_required, current_user
-from app.extensions import db
-from app.models import (
-    Admin, Coach, Manager, Player,
-    User, Tryout, Evaluation, TryoutRegistration,
-    OrgTeam, GAME_POSITIONS, EVALUATION_CRITERIA,
-)
-from sqlalchemy import func
+from sqlalchemy import false, func, select
 from sqlalchemy.orm import aliased
 
 from app.extensions import db
 from app.forms import flash_validation_errors, form_payload
 from app.models import (
+    EVALUATION_CRITERIA,
     GAME_POSITIONS,
     Admin,
+    Coach,
     Evaluation,
+    Manager,
     Player,
+    Scout,
     Tryout,
     TryoutRegistration,
     User,
 )
-from app.pagination import paginate
+from app.pagination import DEFAULT_PER_PAGE, MAX_PER_PAGE
+from app.responders import respond_after_change
+from app.time_utils import utc_now_naive
 from app.validators import EvaluationSchema
 
 evaluations_bp = Blueprint('evaluations', __name__, url_prefix='/evaluations')
@@ -43,95 +43,286 @@ def _users_by_id(user_ids):
     return {user.id: user for user in User.query.filter(User.id.in_(wanted)).all()}
 
 
+def validate_score(score_value):
+    """Turn a raw form value into a criterion score (1..10), or None.
+
+    A blank value means "not assessed". Anything else outside 1..10 is a
+    validation error, matching the single-player form's ``EvaluationSchema``
+    -- a coach must not be able to quietly turn 11 or 0 into "no score"
+    (QUA-003).
+    """
+    if score_value is None or str(score_value).strip() == '':
+        return None
+    try:
+        score = int(score_value)
+    except (TypeError, ValueError) as exc:
+        raise ValidationError('A score must be a whole number from 1 to 10.') from exc
+    if not 1 <= score <= 10:
+        raise ValidationError('Scores run from 1 to 10.')
+    return score
+
+
+def _apply_evaluation(evaluation, scores, comments, position):
+    """Write validated scores, comments and position onto an Evaluation."""
+    evaluation.apply_scores(scores)
+    evaluation.comments = comments
+    evaluation.position_recommendation = position
+
+
+def _visible_evaluations_query(user):
+    """Evaluations the acting user is allowed to see, as a query.
+
+    Admins and scouts see everything. Managers and coaches see the
+    evaluations authored by managers and coaches inside the tryouts they
+    manage; players never reach the evaluation pages.
+    """
+    if isinstance(user, (Admin, Scout)):
+        return Evaluation.query
+    tryout_ids = [t.id for t in user.get_visible_tryouts()]
+    if not tryout_ids:
+        return Evaluation.query.filter(false())
+    evaluator_alias = aliased(User, name='visible_evaluator')
+    return (
+        Evaluation.query
+        .join(evaluator_alias, Evaluation.evaluator_id == evaluator_alias.id)
+        .filter(evaluator_alias.role.in_(['manager', 'coach']))
+        .filter(Evaluation.tryout_id.in_(tryout_ids))
+    )
+
+
+def _visible_evaluation_ids(user):
+    """A ``select`` of the ids of evaluations the acting user may see."""
+    ids = _visible_evaluations_query(user).with_entities(Evaluation.id).subquery()
+    return select(ids.c.id)
+
+
+def _average(values):
+    """Mean of the non-None values, rounded to one decimal (or None)."""
+    values = [value for value in values if value is not None]
+    if not values:
+        return None
+    return round(sum(values) / len(values), 1)
+
+
+def _aggregate(evaluations):
+    """Per-criterion averages plus a combined overall average."""
+    criterion_averages = [
+        (label, _average([getattr(e, field) for e in evaluations]))
+        for field, label in EVALUATION_CRITERIA
+    ]
+    return {
+        'criterion_averages': criterion_averages,
+        'combined_average': _average([e.overall_score for e in evaluations]),
+        'count': len(evaluations),
+    }
+
+
+def _evaluation_view(evaluation, evaluator, tryout):
+    """Shape an Evaluation for the templates (scores in criterion order)."""
+    return {
+        'evaluation': evaluation,
+        'evaluator': evaluator,
+        'tryout': tryout,
+        'scores': [getattr(evaluation, field) for field, _ in EVALUATION_CRITERIA],
+        'overall': evaluation.overall_score,
+        'position': evaluation.position_recommendation,
+        'comment': evaluation.comments,
+        'date': evaluation.created_at,
+    }
+
+
+def _players_by_average(user):
+    """Players with visible evaluations, best combined average first."""
+    visible_ids = _visible_evaluation_ids(user)
+    rows = (
+        db.session.query(
+            Evaluation.player_id,
+            func.avg(Evaluation.overall_score).label('avg_score'),
+        )
+        .filter(Evaluation.id.in_(visible_ids))
+        .group_by(Evaluation.player_id)
+        .all()
+    )
+    players_by_id = _users_by_id(row.player_id for row in rows)
+    ordered = [
+        (players_by_id[row.player_id], row.avg_score)
+        for row in rows
+        if row.player_id in players_by_id and isinstance(players_by_id[row.player_id], Player)
+    ]
+    ordered.sort(
+        key=lambda pair: (
+            pair[1] is None,
+            -(pair[1] if pair[1] is not None else 0),
+            pair[0].username.lower(),
+        )
+    )
+    return ordered
+
+
 @evaluations_bp.route('')
 @login_required
 def list_evaluations():
-    """List all evaluations accessible to the current user."""
+    """List player evaluations grouped by player, with a per-player view."""
     user = current_user
 
     if isinstance(user, Player):
         flash(_('You do not have permission to view evaluations.'), 'danger')
         return redirect(url_for('main.dashboard'))
 
-    sort_column = request.args.get('sort', 'created_at')
+    sort_column = request.args.get('sort', 'overall_score')
     sort_order = request.args.get('order', 'desc')
     if sort_order not in ('asc', 'desc'):
         sort_order = 'desc'
 
-    player_alias = aliased(User, name='eval_player')
-    evaluator_alias = aliased(User, name='eval_evaluator')
+    visible_ids = _visible_evaluation_ids(user)
 
-    sort_map = {
-        'tryout': Tryout.title,
-        'player': player_alias.username,
-        'evaluator': evaluator_alias.username,
-        'mecanics_score': Evaluation.mecanics_score,
-        'cohesion_score': Evaluation.cohesion_score,
-        'communication_score': Evaluation.communication_score,
-        'gamesense_score': Evaluation.gamesense_score,
-        'versatility_score': Evaluation.versatility_score,
-        'discipline_score': Evaluation.discipline_score,
-        'analysis_score': Evaluation.analysis_score,
-        'sport_ethics_score': Evaluation.sport_ethics_score,
-        'mental_score': Evaluation.mental_score,
-        'overall_score': Evaluation.overall_score,
-        'position_recommendation': Evaluation.position_recommendation,
-        'created_at': Evaluation.created_at,
-    }
-
-    sort_expr = sort_map.get(sort_column, Evaluation.created_at)
-    if sort_order == 'asc':
-        sort_expr = sort_expr.asc()
-    else:
-        sort_expr = sort_expr.desc()
-
-    if isinstance(user, Admin):
-        evaluations_page = paginate(
-            Evaluation.query.outerjoin(Tryout, Evaluation.tryout_id == Tryout.id)
-            .outerjoin(player_alias, Evaluation.player_id == player_alias.id)
-            .outerjoin(evaluator_alias, Evaluation.evaluator_id == evaluator_alias.id)
-            .order_by(sort_expr, Evaluation.id)
+    aggregate = (
+        db.session.query(
+            Evaluation.player_id,
+            func.count(Evaluation.id).label('eval_count'),
+            func.avg(Evaluation.overall_score).label('avg_score'),
+            func.max(Evaluation.created_at).label('last_eval'),
         )
-        avg_scores = (
-            db.session.query(
-                Evaluation.player_id,
-                func.count(Evaluation.id).label('eval_count'),
-                func.avg(Evaluation.overall_score).label('avg_score'),
-            )
-            .group_by(Evaluation.player_id)
+        .filter(Evaluation.id.in_(visible_ids))
+        .group_by(Evaluation.player_id)
+        .all()
+    )
+
+    players_by_id = _users_by_id(row.player_id for row in aggregate)
+    grouped = []
+    for row in aggregate:
+        player = players_by_id.get(row.player_id)
+        if not player or not isinstance(player, Player):
+            continue
+        grouped.append(
+            {
+                'player': player,
+                'avg': round(row.avg_score, 1) if row.avg_score is not None else None,
+                'count': row.eval_count,
+                'last_eval': row.last_eval,
+                'evaluations': [],
+            }
+        )
+
+    def sort_value(entry):
+        if sort_column == 'player':
+            return entry['player'].username.lower()
+        if sort_column == 'count':
+            return entry['count']
+        if sort_column == 'created_at':
+            return entry['last_eval'] or utc_now_naive()
+        return entry['avg'] if entry['avg'] is not None else float('-inf')
+
+    grouped.sort(key=sort_value, reverse=(sort_order == 'desc'))
+
+    page = request.args.get('page', 1, type=int) or 1
+    page = max(1, page)
+    per_page = request.args.get('per_page', DEFAULT_PER_PAGE, type=int) or DEFAULT_PER_PAGE
+    per_page = max(1, min(per_page, MAX_PER_PAGE))
+
+    total = len(grouped)
+    pages = math.ceil(total / per_page) if total else 1
+    page = min(page, pages)
+    start = (page - 1) * per_page
+    page_items = grouped[start:start + per_page]
+
+    players_on_page = {entry['player'].id: entry for entry in page_items}
+    if players_on_page:
+        evaluations = (
+            Evaluation.query
+            .filter(Evaluation.player_id.in_(players_on_page))
+            .filter(Evaluation.id.in_(visible_ids))
+            .order_by(Evaluation.created_at.desc(), Evaluation.id.desc())
             .all()
         )
-        players_by_id = _users_by_id(row.player_id for row in avg_scores)
-        player_scores = {}
-        for row in avg_scores:
-            p = players_by_id.get(row.player_id)
-            if p:
-                player_scores[p.id] = {
-                    'player': p,
-                    'count': row.eval_count,
-                    'avg': round(row.avg_score, 1) if row.avg_score else 0,
-                }
-    else:
-        # Everyone still here evaluates: players were redirected above, and
-        # can_evaluate() is true for the four remaining roles. The former
-        # `else` branch listed evaluations *received* — a player's view,
-        # unreachable from this point (ARCH-007).
-        evaluations_page = paginate(
-            Evaluation.query.outerjoin(Tryout, Evaluation.tryout_id == Tryout.id)
-            .outerjoin(player_alias, Evaluation.player_id == player_alias.id)
-            .outerjoin(evaluator_alias, Evaluation.evaluator_id == evaluator_alias.id)
-            .filter(Evaluation.evaluator_id == user.id)
-            .order_by(sort_expr, Evaluation.id)
+        evaluators_by_id = _users_by_id(e.evaluator_id for e in evaluations)
+        tryout_ids = [e.tryout_id for e in evaluations if e.tryout_id]
+        tryouts_by_id = (
+            {t.id: t for t in Tryout.query.filter(Tryout.id.in_(tryout_ids)).all()}
+            if tryout_ids
+            else {}
         )
-        player_scores = {}
+        for evaluation in evaluations:
+            players_on_page[evaluation.player_id]['evaluations'].append(
+                _evaluation_view(
+                    evaluation,
+                    evaluators_by_id.get(evaluation.evaluator_id),
+                    tryouts_by_id.get(evaluation.tryout_id),
+                )
+            )
+
+    pagination = {
+        'page': page,
+        'pages': pages,
+        'total': total,
+        'has_prev': page > 1,
+        'has_next': page < pages,
+        'prev_num': page - 1,
+        'next_num': page + 1,
+    }
 
     return render_template(
         'pages/evaluations.html',
-        evaluations=evaluations_page.items,
-        pagination=evaluations_page,
-        player_scores=player_scores,
+        players=page_items,
+        pagination=pagination,
         sort_column=sort_column,
         sort_order=sort_order,
+        evaluation_criteria=EVALUATION_CRITERIA,
+        first_player_id=grouped[0]['player'].id if grouped else None,
+    )
+
+
+@evaluations_bp.route('/player/<int:player_id>')
+@login_required
+def player_evaluations(player_id):
+    """One player's evaluations, with prev/next navigation between players."""
+    user = current_user
+    if not user.can_evaluate():
+        flash(_('You do not have permission to view evaluations.'), 'danger')
+        return redirect(url_for('main.dashboard'))
+
+    player = db.get_or_404(User, player_id)
+    if not isinstance(player, Player):
+        flash(_('Can only view evaluations for players.'), 'danger')
+        return redirect(url_for('evaluations.list_evaluations'))
+
+    ordered = _players_by_average(user)
+    index = next((i for i, (p, _avg) in enumerate(ordered) if p.id == player.id), None)
+    prev_player = ordered[index - 1][0] if index is not None and index > 0 else None
+    next_player = ordered[index + 1][0] if index is not None and index + 1 < len(ordered) else None
+
+    visible_ids = _visible_evaluation_ids(user)
+    evaluations = (
+        Evaluation.query
+        .filter(Evaluation.player_id == player.id)
+        .filter(Evaluation.id.in_(visible_ids))
+        .order_by(Evaluation.created_at.desc(), Evaluation.id.desc())
+        .all()
+    )
+    evaluators_by_id = _users_by_id(e.evaluator_id for e in evaluations)
+    tryout_ids = [e.tryout_id for e in evaluations if e.tryout_id]
+    tryouts_by_id = (
+        {t.id: t for t in Tryout.query.filter(Tryout.id.in_(tryout_ids)).all()}
+        if tryout_ids
+        else {}
+    )
+    evaluation_views = [
+        _evaluation_view(e, evaluators_by_id.get(e.evaluator_id), tryouts_by_id.get(e.tryout_id))
+        for e in evaluations
+    ]
+
+    aggregates = _aggregate(evaluations)
+
+    return render_template(
+        'pages/player_evaluations.html',
+        player=player,
+        evaluations=evaluation_views,
+        prev_player=prev_player,
+        next_player=next_player,
+        criterion_averages=aggregates['criterion_averages'],
+        combined_average=aggregates['combined_average'],
+        evaluation_count=aggregates['count'],
+        evaluation_criteria=EVALUATION_CRITERIA,
     )
 
 
@@ -157,12 +348,12 @@ def evaluate_player(tryout_id, player_id):
     )
     if not is_registered:
         flash(_('Player is not registered for this tryout.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     player = db.get_or_404(User, player_id)
     if not isinstance(player, Player):
         flash(_('Can only evaluate players.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     existing_eval = Evaluation.query.filter_by(
         tryout_id=tryout_id,
@@ -216,7 +407,7 @@ def evaluate_player(tryout_id, player_id):
         evaluation.position_recommendation = data['position_recommendation']
 
         db.session.commit()
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     return render_evaluation_form()
 
@@ -291,23 +482,31 @@ def batch_evaluate(tryout_id):
         player = User.query.get(pid)
         if not player or not isinstance(player, Player):
             continue
-        is_registered = TryoutRegistration.query.filter_by(
-            tryout_id=tryout_id, player_id=pid,
-        ).first() is not None
+        is_registered = (
+            TryoutRegistration.query.filter_by(
+                tryout_id=tryout_id,
+                player_id=pid,
+            ).first()
+            is not None
+        )
         if not is_registered:
             continue
         existing = Evaluation.query.filter_by(
-            tryout_id=tryout_id, player_id=pid, evaluator_id=current_user.id,
+            tryout_id=tryout_id,
+            player_id=pid,
+            evaluator_id=current_user.id,
         ).first()
         existing_scores = {
             field_name: getattr(existing, field_name) if existing else None
             for field_name, _ in EVALUATION_CRITERIA
         }
-        players.append({
-            'player': player,
-            'existing': existing,
-            'existing_scores': existing_scores,
-        })
+        players.append(
+            {
+                'player': player,
+                'existing': existing,
+                'existing_scores': existing_scores,
+            }
+        )
 
     if not players:
         flash('No valid players selected for evaluation.', 'danger')
@@ -315,32 +514,47 @@ def batch_evaluate(tryout_id):
 
     if request.method == 'POST':
         saved = 0
-        for entry in players:
-            pid = entry['player'].id
-            scores = {
-                field_name: validate_score(request.form.get(f'{field_name}_{pid}'))
-                for field_name, _ in EVALUATION_CRITERIA
-            }
-            comments = request.form.get(f'comments_{pid}')
-            position = request.form.get(f'position_recommendation_{pid}')
+        try:
+            for entry in players:
+                pid = entry['player'].id
+                scores = {
+                    field_name: validate_score(request.form.get(f'{field_name}_{pid}'))
+                    for field_name, _ in EVALUATION_CRITERIA
+                }
+                comments = request.form.get(f'comments_{pid}')
+                position = request.form.get(f'position_recommendation_{pid}')
 
-            existing = entry['existing']
-            if existing:
-                _apply_evaluation(existing, scores, comments, position)
-            else:
-                evaluation = Evaluation(
-                    tryout_id=tryout_id, player_id=pid,
-                    evaluator_id=current_user.id,
-                )
-                _apply_evaluation(evaluation, scores, comments, position)
-                db.session.add(evaluation)
-            saved += 1
+                existing = entry['existing']
+                if existing:
+                    _apply_evaluation(existing, scores, comments, position)
+                else:
+                    evaluation = Evaluation(
+                        tryout_id=tryout_id,
+                        player_id=pid,
+                        evaluator_id=current_user.id,
+                    )
+                    _apply_evaluation(evaluation, scores, comments, position)
+                    db.session.add(evaluation)
+                saved += 1
+        except ValidationError:
+            db.session.rollback()
+            flash(_('Scores must be whole numbers from 1 to 10.'), 'danger')
+            return render_template(
+                'pages/batch_evaluate.html',
+                tryout=tryout,
+                players=players,
+                evaluation_criteria=EVALUATION_CRITERIA,
+                game_positions=GAME_POSITIONS,
+            )
 
         db.session.commit()
         flash(f'Saved evaluations for {saved} player(s).', 'success')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
-    return render_template('pages/batch_evaluate.html',
-                           tryout=tryout, players=players,
-                           evaluation_criteria=EVALUATION_CRITERIA,
-                           game_positions=GAME_POSITIONS)
+    return render_template(
+        'pages/batch_evaluate.html',
+        tryout=tryout,
+        players=players,
+        evaluation_criteria=EVALUATION_CRITERIA,
+        game_positions=GAME_POSITIONS,
+    )

app/routes/matches.py

@@ -5,7 +5,7 @@ Uses polymorphic isinstance checks instead of role-string comparisons.
 
 from datetime import datetime, timedelta
 
-from flask import Blueprint, flash, jsonify, redirect, render_template, request, url_for
+from flask import Blueprint, flash, jsonify, render_template, request, url_for
 from flask_babel import gettext as _
 from flask_login import current_user, login_required
 from marshmallow import ValidationError
@@ -26,11 +26,14 @@ from app.models import (
     PlayerDisponibility,
     Scout,
     Team,
+    TeamMatch,
     TeamMember,
     Tryout,
     TryoutRegistration,
     User,
 )
+from app.permissions import visible_org_teams
+from app.responders import respond_after_change
 from app.services.scheduling import notify_participants, zip_participants
 from app.validators import MatchEditSchema, MatchSchema
 
@@ -74,6 +77,25 @@ def default_end_time(date, start_time):
     return (datetime.combine(date, start_time) + timedelta(minutes=DEFAULT_MATCH_MINUTES)).time()
 
 
+def calendar_event_time_fields(date, start_time, end_time):
+    """FullCalendar date/time fields for a match.
+
+    A date-only event renders in the all-day row; a ``start``/``end`` with a
+    time places it on the clock for the same calendar day. Matches, team
+    matches and one-on-one sessions are stored as a date plus optional time
+    columns, so the feed translates that into the shape FullCalendar expects.
+    """
+    if not start_time:
+        return {'date': date.strftime('%Y-%m-%d'), 'allDay': True}
+    fields = {
+        'start': f'{date.isoformat()}T{start_time.strftime("%H:%M:%S")}',
+        'allDay': False,
+    }
+    if end_time:
+        fields['end'] = f'{date.isoformat()}T{end_time.strftime("%H:%M:%S")}'
+    return fields
+
+
 def create_participants(match, data):
     """Attach participants to a match, per its type.
 
@@ -165,13 +187,17 @@ def api_events():
     president — and then issue one MatchParticipant query per match to find
     out whether the viewer was in it. The calendar's cost grew with the
     whole history, on every navigation.
+
+    Tryout matches, regular-season team matches and approved one-on-one
+    sessions share this feed. Timed rows carry `start`/`end` so
+    FullCalendar places them on the clock instead of the all-day row.
     """
     events = []
     tryouts = get_visible_tryouts_for_user()
+    window_start, window_end = calendar_window(request.args)
     tryouts_by_id = {tryout.id: tryout for tryout in tryouts}
 
     if tryouts_by_id:
-        window_start, window_end = calendar_window(request.args)
         query = Match.query.filter(Match.tryout_id.in_(tryouts_by_id))
         if window_start:
             query = query.filter(Match.date >= window_start)
@@ -198,7 +224,6 @@ def api_events():
 
         for match in matches:
             tryout = tryouts_by_id[match.tryout_id]
-            match_color = '#10b981' if match.match_type == 'team_vs_team' else '#f59e0b'
             # 'description' used to be participants_str + '<br>' + description.
             # Building presentation markup inside a JSON field is what carried
             # the stored XSS: the browser dropped it straight into innerHTML,
@@ -225,30 +250,69 @@ def api_events():
 
             user_participant = mine_by_match.get(match.id)
 
-            events.append(
-                {
-                    'id': f'match_{match.id}',
-                    'title': match.title,
-                    'date': match.date.strftime('%Y-%m-%d'),
-                    'type': 'match',
-                    'color': match_color,
-                    'extendedProps': {
-                        'location': match.location or tryout.location or 'TBD',
-                        'status': match.status,
-                        'description': match.description or '',
-                        'match_type': match.match_type,
-                        'tryout_id': tryout.id,
-                        'match_id': match.id,
-                        'start_time': start_time_str,
-                        'end_time': end_time_str,
-                        'participants': participants_str,
-                        'user_participant_id': user_participant.id if user_participant else None,
-                        'user_attendance_confirmed': user_participant.attendance_confirmed
-                        if user_participant
-                        else False,
-                    },
-                }
-            )
+            event = {
+                'id': f'match_{match.id}',
+                'title': match.title,
+                'type': 'match',
+                'extendedProps': {
+                    'location': match.location or tryout.location or 'TBD',
+                    'status': match.status,
+                    'description': match.description or '',
+                    'match_type': match.match_type,
+                    'tryout_id': tryout.id,
+                    'match_id': match.id,
+                    'start_time': start_time_str,
+                    'end_time': end_time_str,
+                    'participants': participants_str,
+                    'user_participant_id': user_participant.id if user_participant else None,
+                    'user_attendance_confirmed': user_participant.attendance_confirmed
+                    if user_participant
+                    else False,
+                },
+            }
+            event.update(calendar_event_time_fields(match.date, match.start_time, match.end_time))
+            events.append(event)
+
+    # Regular-season team matches: a separate table from tryout matches, but
+    # the same calendar. Visible to the roles that can see the org team.
+    if isinstance(current_user, (Admin, Manager)):
+        team_query = TeamMatch.query
+    elif isinstance(current_user, (Coach, Player)):
+        team_ids = [team.id for team in visible_org_teams(current_user)]
+        team_query = (
+            TeamMatch.query.filter(TeamMatch.org_team_id.in_(team_ids))
+            if team_ids
+            else TeamMatch.query.filter(TeamMatch.id == -1)
+        )
+    else:
+        team_query = TeamMatch.query.filter(TeamMatch.id == -1)
+
+    if window_start:
+        team_query = team_query.filter(TeamMatch.date >= window_start)
+    if window_end:
+        team_query = team_query.filter(TeamMatch.date <= window_end)
+
+    for team_match in team_query.options(joinedload(TeamMatch.org_team)).all():
+        start_time_str = team_match.start_time.strftime('%H:%M') if team_match.start_time else None
+        end_time_str = team_match.end_time.strftime('%H:%M') if team_match.end_time else None
+        event = {
+            'id': f'team_match_{team_match.id}',
+            'title': team_match.title,
+            'type': 'team_match',
+            'extendedProps': {
+                'location': team_match.location or 'TBD',
+                'status': team_match.status,
+                'description': team_match.description or '',
+                'org_team': team_match.org_team.name if team_match.org_team else '',
+                'opponent': team_match.opponent or '',
+                'start_time': start_time_str,
+                'end_time': end_time_str,
+            },
+        }
+        event.update(
+            calendar_event_time_fields(team_match.date, team_match.start_time, team_match.end_time)
+        )
+        events.append(event)
 
     # Add approved One on One sessions for the current user (player or coach)
     if isinstance(current_user, Player):
@@ -263,23 +327,21 @@ def api_events():
         one_on_ones = []
 
     for ooo in one_on_ones:
-        events.append(
-            {
-                'id': f'one_on_one_{ooo.id}',
-                'title': f'1:1 - {ooo.player.full_name} & {ooo.coach.full_name}',
-                'date': ooo.date.strftime('%Y-%m-%d'),
-                'type': 'one_on_one',
-                'color': '#8b5cf6',
-                'extendedProps': {
-                    'location': 'Discord / Voice Chat',
-                    'status': 'approved',
-                    'description': ooo.points or 'One on One session',
-                    'start_time': ooo.start_time.strftime('%H:%M') if ooo.start_time else None,
-                    'end_time': ooo.end_time.strftime('%H:%M') if ooo.end_time else None,
-                    'participants': f"{ooo.player.full_name} with {ooo.coach.full_name}",
-                },
-            }
-        )
+        event = {
+            'id': f'one_on_one_{ooo.id}',
+            'title': f'1:1 - {ooo.player.full_name} & {ooo.coach.full_name}',
+            'type': 'one_on_one',
+            'extendedProps': {
+                'location': 'Discord / Voice Chat',
+                'status': 'approved',
+                'description': ooo.points or 'One on One session',
+                'start_time': ooo.start_time.strftime('%H:%M') if ooo.start_time else None,
+                'end_time': ooo.end_time.strftime('%H:%M') if ooo.end_time else None,
+                'participants': f"{ooo.player.full_name} with {ooo.coach.full_name}",
+            },
+        }
+        event.update(calendar_event_time_fields(ooo.date, ooo.start_time, ooo.end_time))
+        events.append(event)
 
     return jsonify(events)
 
@@ -351,25 +413,24 @@ def api_events_for_tryout(tryout_id):
         start_time_str = match.start_time.strftime('%H:%M') if match.start_time else None
         end_time_str = match.end_time.strftime('%H:%M') if match.end_time else None
 
-        events.append(
-            {
-                'id': f'match_{match.id}',
-                'title': match.title,
-                'date': match.date.strftime('%Y-%m-%d'),
-                'type': 'match',
-                'color': match_color,
-                'extendedProps': {
-                    'location': match.location or tryout.location or 'TBD',
-                    'status': match.status,
-                    'match_type': match.match_type,
-                    'tryout_id': tryout.id,
-                    'match_id': match.id,
-                    'participants': participants_str,
-                    'start_time': start_time_str,
-                    'end_time': end_time_str,
-                },
-            }
-        )
+        event = {
+            'id': f'match_{match.id}',
+            'title': match.title,
+            'type': 'match',
+            'color': match_color,
+            'extendedProps': {
+                'location': match.location or tryout.location or 'TBD',
+                'status': match.status,
+                'match_type': match.match_type,
+                'tryout_id': tryout.id,
+                'match_id': match.id,
+                'participants': participants_str,
+                'start_time': start_time_str,
+                'end_time': end_time_str,
+            },
+        }
+        event.update(calendar_event_time_fields(match.date, match.start_time, match.end_time))
+        events.append(event)
 
     return jsonify(events)
 
@@ -381,11 +442,11 @@ def create_match(tryout_id):
     tryout = db.get_or_404(Tryout, tryout_id)
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('You do not have permission to schedule matches for this tryout.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     if tryout.is_ended:
         flash(_('This tryout has ended. Matches can no longer be created or modified.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     teams = Team.query.filter_by(tryout_id=tryout_id).all()
     all_players = registered_players(tryout_id)
@@ -443,7 +504,7 @@ def create_match(tryout_id):
         )
 
         flash(_('Match scheduled successfully!'), 'success')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     return rerender()
 
@@ -457,11 +518,11 @@ def edit_match(match_id):
 
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('You do not have permission to edit this match.'), 'danger')
-        return redirect(url_for('matches.calendar'))
+        return respond_after_change(url_for('matches.calendar'))
 
     if tryout.is_ended:
         flash(_('This tryout has ended. Matches can no longer be created or modified.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout.id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout.id))
 
     teams = Team.query.filter_by(tryout_id=tryout.id).all()
     all_players = registered_players(tryout.id)
@@ -505,6 +566,12 @@ def edit_match(match_id):
             flash_validation_errors(err)
             return rerender()
 
+        # Snapshot the date/time before we overwrite them, so we can detect
+        # whether only these fields changed and choose the right Discord message.
+        old_date = match.date
+        old_start = match.start_time
+        old_end = match.end_time
+
         # Assigned only once the whole form has been accepted. Assigning as
         # each field was read meant a form rejected halfway had already
         # changed the record in the session.
@@ -516,41 +583,106 @@ def edit_match(match_id):
         match.location = data['location']
         match.status = data['status']
 
+        time_changed = (
+            match.date != old_date or match.start_time != old_start or match.end_time != old_end
+        )
+
+        # Build the desired participant set and reconcile it against the
+        # existing participants, rather than deleting and recreating everyone.
+        # This preserves attendance_confirmed for players who stay.
+        desired = set()
+        if match.match_type == 'team_vs_team':
+            match.team1_id = data['team1_id']
+            match.team2_id = data['team2_id']
+            for team_id in (data['team1_id'], data['team2_id']):
+                if team_id:
+                    for member in TeamMember.query.filter_by(team_id=team_id).all():
+                        desired.add(member.player_id)
+        elif match.match_type == 'player_vs_player':
+            for pid in data['team1_player_ids']:
+                desired.add(pid)
+            for pid in data['team2_player_ids']:
+                desired.add(pid)
+        else:
+            for pid in data['player_ids']:
+                desired.add(pid)
+
+        existing = {
+            p.player_id: p for p in MatchParticipant.query.filter_by(match_id=match.id).all()
+        }
+
+        removed_ids = []
         notified_player_ids = []
         notified_participant_ids = []
+        kept_ids = set()
 
-        if match.match_type == 'team_vs_team':
-            teams_changed = data['team1_id'] != match.team1_id or data['team2_id'] != match.team2_id
-            if teams_changed:
-                MatchParticipant.query.filter_by(match_id=match.id).delete()
-                match.team1_id = data['team1_id']
-                match.team2_id = data['team2_id']
-                notified_player_ids, notified_participant_ids = create_participants(match, data)
+        for player_id, participant in list(existing.items()):
+            if player_id in desired:
+                kept_ids.add(player_id)
+                notified_player_ids.append(player_id)
+                notified_participant_ids.append(participant.id)
             else:
-                # Same teams: the roster stands, but everyone is told again,
-                # because the date or the time may have moved.
-                for team_id in (match.team1_id, match.team2_id):
-                    if team_id:
-                        notified_player_ids.extend(
-                            m.player_id for m in TeamMember.query.filter_by(team_id=team_id).all()
-                        )
-        else:
-            MatchParticipant.query.filter_by(match_id=match.id).delete()
-            notified_player_ids, notified_participant_ids = create_participants(match, data)
+                removed_ids.append(participant.id)
+                db.session.delete(participant)
+
+        # New players get new participant rows.
+        for player_id in desired - set(existing.keys()):
+            participant = MatchParticipant(match_id=match.id, player_id=player_id)
+            db.session.add(participant)
+            db.session.flush()
+            notified_player_ids.append(player_id)
+            notified_participant_ids.append(participant.id)
+            kept_ids.add(player_id)
+
+        # When the date or time changed, reset attendance on everyone who
+        # stayed. They'll be asked to re-confirm via the modified message.
+        if time_changed:
+            for participant in MatchParticipant.query.filter_by(match_id=match.id).all():
+                if participant.player_id in kept_ids:
+                    participant.attendance_confirmed = False
 
         db.session.commit()
 
-        notify_participants(
-            title=match.title,
-            date=match.date,
-            start_time=match.start_time,
-            end_time=match.end_time,
-            participants=zip_participants(notified_player_ids, notified_participant_ids),
-            fallback_id=match.id,
-        )
+        # Purge Discord pending entries for participants that no longer exist.
+        if removed_ids:
+            from app.discord_bot import purge_pending_for_participants
+
+            purge_pending_for_participants(removed_ids)
+
+        # Decide whether and what to notify.
+        if time_changed:
+            # All current participants get the "modified" message.
+            all_current = list(zip(notified_player_ids, notified_participant_ids))
+            notify_participants(
+                title=match.title,
+                date=match.date,
+                start_time=match.start_time,
+                end_time=match.end_time,
+                participants=all_current,
+                fallback_id=match.id,
+                change_kind='modified',
+            )
+        elif desired - set(existing.keys()):
+            # Only the newly added players are told about the match.
+            new_player_ids = desired - set(existing.keys())
+            new_pairs = [
+                (pid, nid)
+                for pid, nid in zip(notified_player_ids, notified_participant_ids)
+                if pid in new_player_ids
+            ]
+            notify_participants(
+                title=match.title,
+                date=match.date,
+                start_time=match.start_time,
+                end_time=match.end_time,
+                participants=new_pairs,
+                fallback_id=match.id,
+                change_kind='scheduled',
+            )
+        # else: nothing changed that needs a notification.
 
         flash(_('Match updated successfully!'), 'success')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout.id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout.id))
 
     return rerender()
 
@@ -586,10 +718,10 @@ def delete_match(match_id):
     tryout = match.tryout
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('You do not have permission to delete this match.'), 'danger')
-        return redirect(url_for('matches.calendar'))
+        return respond_after_change(url_for('matches.calendar'))
     if tryout.is_ended:
         flash(_('This tryout has ended. Matches can no longer be deleted.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout.id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout.id))
 
     # Notes outlive the match they were taken during: a coach's observation
     # keeps its value, and deleting it here would destroy unrelated content.
@@ -602,7 +734,7 @@ def delete_match(match_id):
     db.session.delete(match)
     db.session.commit()
     flash(_('Match deleted successfully.'), 'success')
-    return redirect(url_for('tryouts.view_tryout', tryout_id=tryout.id))
+    return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout.id))
 
 
 def get_players_available_at_time(date_str, time_str):

app/routes/team_matches.py

@@ -3,7 +3,7 @@
 Uses polymorphic isinstance checks instead of role-string comparisons.
 """
 
-from flask import Blueprint, flash, jsonify, redirect, render_template, request, url_for
+from flask import Blueprint, flash, jsonify, render_template, request, url_for
 from flask_babel import gettext as _
 from flask_login import current_user, login_required
 from marshmallow import ValidationError
@@ -13,6 +13,7 @@ from app.extensions import db
 from app.forms import flash_validation_errors, form_payload
 from app.models import (
     Admin,
+    AppSettings,
     Coach,
     Manager,
     OrgTeam,
@@ -23,6 +24,7 @@ from app.models import (
 )
 from app.pagination import paginate
 from app.permissions import can_manage_org_team, coach_org_teams, visible_org_teams
+from app.responders import respond_after_change
 from app.routes.matches import default_end_time
 from app.services.scheduling import notify_participants, zip_participants
 from app.time_utils import utc_now_naive
@@ -40,6 +42,17 @@ def can_manage_team_match(team):
     return can_manage_org_team(current_user, team)
 
 
+def season_locked():
+    """Return True when the regular season is inactive for non-admins.
+
+    Admins bypass the lock. Coaches and managers may only schedule regular
+    season matches while the season is active.
+    """
+    if isinstance(current_user, Admin):
+        return False
+    return not AppSettings.get_bool('season_active', default=False)
+
+
 @team_matches_bp.route('')
 @login_required
 def list_matches():
@@ -108,9 +121,15 @@ def list_matches():
 def create_match(team_id):
     """Create a new regular-season team match."""
     team = db.get_or_404(OrgTeam, team_id)
+    if season_locked():
+        flash(
+            'The regular season is not active. Begin a season before scheduling matches.', 'warning'
+        )
+        return respond_after_change(url_for('team_matches.list_matches'))
+
     if not can_manage_team_match(team):
         flash(_('You do not have permission to schedule matches for this team.'), 'danger')
-        return redirect(url_for('team_matches.list_matches'))
+        return respond_after_change(url_for('team_matches.list_matches'))
 
     team_players = TeamPlayer.query.filter_by(org_team_id=team_id).all()
     prefill_date = request.args.get('date', '')
@@ -203,7 +222,7 @@ def create_match(team_id):
         flash(
             _('Team match "%(title)s" scheduled successfully!', title=team_match.title), 'success'
         )
-        return redirect(url_for('team_matches.list_matches'))
+        return respond_after_change(url_for('team_matches.list_matches'))
 
     return render_template('pages/team_match_form.html', team=team, team_players=team_players)
 
@@ -217,7 +236,7 @@ def edit_match(match_id):
 
     if not can_manage_team_match(team):
         flash(_('You do not have permission to edit this match.'), 'danger')
-        return redirect(url_for('team_matches.list_matches'))
+        return respond_after_change(url_for('team_matches.list_matches'))
 
     if request.method == 'POST':
         # The three date and time fields used to be checked one at a time,
@@ -247,7 +266,7 @@ def edit_match(match_id):
 
         db.session.commit()
         flash(_('Match updated successfully!'), 'success')
-        return redirect(url_for('team_matches.list_matches'))
+        return respond_after_change(url_for('team_matches.list_matches'))
 
     return render_template(
         'pages/team_match_form.html', match=team_match, team=team, team_players=[]
@@ -260,13 +279,20 @@ def delete_match(match_id):
     """Delete a team match."""
     team_match = db.get_or_404(TeamMatch, match_id)
     team = team_match.org_team
+    if season_locked():
+        flash(
+            'The regular season is not active. Begin a season before deleting matches.', 'warning'
+        )
+        return respond_after_change(url_for('team_matches.list_matches'))
+
     if not can_manage_team_match(team):
         flash(_('You do not have permission to delete this match.'), 'danger')
-        return redirect(url_for('team_matches.list_matches'))
+        return respond_after_change(url_for('team_matches.list_matches'))
+
     db.session.delete(team_match)
     db.session.commit()
     flash(_('Match deleted successfully.'), 'success')
-    return redirect(url_for('team_matches.list_matches'))
+    return respond_after_change(url_for('team_matches.list_matches'))
 
 
 @team_matches_bp.route('/api/manageable-teams')

app/routes/teams.py

@@ -27,6 +27,8 @@ from app.models import (
     User,
 )
 from app.permissions import visible_org_teams
+from app.responders import respond_after_change
+from app.services.documents import backfill_assignments_for_user
 from app.time_utils import utc_now_naive
 from app.validators import NoteContentSchema, OrgTeamSchema, TeamPlayerSchema, TeamStaffSchema
 
@@ -76,7 +78,7 @@ def my_teams():
     """View the player's own teams with upcoming matches."""
     if not isinstance(current_user, Player):
         flash(_('This page is for players.'), 'info')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     from app.models import TeamMatch, TeamMatchParticipant
 
@@ -183,18 +185,18 @@ def create_team():
     """Create a new organization team."""
     if not current_user.can_manage_teams():
         flash(_('You do not have permission to create teams.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     try:
         data = OrgTeamSchema().load(form_payload(list_fields=('coach_ids', 'manager_ids')))
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     name = data['name']
     if OrgTeam.query.filter_by(name=name).first():
         flash(_('Team "%(name)s" already exists.', name=name), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     coach = _staff_member(data['coach_id'], Coach)
     manager = _staff_member(data['manager_id'], Manager)
@@ -214,8 +216,11 @@ def create_team():
         team.managers.append(manager)
 
     db.session.commit()
+    for staff_user in (coach, manager):
+        if staff_user:
+            backfill_assignments_for_user(staff_user)
     flash(_('Team "%(name)s" created successfully!', name=name), 'success')
-    return redirect(url_for('teams.list_teams'))
+    return respond_after_change(url_for('teams.list_teams'))
 
 
 @teams_bp.route('/<int:team_id>/edit', methods=['POST'])
@@ -225,18 +230,18 @@ def edit_team(team_id):
     team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('You do not have permission to edit this team.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     try:
         data = OrgTeamSchema().load(form_payload(list_fields=('coach_ids', 'manager_ids')))
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     name = data['name']
     if OrgTeam.query.filter(OrgTeam.name == name, OrgTeam.id != team_id).first():
         flash(_('Team "%(name)s" already exists.', name=name), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     team.name = name
 
@@ -268,8 +273,10 @@ def edit_team(team_id):
             team.managers.append(manager)
 
     db.session.commit()
+    for staff_user in team.get_coaches() + team.get_managers():
+        backfill_assignments_for_user(staff_user)
     flash(_('Team "%(name)s" updated successfully!', name=name), 'success')
-    return redirect(url_for('teams.list_teams'))
+    return respond_after_change(url_for('teams.list_teams'))
 
 
 @teams_bp.route('/<int:team_id>/delete', methods=['POST'])
@@ -297,7 +304,7 @@ def delete_team(team_id):
 
     if not (current_user.can_manage_teams() and current_user.can_manage_this_org_team(team)):
         flash(_('You do not have permission to delete teams.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     name = team.name
 
@@ -328,7 +335,7 @@ def delete_team(team_id):
     db.session.delete(team)
     db.session.commit()
     flash(_('Team "%(name)s" deleted successfully.', name=name), 'success')
-    return redirect(url_for('teams.list_teams'))
+    return respond_after_change(url_for('teams.list_teams'))
 
 
 @teams_bp.route('/<int:team_id>/add_coach', methods=['POST'])
@@ -338,19 +345,19 @@ def add_coach(team_id):
     team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('Permission denied.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     data = _posted(TeamStaffSchema())
     if data is None:
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
     if not data['coach_id']:
         flash(_('Please select a coach.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     coach = db.session.get(User, data['coach_id'])
     if not coach or not _assignable(coach, Coach):
         flash(_('Only coaches can be assigned as coach.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     if team.coaches.filter_by(id=coach.id).first():
         flash(
@@ -361,17 +368,18 @@ def add_coach(team_id):
             ),
             'info',
         )
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     team.coaches.append(coach)
     if not team.coach_id:
         team.coach_id = coach.id
     db.session.commit()
+    backfill_assignments_for_user(coach)
     flash(
         _('%(username)s added as coach of %(name)s.', username=coach.username, name=team.name),
         'success',
     )
-    return redirect(url_for('teams.list_teams'))
+    return respond_after_change(url_for('teams.list_teams'))
 
 
 @teams_bp.route('/<int:team_id>/add_manager', methods=['POST'])
@@ -381,19 +389,19 @@ def add_manager(team_id):
     team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('Permission denied.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     data = _posted(TeamStaffSchema())
     if data is None:
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
     if not data['manager_id']:
         flash(_('Please select a manager.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     manager = db.session.get(User, data['manager_id'])
     if not manager or not _assignable(manager, Manager):
         flash(_('Only managers can be assigned as manager.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     if team.managers.filter_by(id=manager.id).first():
         flash(
@@ -404,17 +412,18 @@ def add_manager(team_id):
             ),
             'info',
         )
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     team.managers.append(manager)
     if not team.manager_id:
         team.manager_id = manager.id
     db.session.commit()
+    backfill_assignments_for_user(manager)
     flash(
         _('%(username)s added as manager of %(name)s.', username=manager.username, name=team.name),
         'success',
     )
-    return redirect(url_for('teams.list_teams'))
+    return respond_after_change(url_for('teams.list_teams'))
 
 
 @teams_bp.route('/<int:team_id>/remove_coach', methods=['POST'])
@@ -424,11 +433,11 @@ def remove_coach(team_id):
     team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('Permission denied.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     data = _posted(TeamStaffSchema())
     if data is None:
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     if data['coach_id']:
         coach = db.session.get(User, data['coach_id'])
@@ -442,7 +451,7 @@ def remove_coach(team_id):
 
     db.session.commit()
     flash(_('Coach removed from %(name)s.', name=team.name), 'success')
-    return redirect(url_for('teams.list_teams'))
+    return respond_after_change(url_for('teams.list_teams'))
 
 
 @teams_bp.route('/<int:team_id>/remove_manager', methods=['POST'])
@@ -452,11 +461,11 @@ def remove_manager(team_id):
     team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('Permission denied.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     data = _posted(TeamStaffSchema())
     if data is None:
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     if data['manager_id']:
         manager = db.session.get(User, data['manager_id'])
@@ -470,7 +479,7 @@ def remove_manager(team_id):
 
     db.session.commit()
     flash(_('Manager removed from %(name)s.', name=team.name), 'success')
-    return redirect(url_for('teams.list_teams'))
+    return respond_after_change(url_for('teams.list_teams'))
 
 
 @teams_bp.route('/<int:team_id>/add_player', methods=['POST'])
@@ -480,20 +489,20 @@ def add_player(team_id):
     team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('Permission denied.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     data = _posted(TeamPlayerSchema())
     if data is None:
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
     if not data['player_id']:
         flash(_('Please select a player.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     status = data['status']
     player = db.session.get(User, data['player_id'])
     if not player or not _assignable(player, Player):
         flash(_('Can only assign players to teams.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     existing = TeamPlayer.query.filter_by(player_id=player.id, org_team_id=team.id).first()
     if existing:
@@ -501,13 +510,14 @@ def add_player(team_id):
             _('%(username)s is already on %(name)s.', username=player.username, name=team.name),
             'info',
         )
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     tp = TeamPlayer(player_id=player.id, org_team_id=team.id, status=status)
     db.session.add(tp)
     db.session.commit()
+    backfill_assignments_for_user(player)
     flash(_('%(username)s added to %(name)s!', username=player.username, name=team.name), 'success')
-    return redirect(url_for('teams.list_teams'))
+    return respond_after_change(url_for('teams.list_teams'))
 
 
 @teams_bp.route('/<int:team_id>/remove_player/<int:player_id>', methods=['POST'])
@@ -517,7 +527,7 @@ def remove_player(team_id, player_id):
     team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('Permission denied.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     player = db.get_or_404(User, player_id)
     tp = TeamPlayer.query.filter_by(player_id=player_id, org_team_id=team_id).first()
@@ -526,7 +536,7 @@ def remove_player(team_id, player_id):
             _('%(username)s is not on %(name)s.', username=player.username, name=team.name),
             'danger',
         )
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     db.session.delete(tp)
     db.session.commit()
@@ -534,7 +544,7 @@ def remove_player(team_id, player_id):
         _('%(username)s removed from %(name)s.', username=player.username, name=team.name),
         'success',
     )
-    return redirect(url_for('teams.list_teams'))
+    return respond_after_change(url_for('teams.list_teams'))
 
 
 @teams_bp.route('/<int:team_id>/toggle_status/<int:player_id>', methods=['POST'])
@@ -569,19 +579,19 @@ def add_team_note(team_id):
     team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('You do not have permission to add notes to this team.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     try:
         data = NoteContentSchema().load(form_payload(list_fields=()))
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     note = TeamNote(org_team_id=team_id, coach_id=current_user.id, content=data['content'])
     db.session.add(note)
     db.session.commit()
     flash(_('Team notes added successfully!'), 'success')
-    return redirect(url_for('teams.list_teams'))
+    return respond_after_change(url_for('teams.list_teams'))
 
 
 @teams_bp.route('/<int:team_id>/add-player-note/<int:player_id>', methods=['POST'])
@@ -591,12 +601,12 @@ def add_player_note(team_id, player_id):
     team = db.get_or_404(OrgTeam, team_id)
     if not current_user.can_manage_this_org_team(team):
         flash(_('You do not have permission to add notes to this team.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     player = db.get_or_404(User, player_id)
     if not isinstance(player, Player):
         flash(_('Can only add notes for players.'), 'danger')
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     tp = TeamPlayer.query.filter_by(player_id=player_id, org_team_id=team_id).first()
     if not tp:
@@ -604,16 +614,16 @@ def add_player_note(team_id, player_id):
             _('%(username)s is not on %(name)s.', username=player.username, name=team.name),
             'danger',
         )
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     try:
         data = NoteContentSchema().load(form_payload(list_fields=()))
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('teams.list_teams'))
+        return respond_after_change(url_for('teams.list_teams'))
 
     note = PersonalNote(player_id=player_id, coach_id=current_user.id, content=data['content'])
     db.session.add(note)
     db.session.commit()
     flash(_('Note added for %(username)s!', username=player.username), 'success')
-    return redirect(url_for('teams.list_teams'))
+    return respond_after_change(url_for('teams.list_teams'))

app/routes/tryouts.py

@@ -16,6 +16,7 @@ from app.models import (
     ESPORT_GAMES,
     GAME_POSITIONS,
     Admin,
+    AppSettings,
     Coach,
     Evaluation,
     Manager,
@@ -31,12 +32,14 @@ from app.models import (
     TryoutRegistration,
     User,
 )
+from app.responders import respond_after_change
 from app.time_utils import utc_now_naive
 from app.validators import (
     PlayerSelectionSchema,
     TryoutRegistrationStatusSchema,
     TryoutSchema,
     TryoutStatusSchema,
+    TryoutTeamMemberPositionSchema,
     TryoutTeamMemberSchema,
     TryoutTeamSchema,
 )
@@ -49,6 +52,17 @@ def can_manage():
     return isinstance(current_user, (Admin, Manager))
 
 
+def tryouts_locked():
+    """Return True when tryouts are globally closed to coaches/managers.
+
+    Admins are always allowed to bypass the lock. Coaches and managers can
+    only make changes when the global tryout switch is open.
+    """
+    if isinstance(current_user, Admin):
+        return False
+    return not AppSettings.get_bool('tryouts_open', default=True)
+
+
 def tryout_form_payload():
     """The tryout form, shaped for marshmallow (ARCH-005)."""
     return form_payload(list_fields=('coach_ids', 'manager_ids'), optional_blank=())
@@ -127,6 +141,13 @@ def list_tryouts():
 @login_required
 def create_tryout():
     """Create a new tryout event. Requires Admin or Manager."""
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return redirect(url_for('tryouts.list_tryouts'))
+
     if not can_manage():
         flash(_('You do not have permission to create tryouts.'), 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
@@ -187,6 +208,13 @@ def edit_tryout(tryout_id):
     """Edit an existing tryout event. Permission based on can_manage_this_tryout."""
     tryout = db.get_or_404(Tryout, tryout_id)
 
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout.id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('You do not have permission to edit this tryout.'), 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
@@ -231,7 +259,7 @@ def edit_tryout(tryout_id):
 
         # Only update staff lists when the form explicitly sends them.
         # An absent checkbox group (all unchecked or JS failed) means
-        # \"don't change\", not \"remove everyone\".
+        # "don't change", not "remove everyone".
         if 'coach_ids' in request.form:
             tryout.coaches = coaches_from_ids(data['coach_ids'])
         if 'manager_ids' in request.form:
@@ -253,9 +281,7 @@ def view_tryout(tryout_id):
     can_view = False
     if isinstance(current_user, Admin):
         can_view = True
-    elif isinstance(current_user, Manager):
-        can_view = current_user.can_manage_this_tryout(tryout)
-    elif isinstance(current_user, Coach):
+    elif isinstance(current_user, (Manager, Coach)):
         can_view = current_user.can_manage_this_tryout(tryout)
     elif isinstance(current_user, Player):
         is_registered = (
@@ -321,7 +347,12 @@ def view_tryout(tryout_id):
         member_players = _users_by_id([m.player_id for m in member_rows if m.player_id])
         for row in member_rows:
             members_by_team.setdefault(row.team_id, []).append(
-                {'player': member_players.get(row.player_id), 'position': row.position}
+                {
+                    'player': member_players.get(row.player_id),
+                    'position': row.position,
+                    'member_id': row.id,
+                    'player_id': row.player_id,
+                }
             )
     team_data = [{'team': team, 'members': members_by_team.get(team.id, [])} for team in teams]
 
@@ -447,31 +478,31 @@ def register_for_tryout(tryout_id):
     """Register a player for a tryout. Only Players can self-register."""
     if not isinstance(current_user, Player):
         flash(_('Only players can register for tryouts.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
     tryout = locked_tryout_or_404(tryout_id)
 
     if tryout.status not in ['upcoming', 'in_progress']:
         flash(_('This tryout is not accepting registrations.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     existing = TryoutRegistration.query.filter_by(
         tryout_id=tryout_id, player_id=current_user.id
     ).first()
     if existing:
         flash(_('You are already registered for this tryout.'), 'info')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     if tryout.max_players:
         count = TryoutRegistration.query.filter_by(tryout_id=tryout_id).count()
         if count >= tryout.max_players:
             flash(_('This tryout is full.'), 'danger')
-            return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+            return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     registration = TryoutRegistration(tryout_id=tryout_id, player_id=current_user.id)
     db.session.add(registration)
     db.session.commit()
     flash(_('Successfully registered for tryout!'), 'success')
-    return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+    return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
 
 @tryouts_bp.route('/<int:tryout_id>/status', methods=['POST'])
@@ -479,6 +510,13 @@ def register_for_tryout(tryout_id):
 def update_status(tryout_id):
     """Update the status of a tryout."""
     tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
@@ -486,12 +524,12 @@ def update_status(tryout_id):
         data = TryoutStatusSchema().load(form_payload(list_fields=()))
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     tryout.status = data['status']
     db.session.commit()
     flash(_('Tryout status updated to %(new_status)s.', new_status=data['status']), 'success')
-    return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+    return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
 
 @tryouts_bp.route('/<int:tryout_id>/registration/<int:player_id>/status', methods=['POST'])
@@ -499,6 +537,13 @@ def update_status(tryout_id):
 def update_registration_status(tryout_id, player_id):
     """Update a registration's attendance status."""
     tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
@@ -510,12 +555,12 @@ def update_registration_status(tryout_id, player_id):
         data = TryoutRegistrationStatusSchema().load(form_payload(list_fields=()))
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     registration.status = data['status']
     db.session.commit()
     flash(_('Registration status updated.'), 'success')
-    return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+    return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
 
 @tryouts_bp.route('/<int:tryout_id>/register_player', methods=['POST'])
@@ -523,18 +568,25 @@ def update_registration_status(tryout_id, player_id):
 def register_player(tryout_id):
     """Manually register a player for a tryout (by managers/coaches)."""
     tryout = locked_tryout_or_404(tryout_id)
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('Permission denied.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
     try:
         data = PlayerSelectionSchema().load(form_payload())
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     if not data['player_id']:
         flash(_('Please select a player.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     # Same two checks as the team roster (SEC-16): the right role, and an
     # account that has not been deactivated. The select this comes from now
@@ -542,7 +594,7 @@ def register_player(tryout_id):
     player = db.session.get(User, data['player_id'])
     if not player or not isinstance(player, Player) or not player.is_active_account:
         flash(_('Can only register players.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     existing = TryoutRegistration.query.filter_by(tryout_id=tryout_id, player_id=player.id).first()
     if existing:
@@ -550,19 +602,19 @@ def register_player(tryout_id):
             _('%(username)s is already registered for this tryout.', username=player.username),
             'info',
         )
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     if tryout.max_players:
         count = TryoutRegistration.query.filter_by(tryout_id=tryout_id).count()
         if count >= tryout.max_players:
             flash(_('This tryout is full.'), 'danger')
-            return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+            return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     registration = TryoutRegistration(tryout_id=tryout_id, player_id=player.id)
     db.session.add(registration)
     db.session.commit()
     flash(_('%(username)s registered for tryout!', username=player.username), 'success')
-    return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+    return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
 
 @tryouts_bp.route('/<int:tryout_id>/remove_player/<int:player_id>', methods=['POST'])
@@ -570,6 +622,13 @@ def register_player(tryout_id):
 def remove_player(tryout_id, player_id):
     """Remove a registered player from a tryout (cascades to teams/matches)."""
     tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('Permission denied.'), 'danger')
         return redirect(url_for('tryouts.list_tryouts'))
@@ -598,7 +657,7 @@ def remove_player(tryout_id, player_id):
 
     db.session.commit()
     flash(_('%(username)s removed from tryout.', username=player.username), 'success')
-    return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+    return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
 
 @tryouts_bp.route('/<int:tryout_id>/team/create', methods=['POST'])
@@ -606,21 +665,28 @@ def remove_player(tryout_id, player_id):
 def create_team(tryout_id):
     """Create a tryout-specific team."""
     tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('Permission denied.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     try:
         data = TryoutTeamSchema().load(form_payload(list_fields=()))
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     team = Team(tryout_id=tryout_id, name=data['team_name'], created_by=current_user.id)
     db.session.add(team)
     db.session.commit()
     flash(_('Team "%(team_name)s" created!', team_name=data['team_name']), 'success')
-    return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+    return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
 
 @tryouts_bp.route('/<int:tryout_id>/team/<int:team_id>/add', methods=['POST'])
@@ -629,9 +695,16 @@ def add_to_team(tryout_id, team_id):
     """Add a player to a tryout team."""
     team = db.get_or_404(Team, team_id)
     tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('Permission denied.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     # The two ids arrive independently in the URL. Without this check, being
     # allowed to manage tryout A was enough to modify a team belonging to
@@ -643,7 +716,7 @@ def add_to_team(tryout_id, team_id):
         data = TryoutTeamMemberSchema().load(form_payload(list_fields=()))
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
     player_id = data['player_id']
 
     # Only players registered for this tryout may be placed on its teams.
@@ -653,7 +726,7 @@ def add_to_team(tryout_id, team_id):
     )
     if not is_registered:
         flash(_('That player is not registered for this tryout.'), 'danger')
-        return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
     existing = TeamMember.query.filter_by(team_id=team_id, player_id=player_id).first()
     if existing:
@@ -663,7 +736,153 @@ def add_to_team(tryout_id, team_id):
         db.session.add(member)
         db.session.commit()
         flash(_('Player added to team!'), 'success')
-    return redirect(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+    return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+
+@tryouts_bp.route('/<int:tryout_id>/team/<int:team_id>/edit', methods=['POST'])
+@login_required
+def edit_team(tryout_id, team_id):
+    """Rename a tryout-specific team."""
+    team = db.get_or_404(Team, team_id)
+    tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+    if not current_user.can_manage_this_tryout(tryout):
+        flash(_('Permission denied.'), 'danger')
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+    if team.tryout_id != tryout_id:
+        abort(404)
+
+    try:
+        data = TryoutTeamSchema().load(form_payload(list_fields=()))
+    except ValidationError as err:
+        flash_validation_errors(err)
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+    team.name = data['team_name']
+    db.session.commit()
+    flash(_('Team renamed to "%(team_name)s".', team_name=data['team_name']), 'success')
+    return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+
+@tryouts_bp.route('/<int:tryout_id>/team/<int:team_id>/delete', methods=['POST'])
+@login_required
+def delete_team(tryout_id, team_id):
+    """Delete a tryout-specific team and its memberships."""
+    team = db.get_or_404(Team, team_id)
+    tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+    if not current_user.can_manage_this_tryout(tryout):
+        flash(_('Permission denied.'), 'danger')
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+    if team.tryout_id != tryout_id:
+        abort(404)
+
+    name = team.name
+
+    # Personal note references outlive the team.
+    PersonalNote.query.filter_by(team_id=team_id).update(
+        {'team_id': None}, synchronize_session=False
+    )
+
+    # Matches referencing this team: null the FK so the match survives.
+    Match.query.filter_by(team1_id=team_id).update({'team1_id': None}, synchronize_session=False)
+    Match.query.filter_by(team2_id=team_id).update({'team2_id': None}, synchronize_session=False)
+
+    # Clean participants for those matches (they are no longer in that team).
+    for match in Match.query.filter(
+        db.or_(Match.team1_id == team_id, Match.team2_id == team_id)
+    ).all():
+        MatchParticipant.query.filter_by(match_id=match.id).delete(synchronize_session=False)
+
+    TeamMember.query.filter_by(team_id=team_id).delete(synchronize_session=False)
+    db.session.delete(team)
+    db.session.commit()
+    flash(_('Team "%(name)s" deleted.', name=name), 'success')
+    return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+
+@tryouts_bp.route('/<int:tryout_id>/team/<int:team_id>/remove/<int:player_id>', methods=['POST'])
+@login_required
+def remove_from_team(tryout_id, team_id, player_id):
+    """Remove a player from a tryout team."""
+    team = db.get_or_404(Team, team_id)
+    tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+    if not current_user.can_manage_this_tryout(tryout):
+        flash(_('Permission denied.'), 'danger')
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+    if team.tryout_id != tryout_id:
+        abort(404)
+
+    TeamMember.query.filter_by(team_id=team_id, player_id=player_id).delete(
+        synchronize_session=False
+    )
+    # Also remove the player from any match participants that were tied to this team.
+    match_ids = [m.id for m in Match.query.filter_by(tryout_id=tryout_id).all()]
+    if match_ids:
+        MatchParticipant.query.filter(
+            MatchParticipant.match_id.in_(match_ids),
+            MatchParticipant.player_id == player_id,
+        ).delete(synchronize_session=False)
+    db.session.commit()
+    flash(_('Player removed from team.'), 'success')
+    return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+
+@tryouts_bp.route(
+    '/<int:tryout_id>/team/<int:team_id>/member/<int:member_id>/position', methods=['POST']
+)
+@login_required
+def update_member_position(tryout_id, team_id, member_id):
+    """Set or clear a team member's in-game position (role)."""
+    team = db.get_or_404(Team, team_id)
+    tryout = db.get_or_404(Tryout, tryout_id)
+    member = db.get_or_404(TeamMember, member_id)
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+    if not current_user.can_manage_this_tryout(tryout):
+        flash(_('Permission denied.'), 'danger')
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+    if team.tryout_id != tryout_id or member.team_id != team_id:
+        abort(404)
+
+    try:
+        data = TryoutTeamMemberPositionSchema().load(form_payload(list_fields=()))
+    except ValidationError as err:
+        flash_validation_errors(err)
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
+    member.position = data['position'] or None
+    db.session.commit()
+    flash(_('Position updated.'), 'success')
+    return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
 
 
 @tryouts_bp.route('/<int:tryout_id>/delete', methods=['POST'])
@@ -671,6 +890,13 @@ def add_to_team(tryout_id, team_id):
 def delete_tryout(tryout_id):
     """Delete a tryout and all associated data (matches, teams, registrations, evaluations)."""
     tryout = db.get_or_404(Tryout, tryout_id)
+    if tryouts_locked():
+        flash(
+            'Tryouts are currently closed. An admin must open tryouts before changes can be made.',
+            'danger',
+        )
+        return respond_after_change(url_for('tryouts.view_tryout', tryout_id=tryout_id))
+
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('You do not have permission to delete this tryout.'), 'danger')
         return redirect(url_for('tryouts.list_tryouts'))

app/routes/users/__init__.py

@@ -15,6 +15,7 @@ from app.routes.users import (
     accounts,  # noqa: F401,E402
     availability,  # noqa: F401,E402
     contracts,  # noqa: F401,E402
+    documents,  # noqa: F401,E402
     notes,  # noqa: F401,E402
     one_on_one,  # noqa: F401,E402
     profile,  # noqa: F401,E402

app/routes/users/_shared.py

@@ -39,6 +39,10 @@ def pdf_upload_error(file, allowed_extensions):
     could put an arbitrary file on the server under a name the application
     later hands back for download (SEC-021).
 
+    The check now goes beyond the header: it parses the upload with pypdf
+    and requires at least one parseable page, so a file with ``%PDF-``
+    prepended or a renamed non-PDF is rejected.
+
     Args:
         file: The uploaded FileStorage, or None.
         allowed_extensions: Extensions to accept, lowercase and without dot.
@@ -53,11 +57,27 @@ def pdf_upload_error(file, allowed_extensions):
     if not (stem and dot) or extension.lower() not in allowed_extensions:
         return _('Only PDF files are allowed for contracts.')
 
+    # Fast-fail: the PDF signature must appear at the start of the stream.
     head = file.stream.read(len(PDF_SIGNATURE))
     file.stream.seek(0)
     if head != PDF_SIGNATURE:
         return _('That file is not a PDF, whatever its name says.')
 
+    # Full-content validation: parse with pypdf and require at least one
+    # page.  A file with a forged header but no real PDF structure (e.g. a
+    # renamed executable with ``%PDF-`` prepended) will fail here.
+    try:
+        from pypdf import PdfReader
+        from pypdf.errors import PyPdfError
+
+        reader = PdfReader(file.stream, strict=False)
+        if len(reader.pages) == 0:
+            return _('That file is not a PDF, whatever its name says.')
+    except (PyPdfError, ValueError, TypeError):
+        return _('That file is not a PDF, whatever its name says.')
+    finally:
+        file.stream.seek(0)
+
     return None
 
 

app/routes/users/accounts.py

@@ -44,6 +44,7 @@ from app.routes.users._shared import (
 )
 from app.routes.users.blueprint import users_bp
 from app.storage import discard_documents
+from app.timeslots import total_hours
 from app.validators import CreateUserSchema, EditUserSchema
 
 
@@ -59,7 +60,39 @@ def list_users():
     # query without a stable ORDER BY can show the same row twice and never
     # show another (MNT-14).
     page = paginate(User.query.order_by(User.role, User.username, User.id))
-    return render_template('pages/users.html', users=page.items, pagination=page, roles=USER_TYPES)
+
+    # Build a per-user hours map for the current page with two bounded
+    # queries (one per availability table), avoiding an N+1 per row.
+    user_ids = [u.id for u in page.items]
+    hours_by_user: dict[int, float] = {}
+
+    for slots, fk in [
+        (
+            PlayerDisponibility.query.filter(
+                PlayerDisponibility.player_id.in_(user_ids),
+            ).all(),
+            'player_id',
+        ),
+        (
+            CoachAvailability.query.filter(
+                CoachAvailability.coach_id.in_(user_ids),
+            ).all(),
+            'coach_id',
+        ),
+    ]:
+        buckets: dict[int, list] = {}
+        for slot in slots:
+            buckets.setdefault(getattr(slot, fk), []).append(slot)
+        for uid, group in buckets.items():
+            hours_by_user[uid] = total_hours(group)
+
+    return render_template(
+        'pages/users.html',
+        users=page.items,
+        pagination=page,
+        roles=USER_TYPES,
+        hours=hours_by_user,
+    )
 
 
 @users_bp.route('/<int:user_id>/edit', methods=['GET', 'POST'])
@@ -380,4 +413,19 @@ def create_user():
 def view_user(user_id):
     """View a public profile for any user."""
     user = db.get_or_404(User, user_id)
-    return render_template('pages/view_user.html', profile_user=user)
+
+    # Load availability for players and coaches so the public profile
+    # can render a read-only weekly grid.
+    availability = None
+    if user.role == 'player':
+        availability = user.disponibilities
+    elif user.role == 'coach':
+        availability = user.coach_availabilities
+    availability_hours = total_hours(availability) if availability else None
+
+    return render_template(
+        'pages/view_user.html',
+        profile_user=user,
+        availability=availability,
+        availability_hours=availability_hours,
+    )

app/routes/users/availability.py

@@ -5,8 +5,7 @@ weekly availability blocks, and a coach's bookable slots for one-on-one
 sessions.
 """
 
-from flask import flash, jsonify, redirect, render_template, request, url_for
-from flask_babel import gettext as _
+from flask import jsonify, request
 from flask_login import current_user, login_required
 from marshmallow import ValidationError
 
@@ -201,60 +200,50 @@ def delete_disponibility(disponibility_id):
     return jsonify({'success': True})
 
 
-@users_bp.route('/coach-availability', methods=['GET', 'POST'])
+@users_bp.route('/coach-availability', methods=['POST'])
 @json_endpoint
 @login_required
 def manage_coach_availability():
     """Manage coach availability for One on One sessions."""
     if not isinstance(current_user, Coach):
-        flash(_('Only coaches can manage availability.'), 'danger')
-        return redirect(url_for('main.dashboard'))
+        return jsonify({'error': 'Unauthorized'}), 403
 
-    if request.method == 'POST':
-        data = request.get_json(silent=True) or {}
-        accepted, rejected = _load_slots(data.get('slots'))
+    data = request.get_json(silent=True) or {}
+    accepted, rejected = _load_slots(data.get('slots'))
 
-        # Validate everything before deleting anything.
-        #
-        # This route replaces the coach's availability: it deleted every
-        # existing slot and then re-added the ones it could parse, skipping
-        # the rest in silence and answering `{'success': true}`. A payload
-        # the browser mangled therefore wiped a coach's bookable hours and
-        # reported success — and one-on-one requests are refused against
-        # exactly this table, so the coach became unbookable with nothing to
-        # show for it. Refusing the whole batch is the only safe answer when
-        # the operation is a replacement (MNT-12).
-        if rejected:
-            return jsonify(
-                {
-                    'error': 'Invalid slots; nothing was changed.',
-                    'rejected': rejected,
-                }
-            ), 400
+    # Validate everything before deleting anything.
+    #
+    # This route replaces the coach's availability: it deleted every
+    # existing slot and then re-added the ones it could parse, skipping
+    # the rest in silence and answering `{'success': true}`. A payload
+    # the browser mangled therefore wiped a coach's bookable hours and
+    # reported success — and one-on-one requests are refused against
+    # exactly this table, so the coach became unbookable with nothing to
+    # show for it. Refusing the whole batch is the only safe answer when
+    # the operation is a replacement (MNT-12).
+    if rejected:
+        return jsonify(
+            {
+                'error': 'Invalid slots; nothing was changed.',
+                'rejected': rejected,
+            }
+        ), 400
 
-        CoachAvailability.query.filter_by(coach_id=current_user.id).delete()
+    CoachAvailability.query.filter_by(coach_id=current_user.id).delete()
 
-        for slot in accepted:
-            start_time = slot['start_time']
-            db.session.add(
-                CoachAvailability(
-                    coach_id=current_user.id,
-                    day_of_week=slot['day_of_week'],
-                    start_time=start_time,
-                    end_time=slot_end(start_time),
-                )
+    for slot in accepted:
+        start_time = slot['start_time']
+        db.session.add(
+            CoachAvailability(
+                coach_id=current_user.id,
+                day_of_week=slot['day_of_week'],
+                start_time=start_time,
+                end_time=slot_end(start_time),
             )
+        )
 
-        db.session.commit()
-        return jsonify({'success': True, 'saved': len(accepted)})
-
-    existing_availability = CoachAvailability.query.filter_by(
-        coach_id=current_user.id,
-    ).all()
-
-    return render_template(
-        'pages/coach_availability.html', existing_availability=existing_availability
-    )
+    db.session.commit()
+    return jsonify({'success': True, 'saved': len(accepted)})
 
 
 @users_bp.route('/coach-availability/clear', methods=['POST'])

app/routes/users/contracts.py

@@ -10,7 +10,9 @@ from marshmallow import ValidationError
 from werkzeug.utils import secure_filename
 
 from app.extensions import db
+from app.responders import respond_after_change
 from app.models import Admin, Coach, Contract, Manager, Player, User
+from app.models.admin_settings import AppSettings
 from app.permissions import can_manage_player_contract, coach_player_ids
 from app.routes.users._shared import (
     ALLOWED_CONTRACT_EXTENSIONS,
@@ -18,7 +20,13 @@ from app.routes.users._shared import (
     pdf_upload_error,
 )
 from app.routes.users.blueprint import users_bp
-from app.storage import CONTRACTS_DIR, document_path
+from app.storage import (
+    CONTRACTS_DIR,
+    GoogleDriveStorageError,
+    is_google_drive_path,
+    open_document,
+    store_uploaded_document,
+)
 from app.time_utils import utc_now_naive
 from app.validators import UploadContractSchema
 
@@ -43,6 +51,17 @@ def manageable_players():
     return User.query.filter_by(role='player', is_active_account=True).order_by(User.username).all()
 
 
+def document_uploads_locked():
+    """Return True when document uploads are globally disabled.
+
+    Admins are always allowed to bypass the lock. Managers, coaches, and
+    players are blocked when the toggle is off.
+    """
+    if isinstance(current_user, Admin):
+        return False
+    return not AppSettings.get_bool('document_uploads_enabled', default=True)
+
+
 @users_bp.route('/contracts')
 @login_required
 def list_contracts():
@@ -84,7 +103,11 @@ def upload_contract():
     """Upload a contract for a player."""
     if not isinstance(current_user, (Admin, Manager, Coach)):
         flash(_('Only presidents, managers, and coaches can upload contracts.'), 'danger')
-        return redirect(url_for('users.list_contracts'))
+        return respond_after_change(url_for('users.list_contracts'))
+
+    if document_uploads_locked():
+        flash(_('Document uploads are currently disabled.'), 'danger')
+        return respond_after_change(url_for('users.list_contracts'))
 
     players = manageable_players()
 
@@ -103,13 +126,13 @@ def upload_contract():
 
         if not can_manage_player_contract(current_user, player_id):
             flash(_('You do not have permission to upload a contract for this player.'), 'danger')
-            return redirect(url_for('users.upload_contract'))
+            return respond_after_change(url_for('users.upload_contract'))
 
         file = request.files.get('contract_file')
         error = pdf_upload_error(file, ALLOWED_CONTRACT_EXTENSIONS)
         if error:
             flash(error, 'danger')
-            return redirect(url_for('users.upload_contract'))
+            return respond_after_change(url_for('users.upload_contract'))
 
         player = db.get_or_404(User, player_id)
         player_teams = player.get_org_teams()
@@ -126,9 +149,13 @@ def upload_contract():
         if team:
             relative_path = os.path.join(CONTRACTS_DIR, secure_filename(team.name), stored_filename)
 
-        absolute_path = document_path(relative_path)
-        os.makedirs(os.path.dirname(absolute_path), exist_ok=True)
-        file.save(absolute_path)
+        try:
+            stored_path = store_uploaded_document(file, relative_path)
+        except GoogleDriveStorageError:
+            flash(
+                _('Contract storage is temporarily unavailable. Please try again later.'), 'danger'
+            )
+            return respond_after_change(url_for('users.upload_contract'))
 
         contract = Contract(
             player_id=player_id,
@@ -136,7 +163,7 @@ def upload_contract():
             uploaded_by_id=current_user.id,
             original_filename=original_filename,
             stored_filename=stored_filename,
-            file_path=relative_path,
+            file_path=stored_path,
             notes=notes if notes else None,
         )
         db.session.add(contract)
@@ -145,7 +172,7 @@ def upload_contract():
             _('Contract uploaded successfully for %(username)s!', username=player.username),
             'success',
         )
-        return redirect(url_for('users.list_contracts'))
+        return respond_after_change(url_for('users.list_contracts'))
 
     return render_template('pages/upload_contract.html', players=players)
 
@@ -157,25 +184,40 @@ def upload_signed_contract(contract_id):
     contract = db.get_or_404(Contract, contract_id)
     if not contract.can_upload_signed(current_user):
         flash(_('Only the player can upload their signed contract.'), 'danger')
-        return redirect(url_for('users.list_contracts'))
+        return respond_after_change(url_for('users.list_contracts'))
+
+    if document_uploads_locked():
+        flash(_('Document uploads are currently disabled.'), 'danger')
+        return respond_after_change(url_for('users.list_contracts'))
 
     file = request.files.get('signed_file')
     error = pdf_upload_error(file, ALLOWED_SIGNED_EXTENSIONS)
     if error:
         flash(error, 'danger')
-        return redirect(url_for('users.list_contracts'))
+        return respond_after_change(url_for('users.list_contracts'))
 
     signed_filename = f"signed_{contract.stored_filename}"
-    signed_path = contract.file_path.replace(contract.stored_filename, signed_filename)
-    file.save(document_path(signed_path))
+    # Legacy local records keep their signed copy beside the original. Drive
+    # identifiers are opaque rather than filenames, so new Drive records use
+    # a fresh logical path and receive a second Drive ID.
+    signed_path = (
+        os.path.join(CONTRACTS_DIR, signed_filename)
+        if is_google_drive_path(contract.file_path)
+        else contract.file_path.replace(contract.stored_filename, signed_filename)
+    )
+    try:
+        stored_signed_path = store_uploaded_document(file, signed_path)
+    except GoogleDriveStorageError:
+        flash(_('Contract storage is temporarily unavailable. Please try again later.'), 'danger')
+        return respond_after_change(url_for('users.list_contracts'))
 
     contract.signed_filename = signed_filename
-    contract.signed_file_path = signed_path
+    contract.signed_file_path = stored_signed_path
     contract.status = 'signed'
     contract.signed_at = utc_now_naive()
     db.session.commit()
     flash(_('Signed contract uploaded successfully!'), 'success')
-    return redirect(url_for('users.list_contracts'))
+    return respond_after_change(url_for('users.list_contracts'))
 
 
 @users_bp.route('/contracts/<int:contract_id>/download')
@@ -185,12 +227,13 @@ def download_contract(contract_id):
     contract = db.get_or_404(Contract, contract_id)
     if not contract.can_view(current_user):
         flash(_('You do not have permission to download this contract.'), 'danger')
-        return redirect(url_for('users.list_contracts'))
-    return send_file(
-        document_path(contract.file_path),
-        as_attachment=True,
-        download_name=contract.original_filename,
-    )
+        return respond_after_change(url_for('users.list_contracts'))
+    try:
+        document = open_document(contract.file_path)
+    except GoogleDriveStorageError:
+        flash(_('Contract storage is temporarily unavailable. Please try again later.'), 'danger')
+        return respond_after_change(url_for('users.list_contracts'))
+    return send_file(document, as_attachment=True, download_name=contract.original_filename)
 
 
 @users_bp.route('/contracts/<int:contract_id>/download_signed')
@@ -200,12 +243,13 @@ def download_signed_contract(contract_id):
     contract = db.get_or_404(Contract, contract_id)
     if not contract.can_view(current_user):
         flash(_('You do not have permission to download this contract.'), 'danger')
-        return redirect(url_for('users.list_contracts'))
+        return respond_after_change(url_for('users.list_contracts'))
     if not contract.signed_file_path:
         flash(_('No signed contract available.'), 'danger')
-        return redirect(url_for('users.list_contracts'))
-    return send_file(
-        document_path(contract.signed_file_path),
-        as_attachment=True,
-        download_name=contract.signed_filename,
-    )
+        return respond_after_change(url_for('users.list_contracts'))
+    try:
+        document = open_document(contract.signed_file_path)
+    except GoogleDriveStorageError:
+        flash(_('Contract storage is temporarily unavailable. Please try again later.'), 'danger')
+        return respond_after_change(url_for('users.list_contracts'))
+    return send_file(document, as_attachment=True, download_name=contract.signed_filename)

app/routes/users/documents.py

@@ -0,0 +1,210 @@
+"""Member-facing document centre.
+
+Players, coaches and managers see the published documents they must sign
+or acknowledge, complete them, and download the file drawn from the single
+canonical copy in storage.  Coaches and managers additionally see progress
+for the members of the teams they are attached to.
+"""
+
+from flask import flash, redirect, render_template, request, send_file, url_for
+from flask_babel import gettext as _
+from flask_login import current_user, login_required
+
+from app.extensions import db
+from app.models import (
+    DOCUMENT_KIND_ROLES,
+    Admin,
+    Coach,
+    Document,
+    DocumentAssignment,
+    DocumentVersion,
+    Manager,
+)
+from app.permissions import visible_org_teams
+from app.responders import respond_after_change
+from app.routes.users._shared import ALLOWED_SIGNED_EXTENSIONS, pdf_upload_error
+from app.routes.users.blueprint import users_bp
+from app.services.documents import (
+    backfill_assignments_for_user,
+    primary_team_for_user,
+    user_eligible_for_kind,
+    user_has_any_team,
+)
+from app.storage import GoogleDriveStorageError, open_document, store_signed_document
+from app.time_utils import utc_now_naive
+
+
+def _team_members(team):
+    """Active players, coaches and managers of one team, de-duplicated."""
+    members = {}
+    for player in team.players:
+        if player.is_active_account:
+            members[player.id] = player
+    for staff in list(team.get_coaches()) + list(team.get_managers()):
+        if staff.is_active_account:
+            members[staff.id] = staff
+    return sorted(members.values(), key=lambda user: user.username.lower())
+
+
+@users_bp.route('/documents')
+@login_required
+def list_my_documents():
+    """The current member's obligations, plus team progress for staff."""
+    backfill_assignments_for_user(current_user)
+
+    if isinstance(current_user, Admin):
+        return redirect(url_for('admin.documents'))
+
+    if not user_has_any_team(current_user):
+        return render_template('pages/my_documents.html', documents=[], teams_progress=None)
+
+    published = (
+        Document.query.filter(Document.is_published.is_(True))
+        .order_by(Document.kind, Document.title)
+        .all()
+    )
+
+    documents = []
+    for doc in published:
+        if current_user.role not in DOCUMENT_KIND_ROLES.get(doc.kind, ()):
+            continue
+        assignment = DocumentAssignment.query.filter_by(
+            document_id=doc.id, user_id=current_user.id
+        ).first()
+        documents.append({'document': doc, 'assignment': assignment})
+
+    teams_progress = None
+    if isinstance(current_user, (Coach, Manager)):
+        teams_progress = []
+        for team in visible_org_teams(current_user):
+            rows = []
+            for member in _team_members(team):
+                statuses = {}
+                for doc in published:
+                    if member.role not in DOCUMENT_KIND_ROLES.get(doc.kind, ()):
+                        continue
+                    assignment = DocumentAssignment.query.filter_by(
+                        document_id=doc.id, user_id=member.id
+                    ).first()
+                    statuses[doc.id] = assignment.status if assignment else None
+                rows.append({'user': member, 'statuses': statuses})
+            teams_progress.append({'team': team, 'members': rows, 'documents': published})
+
+    return render_template(
+        'pages/my_documents.html',
+        documents=documents,
+        teams_progress=teams_progress,
+    )
+
+
+@users_bp.route('/documents/assignments/<int:assignment_id>/sign', methods=['POST'])
+@login_required
+def sign_document(assignment_id):
+    """Upload the signed copy of a pending signature document."""
+    assignment = db.get_or_404(DocumentAssignment, assignment_id)
+    if assignment.user_id != current_user.id:
+        flash(_('You do not have permission to sign this document.'), 'danger')
+        return respond_after_change(url_for('users.list_my_documents'))
+
+    if assignment.completed:
+        flash(_('This document has already been completed.'), 'danger')
+        return respond_after_change(url_for('users.list_my_documents'))
+    if not assignment.document.requires_signature:
+        flash(_('This document is acknowledged, not signed.'), 'danger')
+        return respond_after_change(url_for('users.list_my_documents'))
+    if not assignment.document.current_version:
+        flash(_('This document has no version published yet.'), 'danger')
+        return respond_after_change(url_for('users.list_my_documents'))
+
+    file = request.files.get('signed_file')
+    error = pdf_upload_error(file, ALLOWED_SIGNED_EXTENSIONS)
+    if error:
+        flash(error, 'danger')
+        return respond_after_change(url_for('users.list_my_documents'))
+
+    team = primary_team_for_user(current_user)
+    if team is None:
+        flash(_('You must be part of a team before signing documents.'), 'danger')
+        return respond_after_change(url_for('users.list_my_documents'))
+
+    version = assignment.document.current_version
+    # The kind prefix keeps separate documents from colliding: a player signs
+    # both the player contract and the team agreement, each at version 1.
+    signed_filename = f'{assignment.document.kind}-v{version.version}.pdf'
+    try:
+        stored_path = store_signed_document(
+            file,
+            team_name=team.name,
+            role=current_user.role,
+            username=current_user.username,
+            filename=signed_filename,
+        )
+    except GoogleDriveStorageError:
+        flash(
+            _('Document storage is temporarily unavailable. Please try again later.'),
+            'danger',
+        )
+        return respond_after_change(url_for('users.list_my_documents'))
+
+    assignment.status = 'signed'
+    assignment.signed_filename = signed_filename
+    assignment.signed_file_path = stored_path
+    assignment.completed_version_id = version.id
+    assignment.completed_at = utc_now_naive()
+    assignment.filed_team_id = team.id
+    db.session.commit()
+
+    flash(_('Document signed successfully!'), 'success')
+    return respond_after_change(url_for('users.list_my_documents'))
+
+
+@users_bp.route('/documents/assignments/<int:assignment_id>/acknowledge', methods=['POST'])
+@login_required
+def acknowledge_document(assignment_id):
+    """Mark a read-and-acknowledge document (code of conduct, ethics)."""
+    assignment = db.get_or_404(DocumentAssignment, assignment_id)
+    if assignment.user_id != current_user.id:
+        flash(_('You do not have permission to acknowledge this document.'), 'danger')
+        return respond_after_change(url_for('users.list_my_documents'))
+
+    if assignment.completed:
+        flash(_('This document has already been completed.'), 'danger')
+        return respond_after_change(url_for('users.list_my_documents'))
+    if assignment.document.requires_signature:
+        flash(_('This document must be signed, not acknowledged.'), 'danger')
+        return respond_after_change(url_for('users.list_my_documents'))
+    if not assignment.document.current_version:
+        flash(_('This document has no version published yet.'), 'danger')
+        return respond_after_change(url_for('users.list_my_documents'))
+
+    assignment.status = 'acknowledged'
+    assignment.completed_version_id = assignment.document.current_version.id
+    assignment.completed_at = utc_now_naive()
+    db.session.commit()
+
+    flash(_('Document acknowledged.'), 'success')
+    return respond_after_change(url_for('users.list_my_documents'))
+
+
+@users_bp.route('/documents/version/<int:version_id>/download')
+@login_required
+def download_document(version_id):
+    """Download the canonical file, gated on the admin's published flag."""
+    version = db.get_or_404(DocumentVersion, version_id)
+    allowed = isinstance(current_user, Admin) or (
+        version.document.is_published
+        and user_eligible_for_kind(current_user, version.document.kind)
+    )
+    if not allowed:
+        flash(_('This document is not available to you.'), 'danger')
+        return respond_after_change(url_for('users.list_my_documents'))
+
+    try:
+        file_object = open_document(version.file_path)
+    except GoogleDriveStorageError:
+        flash(
+            _('Document storage is temporarily unavailable. Please try again later.'),
+            'danger',
+        )
+        return respond_after_change(url_for('users.list_my_documents'))
+    return send_file(file_object, as_attachment=True, download_name=version.original_filename)

app/routes/users/notes.py

@@ -10,6 +10,7 @@ from flask_login import current_user, login_required
 from marshmallow import ValidationError
 
 from app.extensions import db
+from app.responders import respond_after_change
 from app.forms import flash_validation_errors, form_payload
 from app.models import (
     Coach,
@@ -176,14 +177,14 @@ def manage_team_notes():
     org_teams = coach_org_teams(current_user)
     if not org_teams:
         flash(_('You are not assigned to a team.'), 'danger')
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
     org_team = org_teams[0]
 
     try:
         data = NoteContentSchema().load(form_payload(list_fields=()))
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
 
     note = TeamNote(
         org_team_id=org_team.id,
@@ -194,7 +195,7 @@ def manage_team_notes():
     db.session.commit()
     flash(_('Team notes saved successfully!'), 'success')
 
-    return redirect(url_for('users.notes_dashboard'))
+    return respond_after_change(url_for('users.notes_dashboard'))
 
 
 # ---------------------------------------------------------------------------
@@ -214,17 +215,17 @@ def manage_personal_notes():
         data = PersonalNoteSchema().load(form_payload(list_fields=()))
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
     player_id = data['player_id']
 
     player = db.get_or_404(User, player_id)
     if not isinstance(player, Player):
         flash(_('Can only add notes for players.'), 'danger')
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
 
     if not coach_can_access_player(current_user, player_id):
         flash(_('You can only write notes about players you work with.'), 'danger')
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
 
     note = PersonalNote(
         player_id=player_id,
@@ -234,7 +235,7 @@ def manage_personal_notes():
     db.session.add(note)
     db.session.commit()
     flash(_('Note added for %(username)s.', username=player.username), 'success')
-    return redirect(url_for('users.notes_dashboard'))
+    return respond_after_change(url_for('users.notes_dashboard'))
 
 
 # ---------------------------------------------------------------------------
@@ -254,44 +255,44 @@ def add_personal_note():
         data = PersonalNoteSchema().load(form_payload(list_fields=()))
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
     player_id = data['player_id']
 
     player = db.get_or_404(User, player_id)
     if not isinstance(player, Player):
         flash(_('Can only add notes for players.'), 'danger')
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
 
     if not coach_can_access_player(current_user, player_id):
         flash(_('You can only write notes about players you work with.'), 'danger')
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
 
     if data['match_id']:
         match = db.get_or_404(Match, data['match_id'])
         if not current_user.can_manage_this_tryout(match.tryout):
             flash(_('You cannot use that match as note context.'), 'danger')
-            return redirect(url_for('users.notes_dashboard'))
+            return respond_after_change(url_for('users.notes_dashboard'))
         if not MatchParticipant.query.filter_by(match_id=match.id, player_id=player_id).first():
             flash(_('That player did not participate in the selected match.'), 'danger')
-            return redirect(url_for('users.notes_dashboard'))
+            return respond_after_change(url_for('users.notes_dashboard'))
 
     if data['tryout_id']:
         tryout = db.get_or_404(Tryout, data['tryout_id'])
         if not current_user.can_manage_this_tryout(tryout):
             flash(_('You cannot use that tryout as note context.'), 'danger')
-            return redirect(url_for('users.notes_dashboard'))
+            return respond_after_change(url_for('users.notes_dashboard'))
         if not TryoutRegistration.query.filter_by(tryout_id=tryout.id, player_id=player_id).first():
             flash(_('That player is not registered for the selected tryout.'), 'danger')
-            return redirect(url_for('users.notes_dashboard'))
+            return respond_after_change(url_for('users.notes_dashboard'))
 
     if data['team_id']:
         team = db.get_or_404(Team, data['team_id'])
         if not current_user.can_manage_this_tryout(team.tryout):
             flash(_('You cannot use that team as note context.'), 'danger')
-            return redirect(url_for('users.notes_dashboard'))
+            return respond_after_change(url_for('users.notes_dashboard'))
         if not TeamMember.query.filter_by(team_id=team.id, player_id=player_id).first():
             flash(_('That player is not on the selected team.'), 'danger')
-            return redirect(url_for('users.notes_dashboard'))
+            return respond_after_change(url_for('users.notes_dashboard'))
 
     note = PersonalNote(
         player_id=player_id,
@@ -304,7 +305,7 @@ def add_personal_note():
     db.session.add(note)
     db.session.commit()
     flash(_('Note added for %(username)s.', username=player.username), 'success')
-    return redirect(url_for('users.notes_dashboard'))
+    return respond_after_change(url_for('users.notes_dashboard'))
 
 
 # ---------------------------------------------------------------------------
@@ -323,7 +324,7 @@ def add_note_from_tryout(tryout_id):
     tryout = db.get_or_404(Tryout, tryout_id)
     if not current_user.can_manage_this_tryout(tryout):
         flash(_('You do not have permission to add notes for this tryout.'), 'danger')
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
     preselected_player_id = request.args.get('player_id', type=int)
 
     # Get registrations as players for the select list
@@ -387,7 +388,7 @@ def add_note_from_match(match_id):
     match_obj = db.get_or_404(Match, match_id)
     if not current_user.can_manage_this_tryout(match_obj.tryout):
         flash(_('You do not have permission to add notes for this match.'), 'danger')
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
 
     # Get participants as players for the select list
     participants = MatchParticipant.query.filter_by(match_id=match_id).all()

app/routes/users/one_on_one.py

@@ -6,6 +6,7 @@ from flask_login import current_user, login_required
 from marshmallow import ValidationError
 
 from app.extensions import db
+from app.responders import respond_after_change
 from app.forms import flash_validation_errors, form_payload
 from app.models import Coach, CoachAvailability, OneOnOneRequest, PersonalNote, Player, TeamNote
 from app.routes.users.blueprint import users_bp
@@ -64,13 +65,13 @@ def one_on_one():
     if request.method == 'POST':
         if not coach:
             flash(_('Cannot request One on One - no coach assigned.'), 'danger')
-            return redirect(url_for('users.one_on_one'))
+            return respond_after_change(url_for('users.one_on_one'))
 
         try:
             data = OneOnOneRequestSchema().load(form_payload())
         except ValidationError as err:
             flash_validation_errors(err)
-            return redirect(url_for('users.one_on_one'))
+            return respond_after_change(url_for('users.one_on_one'))
 
         date_obj = data['date']
         start_time = data['start_time']
@@ -90,7 +91,7 @@ def one_on_one():
 
         if not is_available:
             flash(_("The requested time is not within the coach's availability."), 'danger')
-            return redirect(url_for('users.one_on_one'))
+            return respond_after_change(url_for('users.one_on_one'))
 
         request_obj = OneOnOneRequest(
             player_id=current_user.id,
@@ -118,7 +119,7 @@ def one_on_one():
         )
 
         flash(_('Your One on One request has been submitted!'), 'success')
-        return redirect(url_for('users.one_on_one'))
+        return respond_after_change(url_for('users.one_on_one'))
 
     # Build list of upcoming dates that have coach availability
     from datetime import date as date_cls
@@ -169,11 +170,11 @@ def accept_one_on_one(request_id):
 
     if request_obj.coach_id != current_user.id:
         flash(_('This request is not for you.'), 'danger')
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
 
     if request_obj.status != 'pending':
         flash(_('This request has already been processed.'), 'info')
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
 
     player = request_obj.player
     request_obj.status = 'approved'
@@ -204,7 +205,7 @@ def accept_one_on_one(request_id):
         ),
         'success',
     )
-    return redirect(url_for('users.notes_dashboard'))
+    return respond_after_change(url_for('users.notes_dashboard'))
 
 
 @users_bp.route('/one-on-one/<int:request_id>/reject', methods=['POST'])
@@ -219,17 +220,17 @@ def reject_one_on_one(request_id):
 
     if request_obj.coach_id != current_user.id:
         flash(_('This request is not for you.'), 'danger')
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
 
     if request_obj.status != 'pending':
         flash(_('This request has already been processed.'), 'info')
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
 
     try:
         data = OneOnOneRejectionSchema().load(form_payload(list_fields=()))
     except ValidationError as err:
         flash_validation_errors(err)
-        return redirect(url_for('users.notes_dashboard'))
+        return respond_after_change(url_for('users.notes_dashboard'))
     rejection_reason = data['rejection_reason']
     player = request_obj.player
 
@@ -264,4 +265,4 @@ def reject_one_on_one(request_id):
         ),
         'info',
     )
-    return redirect(url_for('users.notes_dashboard'))
+    return respond_after_change(url_for('users.notes_dashboard'))

app/routes/users/profile.py

@@ -6,6 +6,7 @@ from flask_login import current_user, login_required
 from marshmallow import ValidationError
 
 from app.extensions import db, hash_password
+from app.responders import respond_after_change
 from app.logging_config import log_auth_event
 from app.models import (
     ESPORT_GAMES,
@@ -129,7 +130,7 @@ def edit_profile():
 
         db.session.commit()
         flash(_('Profile updated successfully!'), 'success')
-        return redirect(url_for('users.profile'))
+        return respond_after_change(url_for('users.profile'))
 
     return render_template(
         'pages/edit_profile.html',

app/services/documents.py

@@ -0,0 +1,137 @@
+"""Document lifecycle logic: eligibility, assignment backfill, primary team.
+
+The rules this encodes are the club's:
+
+- Only *active* members who belong to at least one team receive an
+  obligation.  A player not placed on a team signs nothing.
+- Obligations are role-scoped.  A player on two teams signs the player
+  contract once; ``UNIQUE(document_id, user_id)`` is the guarantee, and the
+  team folder below is only where the signed copy is filed.
+- Publishing a version (or enabling a document) backfills pending
+  assignments for everyone currently eligible.  Joining a team backfills
+  that one person across every published document matching their role.
+"""
+
+from app.extensions import db
+from app.models import (
+    DOCUMENT_KIND_ROLES,
+    Coach,
+    Document,
+    DocumentAssignment,
+    Manager,
+    OrgTeam,
+    Player,
+    User,
+)
+
+
+def user_org_team_ids(user):
+    """Ids of the organisation teams the user is a member of.
+
+    Role-appropriate: placements for a player, the coach/managers
+    relationships (many-to-many *and* legacy single column) for staff.  An
+    admin or a scout belongs to none, regardless of how many teams exist.
+    """
+    from app.permissions import coach_org_teams, manager_org_teams
+
+    if isinstance(user, Player):
+        return [tp.org_team_id for tp in user.team_placements]
+    if isinstance(user, Coach):
+        return [team.id for team in coach_org_teams(user)]
+    if isinstance(user, Manager):
+        return [team.id for team in manager_org_teams(user)]
+    return []
+
+
+def user_has_any_team(user):
+    """Whether the user belongs to at least one organisation team."""
+    return bool(user_org_team_ids(user))
+
+
+def primary_team_for_user(user):
+    """The canonical team used for filing a signed copy, or None.
+
+    A member can sit on several teams but every signed file is filed under
+    one team only.  The choice is deterministic: the team with the lowest
+    id among the user's memberships.
+    """
+    team_ids = user_org_team_ids(user)
+    if not team_ids:
+        return None
+    return db.session.get(OrgTeam, min(team_ids))
+
+
+def user_eligible_for_kind(user, kind):
+    """Whether *user* must complete documents of *kind*."""
+    if kind not in DOCUMENT_KIND_ROLES:
+        return False
+    if not user.is_active_account:
+        return False
+    if user.role not in DOCUMENT_KIND_ROLES[kind]:
+        return False
+    return user_has_any_team(user)
+
+
+def eligible_user_ids(kind):
+    """Ids of every user currently eligible for *kind*, ordered by id."""
+    roles = DOCUMENT_KIND_ROLES[kind]
+    users = (
+        User.query.filter(User.role.in_(roles), User.is_active_account.is_(True))
+        .order_by(User.id)
+        .all()
+    )
+    return [u.id for u in users if user_has_any_team(u)]
+
+
+def backfill_assignments_for_document(document):
+    """Create a pending assignment for every currently eligible user.
+
+    Idempotent: anyone who already has an assignment for this document is
+    left alone.  Returns how many new assignments were created.
+    """
+    existing = {a.user_id for a in document.assignments.all()}
+    created = 0
+    for user_id in eligible_user_ids(document.kind):
+        if user_id in existing:
+            continue
+        db.session.add(
+            DocumentAssignment(
+                document_id=document.id,
+                user_id=user_id,
+                status='pending',
+            )
+        )
+        created += 1
+    if created:
+        db.session.commit()
+    return created
+
+
+def backfill_assignments_for_user(user):
+    """Create pending assignments for *user* across published documents.
+
+    Called when a member joins (or is reactivated into) a team.  Only
+    published documents are backfilled: an essentially invisible draft
+    creates no obligations.  Returns how many new assignments were created.
+    """
+    if not user.is_active_account or not user_has_any_team(user):
+        return 0
+    documents = Document.query.filter(Document.is_published.is_(True)).order_by(Document.id).all()
+    created = 0
+    for doc in documents:
+        if user.role not in DOCUMENT_KIND_ROLES.get(doc.kind, ()):
+            continue
+        exists = DocumentAssignment.query.filter_by(document_id=doc.id, user_id=user.id).first()
+        if exists:
+            continue
+        db.session.add(
+            DocumentAssignment(
+                document_id=doc.id,
+                user_id=user.id,
+                status='pending',
+            )
+        )
+        created += 1
+    if created:
+        db.session.commit()
+    return created

app/services/scheduling.py

@@ -60,7 +60,9 @@ def zip_participants(player_ids, participant_ids):
         yield player_id, participant_ids[index] if index < len(participant_ids) else None
 
 
-def notify_participants(*, title, date, start_time, end_time, participants, fallback_id):
+def notify_participants(
+    *, title, date, start_time, end_time, participants, fallback_id, change_kind='scheduled'
+):
     """Tell each participant that a match has been scheduled or changed.
 
     Args:
@@ -73,6 +75,8 @@ def notify_participants(*, title, date, start_time, end_time, participants, fall
             attendance lands on the right row.
         fallback_id: Reference to use when a participant row has no id —
             the match's own, which the bot can still act on.
+        change_kind: 'scheduled' (new match / new player added) or
+            'modified' (date/time changed for existing players).
 
     Returns:
         int: How many notifications were handed to the bot.
@@ -91,6 +95,7 @@ def notify_participants(*, title, date, start_time, end_time, participants, fall
             event_date=event_date,
             event_time=event_time,
             reference_id=participant_id or fallback_id,
+            change_kind=change_kind,
         )
         sent += 1
     return sent

app/static/css/style.css

@@ -1043,6 +1043,10 @@ a:hover { color: var(--primary-dark); }
 
 .fc {
     font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+    --fc-border-color: var(--gray-200);
+    --fc-page-bg-color: transparent;
+    --fc-neutral-bg-color: var(--gray-50);
+    --fc-today-bg-color: var(--info-light);
 }
 
 .fc-toolbar {
@@ -1055,24 +1059,29 @@ a:hover { color: var(--primary-dark); }
     color: var(--gray-900);
 }
 
-.fc-button {
-    background: var(--primary) !important;
-    border: none !important;
+.fc .fc-button {
+    background: var(--gray-50) !important;
+    border: 1px solid var(--gray-200) !important;
+    color: var(--gray-700) !important;
     border-radius: var(--radius-sm) !important;
     padding: 6px 12px !important;
     font-size: 0.85rem !important;
 }
 
-.fc-button:hover {
-    background: var(--primary-dark) !important;
+.fc .fc-button:hover {
+    background: var(--gray-100) !important;
+    color: var(--gray-900) !important;
 }
 
-.fc-button-primary:not(:disabled).fc-button-active,
-.fc-button-primary:not(:disabled):active {
-    background: var(--primary-dark) !important;
+.fc .fc-button-primary:not(:disabled).fc-button-active,
+.fc .fc-button-primary:not(:disabled):active {
+    background: var(--primary) !important;
+    border-color: var(--primary) !important;
+    color: #fff !important;
 }
 
-.fc-daygrid-day {
+.fc-daygrid-day,
+.fc-timegrid-slot {
     transition: var(--transition);
 }
 
@@ -1080,16 +1089,111 @@ a:hover { color: var(--primary-dark); }
     background: var(--gray-50);
 }
 
-.fc-event {
-    border-radius: var(--radius-sm);
-    padding: 2px 4px;
-    font-size: 0.8rem;
+/* Event cards (scoped to the main calendar: the tryout mini-calendar keeps
+   its inline event colors) */
+#calendar .fc-event {
+    border: none !important;
+    border-radius: var(--radius-sm) !important;
+    padding: 3px 6px !important;
+    font-size: 0.8rem !important;
+    background-color: var(--fc-event-bg, var(--primary)) !important;
+    color: #fff !important;
+    box-shadow: var(--shadow);
 }
 
-.fc-event-title {
-    font-weight: 600;
+#calendar .fc-event-body {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    min-width: 0;
 }
 
+#calendar .fc-event-body i {
+    flex: 0 0 auto;
+    font-size: 0.7rem;
+    opacity: 0.9;
+}
+
+#calendar .fc-event-text {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: baseline;
+    gap: 0 4px;
+    min-width: 0;
+}
+
+#calendar .fc-event-time {
+    font-size: 0.72rem;
+    font-weight: 700;
+}
+
+#calendar .fc-event-title {
+    font-weight: 600 !important;
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+}
+
+/* Event type colors (semantic, light theme) */
+#calendar .fc-event--team { --fc-event-bg: #10b981; }
+#calendar .fc-event--scrim { --fc-event-bg: #f59e0b; }
+#calendar .fc-event--team-match { --fc-event-bg: #3b82f6; }
+#calendar .fc-event--one-on-one { --fc-event-bg: #8b5cf6; }
+
+#calendar .fc-now-indicator {
+    border-color: var(--danger);
+}
+
+/* Dark theme: the calendar chrome reacts to the light/dark switch */
+[data-theme="dark"] .fc {
+    --fc-border-color: var(--border-color);
+    --fc-neutral-bg-color: var(--bg-secondary);
+    --fc-today-bg-color: rgba(59, 130, 246, 0.15);
+}
+
+[data-theme="dark"] .fc-toolbar-title {
+    color: var(--text-primary);
+}
+
+[data-theme="dark"] .fc .fc-button {
+    background: var(--bg-tertiary) !important;
+    border-color: var(--border-color) !important;
+    color: var(--text-secondary) !important;
+}
+
+[data-theme="dark"] .fc .fc-button:hover {
+    background: var(--bg-secondary) !important;
+    color: var(--text-primary) !important;
+}
+
+[data-theme="dark"] .fc .fc-button-primary:not(:disabled).fc-button-active,
+[data-theme="dark"] .fc .fc-button-primary:not(:disabled):active {
+    background: var(--primary) !important;
+    border-color: var(--primary) !important;
+    color: #fff !important;
+}
+
+[data-theme="dark"] .fc-daygrid-day:hover {
+    background: var(--bg-tertiary);
+}
+
+[data-theme="dark"] .fc-daygrid-day-number,
+[data-theme="dark"] .fc-col-header-cell-cushion,
+[data-theme="dark"] .fc-timegrid-axis-cushion,
+[data-theme="dark"] .fc-timegrid-slot-label-cushion {
+    color: var(--text-secondary);
+}
+
+/* Pastel event chips with dark text keep contrast on a dark background. */
+[data-theme="dark"] #calendar .fc-event {
+    color: var(--gray-900) !important;
+}
+
+[data-theme="dark"] #calendar .fc-event--team { --fc-event-bg: #d1fae5; }
+[data-theme="dark"] #calendar .fc-event--scrim { --fc-event-bg: #fef3c7; }
+[data-theme="dark"] #calendar .fc-event--team-match { --fc-event-bg: #dbeafe; }
+[data-theme="dark"] #calendar .fc-event--one-on-one { --fc-event-bg: #ede9fe; }
+
 .btn-group {
     display: flex;
     gap: 4px;
@@ -1256,6 +1360,64 @@ a:hover { color: var(--primary-dark); }
     color: white !important;
     border-color: #4f46e5 !important;
 }
+/* Read-only weekly availability grid (public profile) */
+.readonly-availability-grid {
+    display: grid;
+    grid-template-columns: repeat(7, 1fr);
+    gap: 8px;
+    margin-top: 8px;
+}
+
+.ra-day-column {
+    background: var(--bg-secondary);
+    border-radius: 8px;
+    padding: 8px;
+    min-height: 120px;
+}
+
+.ra-day-header {
+    text-align: center;
+    font-weight: 600;
+    padding: 6px 0;
+    border-bottom: 1px solid var(--border-color);
+    margin-bottom: 6px;
+    color: var(--primary);
+    font-size: 0.85rem;
+}
+
+.ra-slot {
+    padding: 4px 6px;
+    margin: 3px 0;
+    border-radius: 4px;
+    font-size: 0.75rem;
+    text-align: center;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-color);
+}
+
+.ra-slot.selected {
+    background: var(--primary);
+    color: white;
+    border-color: var(--primary-dark);
+}
+
+.ra-slot.ra-empty {
+    color: var(--gray-400);
+    border: 1px dashed var(--gray-300);
+    background: transparent;
+}
+
+@media (max-width: 768px) {
+    .readonly-availability-grid {
+        grid-template-columns: repeat(3, 1fr);
+    }
+}
+
+@media (max-width: 480px) {
+    .readonly-availability-grid {
+        grid-template-columns: 1fr;
+    }
+}
 
 .merged-disponibility-time-block.high-availability {
     background: var(--success);
@@ -2064,3 +2226,73 @@ a:hover { color: var(--primary-dark); }
         grid-template-columns: 1fr;
     }
 }
+
+/* Evaluation comments - separate grid so long notes stay readable */
+.eval-comments {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
+    gap: 12px;
+    margin-top: 16px;
+}
+
+.eval-comments-title {
+    grid-column: 1 / -1;
+    margin: 0 0 4px;
+    font-size: 0.95rem;
+    font-weight: 600;
+}
+
+.eval-comment {
+    background: var(--gray-50);
+    border: 1px solid var(--gray-200);
+    border-radius: var(--radius-sm);
+    padding: 12px 14px;
+}
+
+.eval-comment-text {
+    margin: 0 0 10px;
+    white-space: pre-wrap;
+    word-break: break-word;
+    color: var(--gray-800);
+}
+
+.eval-comment-meta {
+    display: flex;
+    justify-content: space-between;
+    gap: 8px;
+    flex-wrap: wrap;
+    font-size: 0.85rem;
+    color: var(--gray-500);
+}
+
+.eval-comment-author strong {
+    color: var(--gray-700);
+    font-weight: 600;
+}
+
+[data-theme="dark"] .eval-comment {
+    background: var(--bg-tertiary);
+    border-color: var(--border-color);
+}
+
+[data-theme="dark"] .eval-comment-text {
+    color: var(--text-primary);
+}
+
+[data-theme="dark"] .eval-comment-meta {
+    color: var(--text-muted);
+}
+
+[data-theme="dark"] .eval-comment-author strong {
+    color: var(--text-secondary);
+}
+
+.eval-comments-empty {
+    margin: 8px 0 0;
+    color: var(--gray-500);
+    font-size: 0.9rem;
+}
+
+[data-theme="dark"] .eval-comments-empty {
+    color: var(--text-muted);
+}

app/static/js/main.js

@@ -420,22 +420,9 @@ document.addEventListener('DOMContentLoaded', function() {
     initDraggableBlocks();
     
     /**
-     * Auto-dismiss flash alerts after 5 seconds.
+     * Auto-dismiss flash alerts after 5 seconds (see armAlertAutoDismiss).
      */
-    const alerts = document.querySelectorAll('.alert-dismissible');
-    alerts.forEach(function(alert) {
-        setTimeout(function() {
-            if (alert.parentElement) {
-                alert.style.opacity = '0';
-                alert.style.transition = 'opacity 0.3s ease';
-                setTimeout(function() {
-                    if (alert.parentElement) {
-                        alert.remove();
-                    }
-                }, 300);
-            }
-        }, 5000);
-    });
+    armAlertAutoDismiss();
 });
 /* =========================================================================
    Declarative behaviours — replacing inline event handlers
@@ -530,13 +517,31 @@ document.addEventListener('change', function (event) {
  * Confirmation before a destructive submit.
  *
  *     <form data-confirm="Delete this match?">
+ *     <form data-confirm-input="confirm" data-confirm-value="DELETE"
+ *           data-confirm-input-message="Type DELETE to continue."
+ *           data-confirm="Delete this record?">
  *
  * Replaces onsubmit="return confirm(...)", and keeps the wording in the
  * markup where it can be translated.
  */
 document.addEventListener('submit', function (event) {
     const form = event.target.closest('[data-confirm]');
-    if (form && !window.confirm(form.getAttribute('data-confirm'))) {
+    if (!form) {
+        return;
+    }
+
+    const inputName = form.getAttribute('data-confirm-input');
+    if (inputName) {
+        const input = form.elements.namedItem(inputName);
+        const expectedValue = form.getAttribute('data-confirm-value') || '';
+        if (!input || input.value.trim() !== expectedValue) {
+            window.alert(form.getAttribute('data-confirm-input-message') || 'Confirmation is required.');
+            event.preventDefault();
+            return;
+        }
+    }
+
+    if (!window.confirm(form.getAttribute('data-confirm'))) {
         event.preventDefault();
     }
 });
@@ -575,7 +580,7 @@ document.addEventListener('input', function (event) {
 document.addEventListener('change', function (event) {
     const control = event.target.closest('[data-submit-on-change]');
     if (control && control.form) {
-        control.form.submit();
+        submitForm(control.form);
     }
 });
 
@@ -595,3 +600,193 @@ document.addEventListener('change', function (event) {
     window.location.href = select.getAttribute('data-navigate')
         .replace('{value}', encodeURIComponent(select.value));
 });
+
+/* =========================================================================
+   AJAX forms — server-rendered changes without a full page reload
+   =========================================================================
+
+   A <form method="post" data-ajax> is submitted with fetch() instead of a
+   navigation. The route answers a JSON payload (see app/responders.py) that
+   says where to fetch the refreshed content and which flash messages to
+   show; the content region is then swapped in place, so scroll position and
+   open state survive between edits.
+
+   A stale edit — the page changed since this copy was loaded — is answered
+   409, and the user is asked to reload rather than silently overwrite the
+   other person's change.
+   ========================================================================= */
+
+let TT_REVISION = null;
+
+function armAlertAutoDismiss() {
+    const alerts = document.querySelectorAll('.alert-dismissible');
+    alerts.forEach(function (alert) {
+        if (alert.getAttribute('data-armed')) return;
+        alert.setAttribute('data-armed', '1');
+        setTimeout(function () {
+            if (alert.parentElement) {
+                alert.style.opacity = '0';
+                alert.style.transition = 'opacity 0.3s ease';
+                setTimeout(function () {
+                    if (alert.parentElement) {
+                        alert.remove();
+                    }
+                }, 300);
+            }
+        }, 5000);
+    });
+}
+
+function fetchRevision() {
+    return fetch('/api/revision', {
+        headers: { 'Accept': 'application/json' },
+        credentials: 'same-origin'
+    }).then(function (r) { return r.json(); }).then(function (data) {
+        TT_REVISION = data.revision;
+        return data.revision;
+    }).catch(function () {
+        // Revision tracking is best-effort; a failed lookup just disables it.
+    });
+}
+
+function showFlashMessages(messages) {
+    const container = document.querySelector('.flash-messages');
+    if (!container || !messages || !messages.length) return;
+    messages.forEach(function (m) {
+        const alert = document.createElement('div');
+        alert.className = 'alert alert-' + (m.category || 'info') + ' alert-dismissible';
+        const span = document.createElement('span');
+        span.textContent = m.text;
+        const close = document.createElement('button');
+        close.type = 'button';
+        close.className = 'alert-close';
+        close.setAttribute('data-action', 'dismiss-alert');
+        close.setAttribute('aria-label', 'Dismiss');
+        close.innerHTML = '&times;';
+        alert.appendChild(span);
+        alert.appendChild(close);
+        container.appendChild(alert);
+    });
+    armAlertAutoDismiss();
+}
+
+function replaceContent(html, url) {
+    const holder = document.createElement('div');
+    holder.innerHTML = html;
+    const next = holder.querySelector('#page-content');
+    const target = document.getElementById('page-content');
+    if (next && target) {
+        target.innerHTML = next.innerHTML;
+    }
+    if (url && window.history && window.history.replaceState) {
+        window.history.replaceState(null, '', url);
+    }
+    initDraggableBlocks();
+    document.dispatchEvent(new Event('fragment:updated'));
+}
+
+function refreshPage(url) {
+    return fetch(url, { credentials: 'same-origin' })
+        .then(function (r) { return r.text(); })
+        .then(function (html) { replaceContent(html, url); });
+}
+
+function submitAjaxForm(form) {
+    const headers = {
+        'X-Requested-With': 'XMLHttpRequest',
+        'Accept': 'application/json'
+    };
+    const token = form.querySelector('input[name="csrf_token"]');
+    if (token) headers['X-CSRFToken'] = token.value;
+    if (TT_REVISION !== null && TT_REVISION !== undefined) {
+        headers['X-Revision'] = String(TT_REVISION);
+    }
+
+    fetch(form.action, {
+        method: (form.method || 'POST').toUpperCase(),
+        body: new FormData(form),
+        headers: headers,
+        credentials: 'same-origin'
+    }).then(function (response) {
+        return response.json().then(function (data) {
+            return { status: response.status, data: data };
+        }).catch(function () {
+            return { status: response.status, data: null };
+        });
+    }).then(function (result) {
+        if (result.status === 409) {
+            const message = (result.data && result.data.message) ||
+                'This page was changed by someone else. Reload to see the latest changes.';
+            if (window.confirm(message)) {
+                window.location.reload();
+            }
+            return null;
+        }
+        if (result.status >= 400) {
+            const message = (result.data && (result.data.message || result.data.error)) ||
+                'Something went wrong. Please try again.';
+            window.alert(message);
+            return null;
+        }
+        return result.data;
+    }).then(function (data) {
+        if (!data) return;
+        if (data.revision !== undefined && data.revision !== null) {
+            TT_REVISION = data.revision;
+        }
+        showFlashMessages(data.messages);
+        if (data.redirect) {
+            return refreshPage(data.redirect);
+        }
+        return undefined;
+    }).catch(function (err) {
+        console.error('AJAX form submission failed:', err);
+    });
+}
+
+function submitForm(form) {
+    if (form.hasAttribute('data-ajax')) {
+        submitAjaxForm(form);
+    } else {
+        form.submit();
+    }
+}
+
+function checkForRemoteChanges() {
+    return fetchRevision().then(function (rev) {
+        if (TT_REVISION !== null && rev !== TT_REVISION) {
+            TT_REVISION = rev;
+            return refreshPage(window.location.href);
+        }
+        return undefined;
+    }).catch(function () { /* best-effort */ });
+}
+
+// data-submit-on-change and data-ajax both funnel through submitForm so a
+// <select> change uses fetch() when the form is marked, and a plain submit
+// otherwise. (form.submit() does not fire the submit event, so intercepting
+// only 'submit' would miss the selects.)
+document.addEventListener('submit', function (event) {
+    const form = event.target.closest('form[data-ajax]');
+    if (!form || event.defaultPrevented) return;
+    event.preventDefault();
+    submitAjaxForm(form);
+});
+
+// Refresh when the user returns to the tab: if someone else changed the data,
+// this brings the view up to date without a constant polling loop.
+document.addEventListener('visibilitychange', function () {
+    if (document.visibilityState === 'visible') {
+        checkForRemoteChanges();
+    }
+});
+window.addEventListener('focus', function () {
+    checkForRemoteChanges();
+});
+
+document.addEventListener('DOMContentLoaded', function () {
+    fetchRevision();
+});
+
+window.TT = window.TT || {};
+window.TT.refreshPage = refreshPage;

app/storage.py

@@ -28,8 +28,29 @@ absolute path and are returned untouched, so this change needs no data
 migration and can ship before Alembic does (DB-002).
 """
 
+import io
+import logging
 import os
 
+from app.google_drive import (
+    GoogleDriveStorageError,
+)
+from app.google_drive import (
+    delete_file as delete_google_drive_file,
+)
+from app.google_drive import (
+    download_file as download_google_drive_file,
+)
+from app.google_drive import (
+    get_or_create_folder as get_or_create_drive_folder,
+)
+from app.google_drive import (
+    root_folder_id as google_drive_root_folder_id,
+)
+from app.google_drive import (
+    upload_file as upload_google_drive_file,
+)
+
 #: Environment override for the document root. What a release-directory
 #: deployment sets, to a path outside the releases — alongside them, not
 #: inside whichever one is current.
@@ -45,6 +66,16 @@ BACKUP_DIR_ENV = 'BACKUP_DIR'
 #: Sub-directory holding uploaded contracts, under the document root.
 CONTRACTS_DIR = 'contrats signés'
 
+#: Database marker for documents stored remotely. Existing rows continue to
+#: hold relative or absolute filesystem paths, so switching storage does not
+#: invalidate contracts already uploaded before the Google Drive move.
+GOOGLE_DRIVE_PATH_PREFIX = 'gdrive://'
+
+#: Storage backends deliberately stay explicit. Google Drive is the
+#: production default; local disk exists only for legacy rows and isolated
+#: test/development environments.
+DOCUMENT_STORAGE_BACKEND_ENV = 'DOCUMENT_STORAGE_BACKEND'
+
 
 def project_root():
     """Absolute path of the project, derived from this file's location.
@@ -91,6 +122,123 @@ def _rooted(env_name, default_name):
     return os.path.join(project_root(), default_name)
 
 
+def document_storage_backend():
+    """Return the configured backend for new document uploads."""
+    backend = os.getenv(DOCUMENT_STORAGE_BACKEND_ENV, 'local').strip().lower()
+    if backend not in {'google_drive', 'local'}:
+        raise ValueError(
+            f'{DOCUMENT_STORAGE_BACKEND_ENV} must be "google_drive" or "local", not {backend!r}'
+        )
+    return backend
+
+
+def is_google_drive_path(stored_path):
+    """Whether a database path references a Google Drive file."""
+    return bool(stored_path and stored_path.startswith(GOOGLE_DRIVE_PATH_PREFIX))
+
+
+def _google_drive_id(stored_path):
+    file_id = stored_path.removeprefix(GOOGLE_DRIVE_PATH_PREFIX)
+    if not file_id:
+        raise GoogleDriveStorageError('The stored Google Drive file identifier is empty.')
+    return file_id
+
+
+def store_uploaded_document(file_storage, relative_path):
+    """Store an uploaded document and return its durable database reference.
+
+    Local storage retains the relative-path format used by existing rows. A
+    Google Drive upload returns an opaque Drive file identifier prefixed with
+    ``gdrive://`` so it cannot be mistaken for a filesystem path.
+    """
+    if document_storage_backend() == 'local':
+        absolute_path = document_path(relative_path)
+        os.makedirs(os.path.dirname(absolute_path), exist_ok=True)
+        file_storage.save(absolute_path)
+        return relative_path
+
+    file_id = upload_google_drive_file(
+        stream=file_storage.stream,
+        filename=os.path.basename(relative_path),
+        mimetype=file_storage.mimetype or 'application/pdf',
+    )
+    return f'{GOOGLE_DRIVE_PATH_PREFIX}{file_id}'
+
+
+def _save_locally(file_storage, relative_path):
+    """Persist *relative_path* (from ``documents_root()``) and return it."""
+    absolute_path = document_path(relative_path)
+    os.makedirs(os.path.dirname(absolute_path), exist_ok=True)
+    file_storage.save(absolute_path)
+    return relative_path
+
+
+def _drive_folder_for(parts):
+    """Resolve (and create as needed) a nested chain of Drive folders.
+
+    Args:
+        parts: Folder names under the root folder, root first.
+
+    Returns:
+        str: The Drive id of the deepest folder.
+    """
+    parent = google_drive_root_folder_id()
+    for part in parts:
+        parent = get_or_create_drive_folder(part, parent)
+    return parent
+
+
+def store_master_document(file_storage, filename, mimetype=None):
+    """Store the unsigned template of a document (the canonical copy).
+
+    The point is to store the file exactly once: every assignment for that
+    document points at this one reference.
+    """
+    if document_storage_backend() == 'local':
+        return _save_locally(file_storage, os.path.join(CONTRACTS_DIR, filename))
+
+    file_id = upload_google_drive_file(
+        stream=file_storage.stream,
+        filename=filename,
+        mimetype=mimetype or file_storage.mimetype or 'application/pdf',
+    )
+    return f'{GOOGLE_DRIVE_PATH_PREFIX}{file_id}'
+
+
+def store_signed_document(file_storage, *, team_name, role, username, filename, mimetype=None):
+    """File a signed copy under ``signés/<team>/<role>/<username>/<filename>``.
+
+    The root folder is already the signed-contracts folder, so no extra
+    ``signed`` segment is added (the layout the club requested).
+
+    Args:
+        file_storage: The uploaded FileStorage.
+        team_name: Name of the signing member's (primary) team.
+        role: The signing member's own role (player/coach/manager).
+        username: The signing member's username.
+        filename: Name of the signed file, e.g. ``player-v1.pdf``.
+    """
+    if document_storage_backend() == 'local':
+        relative = os.path.join(CONTRACTS_DIR, team_name, role, username, filename)
+        return _save_locally(file_storage, relative)
+
+    parent = _drive_folder_for([team_name, role, username])
+    file_id = upload_google_drive_file(
+        stream=file_storage.stream,
+        filename=filename,
+        mimetype=mimetype or file_storage.mimetype or 'application/pdf',
+        parents=[parent],
+    )
+    return f'{GOOGLE_DRIVE_PATH_PREFIX}{file_id}'
+
+
+def open_document(stored_path):
+    """Return a filesystem path or in-memory stream suitable for ``send_file``."""
+    if is_google_drive_path(stored_path):
+        return io.BytesIO(download_google_drive_file(_google_drive_id(stored_path)))
+    return document_path(stored_path)
+
+
 def discard_documents(stored_paths):
     """Remove these documents from disk. Returns how many went (DATA-012).
 
@@ -107,27 +255,27 @@ def discard_documents(stored_paths):
     A path that cannot be removed is logged and skipped. Nothing here should
     be able to abort the deletion of an account.
     """
-    import logging
-
     logger = logging.getLogger(__name__)
     removed = 0
     for stored_path in stored_paths:
         if not stored_path:
             continue
-        target = document_path(stored_path)
         try:
-            os.remove(target)
+            if is_google_drive_path(stored_path):
+                delete_google_drive_file(_google_drive_id(stored_path))
+            else:
+                os.remove(document_path(stored_path))
             removed += 1
         except FileNotFoundError:
             # Already gone. Two contracts sharing a stem, or a previous
             # attempt: not a problem, and not worth an error line.
-            logger.info('Document already absent: %s', target)
-        except OSError as exc:
+            logger.info('Document already absent: %s', stored_path)
+        except (GoogleDriveStorageError, OSError) as exc:
             logger.error(
                 'Could not remove %s (%s). It is now an orphan: no database row '
                 'refers to it, so nothing in the application will ever offer to '
                 'delete it again.',
-                target,
+                stored_path,
                 exc,
             )
     return removed

app/supporting_scripts/backup.py

@@ -42,7 +42,11 @@ from urllib.parse import unquote, urlparse
 # to be — see DOCUMENTS_DIR below.
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
 
-from app.storage import backups_root, documents_root  # noqa: E402 — needs the path above
+from app.storage import (  # noqa: E402 — needs the path above
+    backups_root,
+    document_storage_backend,
+    documents_root,
+)
 
 # Configuration
 BACKUP_DIR = backups_root()
@@ -292,6 +296,75 @@ def backup_documents():
     return zip_path
 
 
+def backup_drive_documents():
+    """Download every file from the configured Google Drive folder and archive it.
+
+    Called **in addition to** ``backup_documents()`` when the storage backend is
+    ``google_drive``.  When the backend is ``local`` this function silently
+    skips — local backups already handled by ``backup_documents()``.
+
+    Returns:
+        str | None: Path to the created archive, or None when skipped.
+
+    Raises:
+        BackupError: If Drive is configured but listing or downloading fails.
+    """
+    if document_storage_backend() != 'google_drive':
+        print('[SKIP] Google Drive is not configured; local documents only.')
+        return None
+
+    try:
+        from app.google_drive import (
+            GoogleDriveStorageError,
+            list_folder_files,
+        )
+        from app.google_drive import (
+            download_file as download_drive_file,
+        )
+    except ImportError:
+        raise BackupError(
+            'Google Drive dependencies are not installed. Install requirements.txt again.'
+        ) from None
+
+    print('[INFO] Listing Google Drive contract folder...')
+    try:
+        files = list_folder_files()
+    except (GoogleDriveStorageError, Exception) as exc:  # noqa: BLE001 — boundary
+        raise BackupError(f'Google Drive listing failed: {exc}') from exc
+
+    if not files:
+        print('[INFO] Google Drive folder is empty; no Drive documents to back up.')
+        return None
+
+    timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
+    archive_basename = os.path.join(BACKUP_DIR, f'documents_backup_drive_{timestamp}')
+
+    download = {}
+    for file_id, name in files:
+        print(f'  Downloading {name} ({file_id})...')
+        try:
+            download[name] = download_drive_file(file_id)
+        except (GoogleDriveStorageError, Exception) as exc:  # noqa: BLE001 — boundary
+            raise BackupError(f'Google Drive download failed for {name}: {exc}') from exc
+
+    try:
+        import zipfile
+
+        zip_path = f'{archive_basename}.zip'
+        with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:
+            for name, data in download.items():
+                zf.writestr(name, data)
+    except Exception as exc:  # noqa: BLE001 — boundary
+        raise BackupError(f'Drive document archive failed: {exc}') from exc
+
+    if not os.path.exists(zip_path) or os.path.getsize(zip_path) == 0:
+        raise BackupError('Drive document archiver reported success but produced an empty file.')
+
+    size_mb = os.path.getsize(zip_path) / (1024 * 1024)
+    print(f'[OK] Drive documents backed up to: {zip_path} ({size_mb:.1f} MB)')
+    return zip_path
+
+
 def cleanup_old_backups():
     """Remove backup files older than BACKUP_RETENTION_DAYS."""
     if not os.path.exists(BACKUP_DIR):
@@ -365,10 +438,16 @@ def main(argv=None):
     except BackupError as exc:
         documents_ok = False
         print(f'[ERROR] {exc}')
+    drive_ok = True
+    try:
+        backup_drive_documents()
+    except BackupError as exc:
+        drive_ok = False
+        print(f'[ERROR] {exc}')
     cleanup_old_backups()
 
     print()
-    if verified and documents_ok:
+    if verified and documents_ok and drive_ok:
         print('=== Backup completed successfully ===')
         return 0
 

app/supporting_scripts/get_refresh_token.py

@@ -0,0 +1,121 @@
+"""Obtain a Google Drive refresh token for the application.
+
+Run this once from a development machine that has a browser. It opens a local
+OAuth redirect server, asks you to log in, and prints the refresh token.
+
+Usage:
+    python app/supporting_scripts/get_refresh_token.py
+
+Requires:
+    pip install google-auth-oauthlib
+
+Before running:
+    1. Create a Google Cloud project and enable the Drive API.
+    2. Create a **Desktop** OAuth 2.0 client ID.
+    3. Add your email as a test user in the OAuth consent screen.
+    4. Run this script and paste the values when prompted.
+"""
+
+import os
+import sys
+
+
+def _prompt(label, env_name, default=""):
+    """Ask the user for a value, accepting an env-var fallback or a default."""
+    candidate = os.getenv(env_name) or default
+    hint = f" [{candidate}]" if candidate else ""
+    raw = input(f"{label}{hint}: ").strip()
+    if raw:
+        return raw
+    if candidate:
+        return candidate
+    return default
+
+
+def _validate_client_id(client_id):
+    """Warn if the client ID doesn't look like a real OAuth client ID."""
+    if client_id == "YOUR_CLIENT_ID.apps.googleusercontent.com":
+        print("[ERROR] You must provide a real client ID from the Google Cloud console.")
+        return False
+    if not client_id.endswith(".apps.googleusercontent.com"):
+        print(
+            f"[WARNING] Client ID should end with '.apps.googleusercontent.com'.\n"
+            f"          Got: {client_id!r}\n"
+            f"          If this is a placeholder, the OAuth request will fail.\n"
+        )
+    return True
+
+
+def _validate_client_secret(secret):
+    if secret == "YOUR_CLIENT_SECRET":
+        print("[ERROR] You must provide a real client secret from the Google Cloud console.")
+        return False
+    # The GOCSPX- prefix is now used by every client type, so it no longer
+    # tells us anything about whether the client was created as a Desktop app.
+    return True
+
+
+def main():
+    print("=" * 60)
+    print("Google Drive Refresh Token — Setup")
+    print("=" * 60)
+    print()
+
+    # When both env vars are set, skip prompts entirely for headless runs.
+    env_id = os.getenv("GOOGLE_DRIVE_CLIENT_ID")
+    env_secret = os.getenv("GOOGLE_DRIVE_CLIENT_SECRET")
+    if env_id and env_secret:
+        client_id = env_id
+        client_secret = env_secret
+        print(f"Using Client ID from environment: {client_id[:30]}...")
+    else:
+        print("Enter your Google Cloud OAuth credentials.")
+        print("You can also set GOOGLE_DRIVE_CLIENT_ID and GOOGLE_DRIVE_CLIENT_SECRET")
+        print("environment variables and re-run to skip the prompts.")
+        print()
+
+        client_id = _prompt("Client ID", "GOOGLE_DRIVE_CLIENT_ID")
+        client_secret = _prompt("Client Secret", "GOOGLE_DRIVE_CLIENT_SECRET")
+
+        if not _validate_client_id(client_id) or not _validate_client_secret(client_secret):
+            sys.exit(1)
+
+    print()
+    print("Opening browser to authenticate with Google...")
+    print("(If it doesn't open, copy the URL below into your browser.)")
+    print()
+
+    from google_auth_oauthlib.flow import InstalledAppFlow
+
+    SCOPE = "https://www.googleapis.com/auth/drive.file"
+
+    client_config = {
+        "installed": {
+            "client_id": client_id,
+            "client_secret": client_secret,
+            "redirect_uris": ["http://localhost"],
+            "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+            "token_uri": "https://oauth2.googleapis.com/token",
+        }
+    }
+
+    flow = InstalledAppFlow.from_client_config(client_config, scopes=[SCOPE])
+    credentials = flow.run_local_server(host="localhost", port=8080, open_browser=True)
+
+    print()
+    print("=" * 60)
+    print("SUCCESS — copy these values into your .env file:")
+    print("=" * 60)
+    print()
+    print("DOCUMENT_STORAGE_BACKEND=google_drive")
+    print(f"GOOGLE_DRIVE_CLIENT_ID={credentials.client_id}")
+    print(f"GOOGLE_DRIVE_CLIENT_SECRET={client_secret}")
+    print(f"GOOGLE_DRIVE_REFRESH_TOKEN={credentials.refresh_token}")
+    print("GOOGLE_DRIVE_FOLDER_ID=<get this from the Drive folder URL>")
+    print()
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

app/templates/layouts/base.html

@@ -90,6 +90,12 @@
                     <span>{{ _('Manage Users') }}</span>
                 </a>
             </li>
+            <li>
+                <a href="{{ url_for('admin.dashboard') }}" class="{% if request.endpoint and 'admin' in request.endpoint %}active{% endif %}">
+                    <i class="fas fa-cogs"></i>
+                    <span>Admin Panel</span>
+                </a>
+            </li>
             {% endif %}
             {% if current_user.role == 'player' %}
             <li>
@@ -107,6 +113,12 @@
                  </a>
              </li>
              {% endif %}
+            <li>
+                <a href="{{ url_for('users.list_my_documents') }}" class="{% if request.endpoint and 'document' in request.endpoint %}active{% endif %}">
+                    <i class="fas fa-folder-open"></i>
+                    <span>{{ _('Documents') }}</span>
+                </a>
+            </li>
             <li>
                 <a href="{{ url_for('users.list_contracts') }}" class="{% if request.endpoint and 'contracts' in request.endpoint %}active{% endif %}">
                     <i class="fas fa-file-contract"></i>
@@ -167,7 +179,7 @@
                 {% endif %}
             {% endwith %}
         </div>
-        <div class="content">
+        <div class="content" id="page-content">
             {% block content %}{% endblock %}
         </div>
     </div>

app/templates/pages/add_note.html

@@ -27,7 +27,7 @@
         {% endif %}
     </div>
     <div class="card-body">
-        <form method="POST" action="
+        <form method="POST" data-ajax action="
             {% if context_type == 'tryout' %}
                 {{ url_for('users.add_note_from_tryout', tryout_id=tryout.id) }}
             {% elif context_type == 'match' %}

app/templates/pages/admin.html

@@ -0,0 +1,294 @@
+{% extends "layouts/base.html" %}
+{% block title %}Admin Panel{% endblock %}
+{% block page_title %}Admin Panel{% endblock %}
+
+{% block content %}
+
+<!-- Stats Bar -->
+<div class="stats-grid">
+    <div class="stat-card">
+        <div class="stat-icon bg-primary">
+            <i class="fas fa-users"></i>
+        </div>
+        <div class="stat-info">
+            <h3>{{ stats.total_users }}</h3>
+            <p>Total Users</p>
+        </div>
+    </div>
+    <div class="stat-card">
+        <div class="stat-icon bg-success">
+            <i class="fas fa-user"></i>
+        </div>
+        <div class="stat-info">
+            <h3>{{ stats.total_players }}</h3>
+            <p>Players</p>
+        </div>
+    </div>
+    <div class="stat-card">
+        <div class="stat-icon bg-warning">
+            <i class="fas fa-shield-alt"></i>
+        </div>
+        <div class="stat-info">
+            <h3>{{ stats.total_org_teams }}</h3>
+            <p>Org Teams</p>
+        </div>
+    </div>
+    <div class="stat-card">
+        <div class="stat-icon bg-info">
+            <i class="fas fa-calendar-alt"></i>
+        </div>
+        <div class="stat-info">
+            <h3>{{ stats.active_tryouts }}</h3>
+            <p>Active Tryouts</p>
+        </div>
+    </div>
+    <div class="stat-card">
+        <div class="stat-icon bg-secondary">
+            <i class="fas fa-clock"></i>
+        </div>
+        <div class="stat-info">
+            <h3>{{ stats.upcoming_tryouts }}</h3>
+            <p>Upcoming</p>
+        </div>
+    </div>
+</div>
+
+<div class="dashboard-grid">
+    <!-- Left column -->
+    <div class="card">
+        <div class="card-header">
+            <h3><i class="fas fa-toggle-{% if settings.tryouts_open %}on{% else %}off{% endif %}"></i> Tryouts Access</h3>
+        </div>
+        <div class="card-body">
+            <p>
+                Status:
+                <span class="badge badge-{% if settings.tryouts_open %}success{% else %}danger{% endif %}">
+                    {% if settings.tryouts_open %}OPEN{% else %}CLOSED{% endif %}
+                </span>
+            </p>
+            <p class="text-muted" style="font-size: 0.85rem; margin: 8px 0;">
+                {% if settings.tryouts_open %}
+                    Coaches and managers can create and modify tryouts.
+                {% else %}
+                    Only admins can create or modify tryouts. Coaches and managers are locked out.
+                {% endif %}
+            </p>
+            <form method="POST" data-ajax action="{{ url_for('admin.toggle_tryouts') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <button type="submit" class="btn btn-{% if settings.tryouts_open %}warning{% else %}success{% endif %}">
+                    {% if settings.tryouts_open %}Close Tryouts{% else %}Open Tryouts{% endif %}
+                </button>
+            </form>
+        </div>
+    </div>
+
+    <div class="card">
+        <div class="card-header">
+            <h3><i class="fas fa-toggle-{% if settings.document_uploads_enabled %}on{% else %}off{% endif %}"></i> Document Uploads</h3>
+        </div>
+        <div class="card-body">
+            <p>
+                Status:
+                <span class="badge badge-{% if settings.document_uploads_enabled %}success{% else %}danger{% endif %}">
+                    {% if settings.document_uploads_enabled %}ENABLED{% else %}DISABLED{% endif %}
+                </span>
+            </p>
+            <p class="text-muted" style="font-size: 0.85rem; margin: 8px 0;">
+                {% if settings.document_uploads_enabled %}
+                    Managers and coaches can upload contracts. Players can upload signed contracts.
+                {% else %}
+                    Only admins can upload or sign contracts. Other roles are blocked.
+                {% endif %}
+            </p>
+            <form method="POST" data-ajax action="{{ url_for('admin.toggle_document_uploads') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <button type="submit" class="btn btn-{% if settings.document_uploads_enabled %}warning{% else %}success{% endif %}">
+                    {% if settings.document_uploads_enabled %}Disable Uploads{% else %}Enable Uploads{% endif %}
+                </button>
+            </form>
+        </div>
+    </div>
+
+    <div class="card">
+        <div class="card-header">
+            <h3><i class="fas fa-calendar-check"></i> Season Management</h3>
+        </div>
+        <div class="card-body">
+            <p>
+                Season:
+                <span class="badge badge-{% if settings.season_active %}success{% else %}info{% endif %}">
+                    {% if settings.season_active %}ACTIVE{% else %}INACTIVE{% endif %}
+                </span>
+            </p>
+            <p><strong>Name:</strong> {{ settings.season_name }}</p>
+            <p><strong>Start:</strong> {{ settings.season_start }}</p>
+            <p><strong>End:</strong> {{ settings.season_end }}</p>
+
+            {% if not settings.season_active %}
+            <hr style="margin: 12px 0;">
+            <form method="POST" data-ajax action="{{ url_for('admin.start_season') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <div class="form-group">
+                    <label>Season Name</label>
+                    <input type="text" name="season_name" class="form-input" placeholder="e.g. Fall 2026" required>
+                </div>
+                <div class="form-group">
+                    <label>Start Date</label>
+                    <input type="date" name="season_start" class="form-input" required>
+                </div>
+                <button type="submit" class="btn btn-success">Begin Season</button>
+            </form>
+            {% else %}
+            <hr style="margin: 12px 0;">
+            <form method="POST" data-ajax action="{{ url_for('admin.end_season') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <div class="form-group">
+                    <label>End Date</label>
+                    <input type="date" name="season_end" class="form-input" required>
+                </div>
+                <button type="submit" class="btn btn-warning">End Season</button>
+            </form>
+            {% endif %}
+        </div>
+    </div>
+
+    <!-- Wipe Teams -->
+    <div class="card" style="border-left: 4px solid var(--danger);">
+        <div class="card-header">
+            <h3><i class="fas fa-trash-alt" style="color: var(--danger);"></i> Wipe Teams for New Season</h3>
+        </div>
+        <div class="card-body">
+            <p class="text-muted" style="font-size: 0.85rem; margin-bottom: 12px;">
+                This removes all players from organization teams and deletes all regular-season matches.
+                Team structures, coaches, and managers are preserved. A safety backup is created automatically.
+            </p>
+            <form method="POST" action="{{ url_for('admin.wipe_teams') }}"
+                  data-confirm-input="confirm" data-confirm-value="WIPE"
+                  data-confirm-input-message="You must type WIPE to confirm."
+                  data-confirm="This will remove ALL players from organization teams and delete ALL regular-season matches. A safety backup will be created automatically. Are you ABSOLUTELY sure?">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <div class="form-group">
+                    <label>Type <strong>WIPE</strong> to confirm:</label>
+                    <input type="text" name="confirm" class="form-input" placeholder="WIPE" autocomplete="off" required>
+                </div>
+                <button type="submit" class="btn btn-danger">Wipe Team Rosters</button>
+            </form>
+        </div>
+    </div>
+
+    <!-- Manual Backup -->
+    <div class="card">
+        <div class="card-header">
+            <h3><i class="fas fa-database"></i> Manual Backup</h3>
+        </div>
+        <div class="card-body">
+            <p class="text-muted" style="font-size: 0.85rem; margin-bottom: 12px;">
+                Creates a full PostgreSQL database dump (.sql file). Stored on the server.
+            </p>
+            <form method="POST" action="{{ url_for('admin.create_backup') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <div class="form-group">
+                    <label>Notes (optional)</label>
+                    <input type="text" name="notes" class="form-input" placeholder="What's this backup for?">
+                </div>
+                <button type="submit" class="btn btn-primary">
+                    <i class="fas fa-save"></i> Create Backup Now
+                </button>
+            </form>
+        </div>
+    </div>
+
+    <!-- Backup History -->
+    <div class="card">
+        <div class="card-header">
+            <h3><i class="fas fa-history"></i> Backup History & Restore</h3>
+        </div>
+        <div class="card-body">
+            <div class="table-container">
+            <table class="table">
+                <thead>
+                    <tr>
+                        <th>Date</th>
+                        <th>Filename</th>
+                        <th>Size</th>
+                        <th>Type</th>
+                        <th>Actions</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    {% for b in backups %}
+                    <tr>
+                        <td>{{ b.created_at.strftime('%Y-%m-%d %H:%M') if b.created_at else '—' }}</td>
+                        <td style="max-width: 200px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;" title="{{ b.filename }}">{{ b.filename }}</td>
+                        <td>{{ (b.size_bytes / 1024)|round(1) }} KB</td>
+                        <td><span class="badge badge-info">{{ b.backup_type }}</span></td>
+                        <td style="white-space: nowrap;">
+                            <a href="{{ url_for('admin.download_backup', backup_id=b.id) }}" class="btn btn-sm btn-primary" title="Download">
+                                <i class="fas fa-download"></i>
+                            </a>
+                            <form method="POST" action="{{ url_for('admin.restore_backup', backup_id=b.id) }}" class="inline-form"
+                                  data-confirm="Restore backup {{ b.filename }}? This will overwrite all current data. A safety backup will be made first.">
+                                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                                <button type="submit" class="btn btn-sm btn-warning" title="Restore">
+                                    <i class="fas fa-undo"></i>
+                                </button>
+                            </form>
+                            <form method="POST" action="{{ url_for('admin.delete_backup', backup_id=b.id) }}" class="inline-form"
+                                  data-confirm="Delete backup {{ b.filename }}?">
+                                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                                <button type="submit" class="btn btn-sm btn-danger" title="Delete">
+                                    <i class="fas fa-trash"></i>
+                                </button>
+                            </form>
+                        </td>
+                    </tr>
+                    {% else %}
+                    <tr>
+                        <td colspan="5" class="text-muted" style="font-size: 0.85rem;">No backups yet. Create your first backup above.</td>
+                    </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+            </div>
+        </div>
+    </div>
+</div>
+
+<!-- Audit Log -->
+<div class="card mt-4">
+    <div class="card-header">
+        <h3><i class="fas fa-clipboard-list"></i> Audit Log (Recent)</h3>
+    </div>
+    <div class="card-body">
+        <div class="table-container">
+        <table class="table">
+            <thead>
+                <tr>
+                    <th>Date</th>
+                    <th>User</th>
+                    <th>Action</th>
+                    <th>Details</th>
+                    <th>IP</th>
+                </tr>
+            </thead>
+            <tbody>
+                {% for entry in audit_logs %}
+                <tr>
+                    <td>{{ entry.created_at.strftime('%Y-%m-%d %H:%M') if entry.created_at else '—' }}</td>
+                    <td>{{ entry.user.username if entry.user else 'System' }}</td>
+                    <td><span class="badge badge-info">{{ entry.action }}</span></td>
+                    <td style="max-width: 250px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;">{{ entry.details or '—' }}</td>
+                    <td>{{ entry.ip_address or '—' }}</td>
+                </tr>
+                {% else %}
+                <tr>
+                    <td colspan="5" class="text-muted" style="font-size: 0.85rem;">No audit log entries yet.</td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        </div>
+    </div>
+</div>
+
+{% endblock %}

app/templates/pages/admin_document_detail.html

@@ -0,0 +1,134 @@
+{% extends "layouts/base.html" %}
+{% block title %}{{ document.title }} - Admin{% endblock %}
+{% block page_title %}{{ document.title }}{% endblock %}
+{% block breadcrumb %}<span class="breadcrumb">Home / <a href="{{ url_for('admin.dashboard') }}">Admin</a> / <a href="{{ url_for('admin.documents') }}">{{ _('Documents') }}</a> / {{ document.title }}</span>{% endblock %}
+
+{% block content %}
+{% set kind_labels = {
+  'player': _('Player contract'),
+  'coach': _('Coach contract'),
+  'manager': _('Manager contract'),
+  'team': _('Team agreement'),
+  'code_of_conduct': _('Code of conduct'),
+  'ethics_code': _('Ethics code'),
+} %}
+
+<div class="card">
+    <div class="card-header">
+        <h3><i class="fas fa-file-upload"></i> {{ _('Publish a new version') }}</h3>
+    </div>
+    <div class="card-body">
+        <p class="text-muted">
+            {{ _('Type') }}: <strong>{{ kind_labels.get(document.kind, document.kind) }}</strong>
+            {% if document.requires_signature %} · {{ _('signed by the member') }}
+            {% else %} · {{ _('acknowledged by the member') }}{% endif %}
+        </p>
+        <form method="POST" action="{{ url_for('admin.publish_document_version', doc_id=document.id) }}" enctype="multipart/form-data" class="form">
+            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+            <div class="form-group">
+                <label for="version_file">{{ _('New version file (PDF)') }}</label>
+                <input type="file" id="version_file" name="version_file" accept=".pdf" required>
+                <small class="form-text text-muted">{{ _('Accepted format: PDF') }}</small>
+            </div>
+            <div class="form-group">
+                <label for="notes">{{ _('Version notes (optional)') }}</label>
+                <textarea id="notes" name="notes" rows="2" placeholder="{{ _('What changed in this version?') }}"></textarea>
+            </div>
+            <div class="form-actions">
+                <a href="{{ url_for('admin.documents') }}" class="btn btn-secondary">{{ _('Back') }}</a>
+                <button type="submit" class="btn btn-primary">
+                    <i class="fas fa-upload"></i> {{ _('Publish version') }}
+                </button>
+            </div>
+        </form>
+    </div>
+</div>
+
+<div class="card mt-4">
+    <div class="card-header">
+        <h3><i class="fas fa-history"></i> {{ _('Versions') }}</h3>
+    </div>
+    <div class="card-body">
+        <div class="table-container">
+            <table class="table">
+                <thead>
+                    <tr>
+                        <th>{{ _('Version') }}</th>
+                        <th>{{ _('File') }}</th>
+                        <th>{{ _('Notes') }}</th>
+                        <th>{{ _('Published') }}</th>
+                        <th>{{ _('Actions') }}</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    {% for version in versions %}
+                    <tr>
+                        <td>
+                            {{ _('v%(number)s', number=version.version) }}
+                            {% if document.current_version_id == version.id %}
+                            <span class="badge badge-success">{{ _('Current') }}</span>{% endif %}
+                        </td>
+                        <td>{{ version.original_filename }}</td>
+                        <td>{{ version.notes or '—' }}</td>
+                        <td>{{ version.published_at.strftime('%Y-%m-%d %H:%M') if version.published_at else '—' }}</td>
+                        <td>
+                            <a href="{{ url_for('admin.download_document_version', version_id=version.id) }}" class="btn btn-sm btn-primary" title="{{ _('Download') }}">
+                                <i class="fas fa-download"></i>
+                            </a>
+                        </td>
+                    </tr>
+                    {% else %}
+                    <tr>
+                        <td colspan="5" class="text-muted">{{ _('No versions published yet.') }}</td>
+                    </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+        </div>
+    </div>
+</div>
+
+<div class="card mt-4">
+    <div class="card-header">
+        <h3><i class="fas fa-list-check"></i> {{ _('Completion') }}</h3>
+    </div>
+    <div class="card-body">
+        <div class="table-container">
+            <table class="table">
+                <thead>
+                    <tr>
+                        <th>{{ _('Member') }}</th>
+                        <th>{{ _('Role') }}</th>
+                        <th>{{ _('Status') }}</th>
+                        <th>{{ _('Completed at') }}</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    {% for assignment, user in assignments %}
+                    <tr>
+                        <td>{{ user.username }}</td>
+                        <td>{{ user.role | capitalize }}</td>
+                        <td>
+                            {% if assignment.status == 'signed' %}
+                            <span class="badge badge-success">{{ _('Signed') }}</span>
+                            {% elif assignment.status == 'acknowledged' %}
+                            <span class="badge badge-success">{{ _('Acknowledged') }}</span>
+                            {% else %}
+                            <span class="badge badge-warning">{{ _('Pending') }}</span>
+                            {% endif %}
+                        </td>
+                        <td>{{ assignment.completed_at.strftime('%Y-%m-%d %H:%M') if assignment.completed_at else '—' }}</td>
+                    </tr>
+                    {% else %}
+                    <tr>
+                        <td colspan="4" class="text-muted">
+                            {{ _('No one is assigned yet. Publish a version first.') }}
+                        </td>
+                    </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+        </div>
+    </div>
+</div>
+{% endblock %}

app/templates/pages/admin_documents.html

@@ -0,0 +1,118 @@
+{% extends "layouts/base.html" %}
+{% block title %}{{ _('Documents') }} - Admin{% endblock %}
+{% block page_title %}{{ _('Document management') }}{% endblock %}
+{% block breadcrumb %}<span class="breadcrumb">Home / <a href="{{ url_for('admin.dashboard') }}">Admin</a> / {{ _('Documents') }}</span>{% endblock %}
+
+{% block content %}
+{% set kind_labels = {
+  'player': _('Player contract'),
+  'coach': _('Coach contract'),
+  'manager': _('Manager contract'),
+  'team': _('Team agreement'),
+  'code_of_conduct': _('Code of conduct'),
+  'ethics_code': _('Ethics code'),
+} %}
+
+<div class="card">
+    <div class="card-header">
+        <h3><i class="fas fa-plus-circle"></i> {{ _('Create a document') }}</h3>
+    </div>
+    <div class="card-body">
+        <form method="POST" data-ajax action="{{ url_for('admin.create_document') }}" class="form">
+            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+            <div class="form-group">
+                <label for="title">{{ _('Title') }}</label>
+                <input type="text" id="title" name="title" class="form-control" required
+                       placeholder="{{ _('e.g. Player contract 2026-2027') }}">
+            </div>
+            <div class="form-group">
+                <label for="kind">{{ _('Type') }}</label>
+                <select id="kind" name="kind" class="form-select" required>
+                    <option value="">{{ _('-- Select a type --') }}</option>
+                    {% for kind in kinds %}
+                    <option value="{{ kind }}">{{ kind_labels.get(kind, kind) }}</option>
+                    {% endfor %}
+                </select>
+                <small class="form-text text-muted">
+                    {{ _('The type decides who must complete the document and how.') }}
+                </small>
+            </div>
+            <div class="form-actions">
+                <button type="submit" class="btn btn-primary">
+                    <i class="fas fa-plus"></i> {{ _('Create document') }}
+                </button>
+            </div>
+        </form>
+    </div>
+</div>
+
+<div class="card mt-4">
+    <div class="card-header">
+        <h3><i class="fas fa-file-contract"></i> {{ _('Existing documents') }}</h3>
+    </div>
+    <div class="card-body">
+        <div class="table-container">
+            <table class="table">
+                <thead>
+                    <tr>
+                        <th>{{ _('Title') }}</th>
+                        <th>{{ _('Type') }}</th>
+                        <th>{{ _('Version') }}</th>
+                        <th>{{ _('Availability') }}</th>
+                        <th>{{ _('Progress') }}</th>
+                        <th>{{ _('Actions') }}</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    {% for document in documents %}
+                    <tr>
+                        <td><a href="{{ url_for('admin.document_detail', doc_id=document.id) }}">{{ document.title }}</a></td>
+                        <td>{{ kind_labels.get(document.kind, document.kind) }}</td>
+                        <td>
+                            {% if document.current_version %}
+                                {{ _('v%(number)s', number=document.current_version.version) }}
+                            {% else %}{{ _('None') }}{% endif %}
+                        </td>
+                        <td>
+                            {% if document.is_published %}
+                            <span class="badge badge-success">{{ _('Downloadable') }}</span>
+                            {% else %}
+                            <span class="badge badge-secondary">{{ _('Hidden') }}</span>
+                            {% endif %}
+                        </td>
+                        <td>
+                            {% set completed, pending = document.completion_counts() %}
+                            <span class="badge badge-info">{{ _('%(completed)s done', completed=completed) }}</span>
+                            <span class="badge badge-warning">{{ _('%(pending)s pending', pending=pending) }}</span>
+                        </td>
+                        <td>
+                            <div class="btn-group">
+                                <a href="{{ url_for('admin.document_detail', doc_id=document.id) }}" class="btn btn-sm btn-primary" title="{{ _('Manage') }}">
+                                    <i class="fas fa-cog"></i> {{ _('Manage') }}
+                                </a>
+                                <form method="POST" data-ajax action="{{ url_for('admin.toggle_document_published', doc_id=document.id) }}" class="inline-form">
+                                    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                                    {% if document.is_published %}
+                                    <button type="submit" class="btn btn-sm btn-secondary" title="{{ _('Hide') }}">
+                                        <i class="fas fa-eye-slash"></i> {{ _('Hide') }}
+                                    </button>
+                                    {% else %}
+                                    <button type="submit" class="btn btn-sm btn-success" title="{{ _('Make downloadable') }}">
+                                        <i class="fas fa-eye"></i> {{ _('Publish') }}
+                                    </button>
+                                    {% endif %}
+                                </form>
+                            </div>
+                        </td>
+                    </tr>
+                    {% else %}
+                    <tr>
+                        <td colspan="6" class="text-muted">{{ _('No documents yet. Create one above.') }}</td>
+                    </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+        </div>
+    </div>
+</div>
+{% endblock %}

app/templates/pages/batch_evaluate.html

@@ -4,7 +4,7 @@
 {% block breadcrumb %}<span class="breadcrumb">Home / <a href="{{ url_for('tryouts.view_tryout', tryout_id=tryout.id) }}">{{ tryout.title }}</a> / Evaluate</span>{% endblock %}
 
 {% block content %}
-<form method="POST" action="{{ url_for('evaluations.batch_evaluate', tryout_id=tryout.id) }}" class="form batch-eval-form">
+<form method="POST" data-ajax action="{{ url_for('evaluations.batch_evaluate', tryout_id=tryout.id) }}" class="form batch-eval-form">
     <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
     {% for entry in players %}
     <input type="hidden" name="player_ids" value="{{ entry.player.id }}"/>

app/templates/pages/calendar.html

@@ -137,12 +137,18 @@ document.addEventListener('DOMContentLoaded', function() {
         headerToolbar: {
             left: 'prev,next today',
             center: 'title',
-            right: 'dayGridMonth,timeGridWeek,timeGridDay,listMonth'
+            right: ''
         },
         events: '/matches/api/events',
         eventClick: function(info) {
             showEventModal(info.event);
         },
+        eventClassNames: function(arg) {
+            return [eventClassName(arg.event)];
+        },
+        eventContent: function(arg) {
+            return renderEventContent(arg);
+        },
         dateClick: function(info) {
             if (canScheduleMatches) {
                 var dateStr = info.dateStr;
@@ -158,7 +164,11 @@ document.addEventListener('DOMContentLoaded', function() {
             }
         },
         slotMinTime: '12:00:00',
-        slotMaxTime: '24:00:00'
+        slotMaxTime: '24:00:00',
+        slotEventOverlap: true,
+        dayMaxEvents: false,
+        nowIndicator: true,
+        height: 'auto'
     });
     calendar.render();
     
@@ -177,6 +187,41 @@ function changeView(viewName) {
     }
 }
 
+function eventClassName(event) {
+    var props = event.extendedProps || {};
+    if (props.type === 'team_match') { return 'fc-event--team-match'; }
+    if (props.type === 'one_on_one') { return 'fc-event--one-on-one'; }
+    return props.match_type === 'team_vs_team' ? 'fc-event--team' : 'fc-event--scrim';
+}
+
+function eventIcon(type, matchType) {
+    if (type === 'team_match') { return 'fa-trophy'; }
+    if (type === 'one_on_one') { return 'fa-user-friends'; }
+    if (matchType === 'team_vs_team') { return 'fa-shield-alt'; }
+    if (matchType === 'player_vs_player') { return 'fa-users'; }
+    return 'fa-gamepad';
+}
+
+function renderEventContent(arg) {
+    // Built with DOM nodes + textContent: the title comes from a JSON endpoint
+    // and has never been HTML-escaped, so it must not reach innerHTML.
+    var props = arg.event.extendedProps || {};
+    var wrap = makeEl('div', 'fc-event-body');
+
+    var icon = makeEl('i', 'fas ' + eventIcon(props.type, props.match_type));
+    icon.setAttribute('aria-hidden', 'true');
+    wrap.appendChild(icon);
+
+    var text = makeEl('span', 'fc-event-text');
+    if (!arg.event.allDay && arg.timeText && arg.view.type.indexOf('dayGrid') === 0) {
+        text.appendChild(makeEl('span', 'fc-event-time', arg.timeText));
+    }
+    text.appendChild(makeEl('span', 'fc-event-title', arg.event.title));
+    wrap.appendChild(text);
+
+    return { domNodes: [wrap] };
+}
+
 // --- Create Event Modal ---
 function showCreateEventModal(dateStr) {
     document.getElementById('createEventDate').textContent = dateStr;
@@ -346,6 +391,14 @@ function showEventModal(event) {
         grid.appendChild(detailItem('Teams', buildTeamsNode(props), true));
     }
 
+    // Team match details
+    if (type === 'team_match') {
+        grid.appendChild(detailItem('Team', document.createTextNode(props.org_team || 'Team')));
+        if (props.opponent) {
+            grid.appendChild(detailItem('Opponent', document.createTextNode(props.opponent)));
+        }
+    }
+
     if (props.description) {
         grid.appendChild(detailItem('Description', multilineNode(props.description), true));
     }

app/templates/pages/coach_availability.html

@@ -1,248 +0,0 @@
-{% extends "layouts/base.html" %}
-{% block title %}{{ _('Manage Availability') }} - UdeS team manager{% endblock %}
-{% block page_title %}{{ _('Manage Availability') }}{% endblock %}
-{% block breadcrumb %}<span class="breadcrumb">Home / Coach Availability</span>{% endblock %}
-
-{% block content %}
-<div class="card">
-    <div class="card-header">
-        <h3><i class="fas fa-clock"></i> {{ _('Set Your Weekly Availability') }}</h3>
-        <p class="text-muted small">{{ _('Select time slots when you\'re available for One on One sessions') }}</p>
-    </div>
-    <div class="card-body">
-        <div class="availability-grid" id="availability-grid">
-            <p class="text-muted">{{ _('Loading availability grid...') }}</p>
-        </div>
-        
-        <div class="form-actions mt-4">
-            <button type="button" class="btn btn-primary" data-action="save-availability">
-                <i class="fas fa-save"></i> {{ _('Save Availability') }}
-            </button>
-            <button type="button" class="btn btn-secondary" data-action="clear-availability">
-                <i class="fas fa-trash"></i> {{ _('Clear All') }}
-            </button>
-        </div>
-    </div>
-</div>
-
-{% endblock %}
-
-{% block scripts %}
-<style>
-.availability-grid {
-    display: grid;
-    grid-template-columns: repeat(7, 1fr);
-    gap: 12px;
-    margin-top: 10px;
-}
-
-.day-column {
-    background: var(--bg-secondary);
-    border-radius: 8px;
-    padding: 10px;
-    min-height: 300px;
-}
-
-.day-header {
-    text-align: center;
-    font-weight: 600;
-    padding: 8px 0;
-    border-bottom: 1px solid var(--border-color);
-    margin-bottom: 10px;
-    color: var(--primary);
-}
-
-.time-slot {
-    padding: 6px 8px;
-    margin: 4px 0;
-    border-radius: 4px;
-    font-size: 0.8rem;
-    text-align: center;
-    cursor: pointer;
-    transition: var(--transition);
-    background: var(--bg-secondary);
-    border: 1px solid var(--border-color);
-}
-
-.time-slot:hover {
-    background: var(--primary-light);
-    border-color: var(--primary);
-}
-
-.time-slot.selected {
-    background: var(--primary);
-    color: white;
-    border-color: var(--primary-dark);
-}
-
-.time-slot.selected:hover {
-    background: var(--danger);
-}
-
-@media (max-width: 768px) {
-    .availability-grid {
-        grid-template-columns: repeat(3, 1fr);
-    }
-}
-
-@media (max-width: 480px) {
-    .availability-grid {
-        grid-template-columns: 1fr;
-    }
-}
-</style>
-<script nonce="{{ csp_nonce }}">
-// Time slots from 8:00 AM to 10:00 PM (30-minute intervals)
-const TIME_SLOTS = [];
-for (let h = 8; h <= 22; h++) {
-    for (let m = 0; m < 60; m += 30) {
-        const timeStr = (h < 10 ? '0' : '') + h + ':' + (m < 10 ? '0' : '') + m;
-        const displayHour = h > 12 ? h - 12 : h;
-        const displayAmpm = h >= 12 ? 'PM' : 'AM';
-        const displayTime = displayHour + ':' + (m < 10 ? '0' : '') + m + ' ' + displayAmpm;
-        TIME_SLOTS.push({ time: timeStr, display: displayTime });
-    }
-}
-
-// Day names
-const DAYS = ['Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday', 'Sunday'];
-
-// Track selected slots: {day_of_week: [time_strings]}
-let selectedSlots = {};
-
-// Initialize
-document.addEventListener('DOMContentLoaded', function() {
-    loadExistingAvailability();
-    renderGrid();
-});
-
-function loadExistingAvailability() {
-    // Load from existing data
-    {% for av in existing_availability %}
-    if (!selectedSlots[{{ av.day_of_week }}]) {
-        selectedSlots[{{ av.day_of_week }}] = [];
-    }
-    selectedSlots[{{ av.day_of_week }}].push('{{ av.start_time.strftime('%H:%M') }}');
-    {% endfor %}
-}
-
-function renderGrid() {
-    const grid = document.getElementById('availability-grid');
-    let html = '';
-    
-    DAYS.forEach((day, dayIndex) => {
-        html += '<div class="day-column">';
-        html += '<div class="day-header">' + day.substring(0, 3) + '</div>';
-        
-        TIME_SLOTS.forEach(slot => {
-            const isSelected = selectedSlots[dayIndex] && selectedSlots[dayIndex].includes(slot.time);
-            const cssClass = isSelected ? 'time-slot selected' : 'time-slot';
-            html += '<div class="' + cssClass + '" data-day="' + dayIndex + '" data-time="' + slot.time + '" data-action="toggle-slot">' + slot.display + '</div>';
-        });
-        
-        html += '</div>';
-    });
-    
-    grid.innerHTML = html;
-}
-
-function toggleSlot(element) {
-    const dayOfWeek = Number(element.getAttribute('data-day'));
-    const timeStr = element.getAttribute('data-time');
-    if (!selectedSlots[dayOfWeek]) {
-        selectedSlots[dayOfWeek] = [];
-    }
-    
-    const index = selectedSlots[dayOfWeek].indexOf(timeStr);
-    if (index === -1) {
-        selectedSlots[dayOfWeek].push(timeStr);
-        element.classList.add('selected');
-    } else {
-        selectedSlots[dayOfWeek].splice(index, 1);
-        element.classList.remove('selected');
-    }
-}
-
-function saveAvailability() {
-    const slots = [];
-    for (let day in selectedSlots) {
-        selectedSlots[day].forEach(time => {
-            slots.push({ day_of_week: parseInt(day), start_time: time });
-        });
-    }
-    
-    fetch('{{ url_for("users.manage_coach_availability") }}', {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            'X-CSRFToken': '{{ csrf_token() }}'
-        },
-        body: JSON.stringify({ slots: slots })
-    })
-    .then(response => response.json())
-    .then(data => {
-        if (data.success) {
-            flash('Availability saved!', 'success');
-        } else {
-            flash(data.error || 'Error saving availability.', 'danger');
-        }
-    })
-    .catch(function(error) {
-        console.error('Save error:', error);
-        flash('Error saving availability.', 'danger');
-    });
-}
-
-function clearAllAvailability() {
-    if (!confirm('Are you sure you want to clear all your availability slots?')) {
-        return;
-    }
-    
-    fetch('{{ url_for("users.clear_coach_availability") }}', {
-        method: 'POST',
-        headers: { 'X-CSRFToken': '{{ csrf_token() }}' }
-    })
-    .then(response => response.json())
-    .then(data => {
-        if (data.success) {
-            selectedSlots = {};
-            renderGrid();
-            flash('Availability cleared!', 'success');
-        }
-    });
-}
-
-function flash(message, type) {
-    const flashContainer = document.querySelector('.flash-messages');
-    const alert = document.createElement('div');
-    alert.className = 'alert alert-' + type + ' alert-dismissible';
-    const text = document.createElement('span');
-    text.textContent = message;
-    const close = document.createElement('button');
-    close.type = 'button';
-    close.className = 'alert-close';
-    close.dataset.action = 'remove-element';
-    close.textContent = '×';
-    alert.append(text, close);
-    flashContainer.appendChild(alert);
-}
-
-// Auto-save on change (debounced)
-let saveTimeout;
-document.addEventListener('click', function(e) {
-    if (e.target.classList.contains('time-slot')) {
-        clearTimeout(saveTimeout);
-        saveTimeout = setTimeout(saveAvailability, 1000);
-    }
-});
-
-// Behaviours are declared in the markup with data-action / data-change and
-// dispatched by the delegated listener in main.js. This replaces inline
-// onclick attributes, which no CSP nonce is able to authorise.
-registerActions({
-    'save-availability': saveAvailability,
-    'clear-availability': clearAllAvailability,
-    'toggle-slot': toggleSlot,
-});
-</script>
-{% endblock %}

app/templates/pages/contracts.html

@@ -94,8 +94,8 @@
                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                 <div class="form-group">
                     <label for="signed_file">{{ _('Select Signed Contract File') }}</label>
-                    <input type="file" id="signed_file" name="signed_file" accept=".pdf,.doc,.docx,.jpg,.jpeg,.png" required>
-                    <small class="form-text text-muted">{{ _('Accepted formats: PDF, DOC, DOCX, JPG, PNG') }}</small>
+                    <input type="file" id="signed_file" name="signed_file" accept=".pdf" required>
+                    <small class="form-text text-muted">{{ _('Accepted format: PDF') }}</small>
                 </div>
                 <div class="form-actions">
                     <button type="button" class="btn btn-secondary" data-action="hide-upload-signed">{{ _('Cancel') }}</button>

app/templates/pages/evaluate_player.html

@@ -25,7 +25,7 @@
             </div>
             {% endif %}
 
-            <form method="POST" action="{{ url_for('evaluations.evaluate_player', tryout_id=tryout.id, player_id=player.id) }}" class="form">
+            <form method="POST" data-ajax action="{{ url_for('evaluations.evaluate_player', tryout_id=tryout.id, player_id=player.id) }}" class="form">
                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
 
                 <div class="form-row">

app/templates/pages/evaluations.html

@@ -5,7 +5,7 @@
 {% block breadcrumb %}<span class="breadcrumb">Home / Evaluations</span>{% endblock %}
 
 {% block content %}
-{% set sort_column = sort_column | default('created_at') %}
+{% set sort_column = sort_column | default('overall_score') %}
 {% set sort_order = sort_order | default('desc') %}
 
 {% macro sort_link(column, label) %}
@@ -22,76 +22,111 @@
 </th>
 {% endmacro %}
 
-{% if current_user.role == 'admin' and player_scores %}
-<div class="stats-grid mb-4">
-    {% for pid, data in player_scores.items() %}
-    <div class="stat-card stat-card-sm">
-        <div class="stat-icon bg-info">
-            <i class="fas fa-user"></i>
-        </div>
-        <div class="stat-info">
-<h3>{{ data.player.username[:12] }}</h3>
-            <p>Avg: <strong>{{ data.avg }}</strong> / {{ data.count }} evals</p>
-        </div>
-    </div>
-    {% endfor %}
+<div class="view-toggle mb-3">
+    <a href="{{ url_for('evaluations.list_evaluations') }}" class="btn btn-sm btn-primary">
+        <i class="fas fa-table"></i> {{ _('Table') }}
+    </a>
+    {% if first_player_id %}
+    <a href="{{ url_for('evaluations.player_evaluations', player_id=first_player_id) }}" class="btn btn-sm btn-outline">
+        <i class="fas fa-user"></i> {{ _('By player') }}
+    </a>
+    {% endif %}
 </div>
-{% endif %}
 
 <div class="card">
     <div class="card-header">
-        <h3><i class="fas fa-clipboard-list"></i>
-            {% if current_user.role == 'player' %}
-            My Evaluations
-            {% else %}
-            All Evaluations
-            {% endif %}
-        </h3>
+        <h3><i class="fas fa-clipboard-list"></i> {{ _('Player Evaluations') }}</h3>
     </div>
     <div class="card-body">
         <div class="table-container">
             <table class="table">
                 <thead>
                     <tr>
-                        {{ sort_link('tryout', 'Tryout') }}
+                        <th></th>
                         {{ sort_link('player', 'Player') }}
-                        {{ sort_link('evaluator', 'Evaluator') }}
-                        {{ sort_link('mecanics_score', 'Mecanics') }}
-                        {{ sort_link('cohesion_score', 'Cohesion') }}
-                        {{ sort_link('communication_score', 'Communication') }}
-                        {{ sort_link('gamesense_score', 'Gamesense') }}
-                        {{ sort_link('versatility_score', 'Versatility') }}
-                        {{ sort_link('discipline_score', 'Discipline') }}
-                        {{ sort_link('analysis_score', 'Analysis') }}
-                        {{ sort_link('sport_ethics_score', 'Sport Ethics') }}
-                        {{ sort_link('mental_score', 'Mental') }}
-                        {{ sort_link('overall_score', 'Overall') }}
-                        {{ sort_link('position_recommendation', 'Position') }}
-                        {{ sort_link('created_at', 'Date') }}
+                        {{ sort_link('overall_score', 'Average') }}
+                        {{ sort_link('count', 'Evaluations') }}
+                        <th>{{ _('Open') }}</th>
                     </tr>
                 </thead>
                 <tbody>
-                    {% for eval in evaluations %}
-                    <tr>
-                        <td>{{ eval.tryout.title if eval.tryout else 'Deleted Tryout' }}</td>
-<td>{{ eval.player.username if eval.player else 'Deleted Player' }}</td>
-<td>{{ eval.evaluator.username if eval.evaluator else 'Deleted Evaluator' }}</td>
-                        <td>{{ eval.mecanics_score or '-' }}</td>
-                        <td>{{ eval.cohesion_score or '-' }}</td>
-                        <td>{{ eval.communication_score or '-' }}</td>
-                        <td>{{ eval.gamesense_score or '-' }}</td>
-                        <td>{{ eval.versatility_score or '-' }}</td>
-                        <td>{{ eval.discipline_score or '-' }}</td>
-                        <td>{{ eval.analysis_score or '-' }}</td>
-                        <td>{{ eval.sport_ethics_score or '-' }}</td>
-                        <td>{{ eval.mental_score or '-' }}</td>
-                        <td><span class="score">{{ eval.overall_score or '-' }}</span></td>
-                        <td><span class="badge badge-info">{{ eval.position_recommendation or 'N/A' }}</span></td>
-                        <td>{{ eval.created_at.strftime('%m/%d/%Y') }}</td>
+                    {% for entry in players %}
+                    <tr class="eval-row" data-action="toggle-player-evals" data-target="evals-{{ entry.player.id }}">
+                        <td><i class="fas fa-chevron-right eval-chevron"></i></td>
+                        <td>
+                            <a href="{{ url_for('evaluations.player_evaluations', player_id=entry.player.id) }}" class="player-link">
+                                {{ entry.player.username }}
+                            </a>
+                        </td>
+                        <td><span class="score">{{ entry.avg | round(1) if entry.avg is not none else '-' }}</span></td>
+                        <td>{{ entry.count }}</td>
+                        <td>
+                            <a href="{{ url_for('evaluations.player_evaluations', player_id=entry.player.id) }}" class="btn btn-sm btn-outline" title="{{ _('Open player view') }}">
+                                <i class="fas fa-external-link-alt"></i>
+                            </a>
+                        </td>
+                    </tr>
+                    <tr class="eval-detail hidden" id="evals-{{ entry.player.id }}">
+                        <td colspan="5">
+                            <div class="eval-detail-inner">
+                                <table class="table table-sm">
+                                    <thead>
+                                        <tr>
+                                            <th>{{ _('Evaluator') }}</th>
+                                            <th>{{ _('Tryout') }}</th>
+                                            {% for field, label in evaluation_criteria %}
+                                            <th>{{ label }}</th>
+                                            {% endfor %}
+                                            <th>{{ _('Overall') }}</th>
+                                            <th>{{ _('Position') }}</th>
+                                            <th>{{ _('Date') }}</th>
+                                        </tr>
+                                    </thead>
+                                    <tbody>
+                                        {% for ev in entry.evaluations %}
+                                        <tr>
+                                            <td>{{ ev.evaluator.username if ev.evaluator else _('Deleted evaluator') }}</td>
+                                            <td>{{ ev.tryout.title if ev.tryout else _('Deleted tryout') }}</td>
+                                            {% for score in ev.scores %}
+                                            <td>{{ score if score is not none else '-' }}</td>
+                                            {% endfor %}
+                                            <td><span class="score">{{ ev.overall | round(1) if ev.overall is not none else '-' }}</span></td>
+                                            <td>{{ ev.position or '-' }}</td>
+                                            <td>{{ ev.date.strftime('%m/%d/%Y') if ev.date else '-' }}</td>
+                                        </tr>
+                                        {% else %}
+                                        <tr>
+                                            <td colspan="{{ evaluation_criteria | length + 5 }}" class="text-center">{{ _('No evaluations for this player.') }}</td>
+                                        </tr>
+                                        {% endfor %}
+                                    </tbody>
+                                </table>
+
+                                {% if entry.evaluations %}
+                                {% set comment_evals = entry.evaluations | selectattr('comment') | list %}
+                                <div class="eval-comments">
+                                    <h4 class="eval-comments-title"><i class="fas fa-comments"></i> {{ _('Comments') }}</h4>
+                                    {% if comment_evals %}
+                                    {% for ev in comment_evals %}
+                                    <article class="eval-comment">
+                                        <p class="eval-comment-text">{{ ev.comment }}</p>
+                                        <footer class="eval-comment-meta">
+                                            <span class="eval-comment-author">{{ _('Evaluator') }}&nbsp;: <strong>{{ ev.evaluator.username if ev.evaluator else _('Deleted evaluator') }}</strong></span>
+                                            <span class="eval-comment-context">{{ ev.tryout.title if ev.tryout else _('Deleted tryout') }} &middot; {{ ev.date.strftime('%m/%d/%Y') if ev.date else '-' }}</span>
+                                        </footer>
+                                    </article>
+                                    {% endfor %}
+                                    {% else %}
+                                    <p class="eval-comments-empty">{{ _('No comments') }}</p>
+                                    {% endif %}
+                                </div>
+                                {% endif %}
+                            </div>
+                        </td>
                     </tr>
                     {% else %}
                     <tr>
-                        <td colspan="15" class="text-center">
+                        <td colspan="5" class="text-center">
                             <div class="empty-state">
                                 <i class="fas fa-clipboard"></i>
                                 <h3>{{ _('No evaluations yet') }}</h3>
@@ -106,3 +141,36 @@
     </div>
 </div>
 {% endblock %}
+
+{% block scripts %}
+<style>
+.view-toggle { display: flex; gap: 8px; }
+.eval-row { cursor: pointer; }
+.eval-chevron { transition: transform 0.15s ease; font-size: 0.75rem; }
+.eval-detail-inner { padding: 8px 4px; }
+.eval-detail-inner .table { margin-bottom: 0; }
+.player-nav { display: flex; gap: 8px; align-items: center; }
+.is-disabled { opacity: 0.5; pointer-events: none; }
+</style>
+<script nonce="{{ csp_nonce }}">
+function togglePlayerEvals(element, event) {
+    if (event.target.closest('a')) {
+        return;
+    }
+    var detail = document.getElementById(element.getAttribute('data-target'));
+    if (!detail) {
+        return;
+    }
+    var chevron = element.querySelector('.eval-chevron');
+    var isHidden = detail.classList.contains('hidden');
+    if (isHidden) {
+        detail.classList.remove('hidden');
+        if (chevron) chevron.classList.add('fa-rotate-90');
+    } else {
+        detail.classList.add('hidden');
+        if (chevron) chevron.classList.remove('fa-rotate-90');
+    }
+}
+registerActions({ 'toggle-player-evals': togglePlayerEvals });
+</script>
+{% endblock %}

app/templates/pages/match_form.html

@@ -22,7 +22,7 @@
         {% endif %}
     </div>
     <div class="card-body">
-        <form method="POST" action="{% if match %}{{ url_for('matches.edit_match', match_id=match.id) }}{% elif is_practice %}{{ url_for('team_matches.create_match', team_id=team_id) }}{% else %}{{ url_for('matches.create_match', tryout_id=tryout.id) }}{% endif %}" class="form" id="matchForm">
+        <form method="POST" data-ajax action="{% if match %}{{ url_for('matches.edit_match', match_id=match.id) }}{% elif is_practice %}{{ url_for('team_matches.create_match', team_id=team_id) }}{% else %}{{ url_for('matches.create_match', tryout_id=tryout.id) }}{% endif %}" class="form" id="matchForm">
             <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
             {% if is_practice %}
             <input type="hidden" name="title" value="Practice">

app/templates/pages/my_documents.html

@@ -0,0 +1,173 @@
+{% extends "layouts/base.html" %}
+{% block title %}{{ _('My Documents') }} - UdeS team manager{% endblock %}
+{% block page_title %}{{ _('My Documents') }}{% endblock %}
+{% block breadcrumb %}<span class="breadcrumb">Home / <a href="{{ url_for('users.profile') }}">Profile</a> / {{ _('My Documents') }}</span>{% endblock %}
+
+{% block content %}
+{% set kind_labels = {
+  'player': _('Player contract'),
+  'coach': _('Coach contract'),
+  'manager': _('Manager contract'),
+  'team': _('Team agreement'),
+  'code_of_conduct': _('Code of conduct'),
+  'ethics_code': _('Ethics code'),
+} %}
+
+<div class="card">
+    <div class="card-header">
+        <h3><i class="fas fa-file-contract"></i> {{ _('Documents to sign or acknowledge') }}</h3>
+    </div>
+    <div class="card-body">
+        {% if documents %}
+        <div class="table-container">
+            <table class="table">
+                <thead>
+                    <tr>
+                        <th>{{ _('Document') }}</th>
+                        <th>{{ _('Type') }}</th>
+                        <th>{{ _('Version') }}</th>
+                        <th>{{ _('Status') }}</th>
+                        <th>{{ _('Actions') }}</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    {% for entry in documents %}
+                    <tr>
+                        <td>{{ entry.document.title }}</td>
+                        <td>{{ kind_labels.get(entry.document.kind, entry.document.kind) }}</td>
+                        <td>
+                            {% if entry.document.current_version %}
+                                {{ _('Version %(number)s', number=entry.document.current_version.version) }}
+                            {% else %}—{% endif %}
+                        </td>
+                        <td>
+                            {% set assignment = entry.assignment %}
+                            {% if assignment is not none and assignment.status == 'signed' %}
+                            <span class="badge badge-success">{{ _('Signed') }}</span>
+                            {% elif assignment is not none and assignment.status == 'acknowledged' %}
+                            <span class="badge badge-success">{{ _('Acknowledged') }}</span>
+                            {% else %}
+                            <span class="badge badge-warning">{{ _('Pending') }}</span>
+                            {% endif %}
+                        </td>
+                        <td>
+                            <div class="btn-group">
+                                {% if entry.document.current_version %}
+                                <a href="{{ url_for('users.download_document', version_id=entry.document.current_version.id) }}" class="btn btn-sm btn-primary" title="{{ _('Download') }}">
+                                    <i class="fas fa-download"></i> {{ _('Download') }}
+                                </a>
+                                {% endif %}
+                                {% if assignment is not none and assignment.status == 'pending' %}
+                                    {% if entry.document.requires_signature %}
+                                    <button class="btn btn-sm btn-warning" data-action="show-sign-document" data-assignment-id="{{ assignment.id }}" title="{{ _('Return signed') }}">
+                                        <i class="fas fa-upload"></i> {{ _('Sign') }}
+                                    </button>
+                                    {% else %}
+                                    <form method="POST" data-ajax action="{{ url_for('users.acknowledge_document', assignment_id=assignment.id) }}" class="inline-form">
+                                        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                                        <button type="submit" class="btn btn-sm btn-success" data-confirm="{{ _('Confirm that you have read and understood this document') }}">
+                                            <i class="fas fa-check"></i> {{ _('Acknowledge') }}
+                                        </button>
+                                    </form>
+                                    {% endif %}
+                                {% endif %}
+                            </div>
+                        </td>
+                    </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+        </div>
+        {% elif not teams_progress %}
+        <div class="empty-state">
+            <i class="fas fa-file-contract"></i>
+            <h4>{{ _('No documents for now') }}</h4>
+            <p>{{ _('Nothing has been published for you yet. Check back later.') }}</p>
+        </div>
+        {% endif %}
+    </div>
+</div>
+
+{% if teams_progress %}
+{% for block in teams_progress %}
+<div class="card mt-4">
+    <div class="card-header">
+        <h3><i class="fas fa-users"></i> {{ _('Team progress') }} — {{ block.team.name }}</h3>
+    </div>
+    <div class="card-body">
+        <div class="table-container">
+            <table class="table">
+                <thead>
+                    <tr>
+                        <th>{{ _('Member') }}</th>
+                        <th>{{ _('Role') }}</th>
+                        {% for doc in block.documents %}<th>{{ doc.title }}</th>{% endfor %}
+                    </tr>
+                </thead>
+                <tbody>
+                    {% for member in block.members %}
+                    <tr>
+                        <td>{{ member.user.username }}</td>
+                        <td>{{ member.user.role | capitalize }}</td>
+                        {% for doc in block.documents %}
+                        {% set status = member.statuses.get(doc.id) %}
+                        <td>
+                            {% if status == 'signed' %}<span class="badge badge-success">{{ _('Signed') }}</span>
+                            {% elif status == 'acknowledged' %}<span class="badge badge-success">{{ _('Acknowledged') }}</span>
+                            {% elif status == 'pending' %}<span class="badge badge-warning">{{ _('Pending') }}</span>
+                            {% else %}<span class="text-muted">{{ _('Not required') }}</span>{% endif %}
+                        </td>
+                        {% endfor %}
+                    </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+        </div>
+    </div>
+</div>
+{% endfor %}
+{% endif %}
+
+<!-- Upload signed document modal -->
+<div id="signDocumentModal" class="modal hidden">
+    <div class="modal-backdrop" data-action="hide-sign-document"></div>
+    <div class="modal-content">
+        <div class="modal-header">
+            <h3>{{ _('Upload Signed Document') }}</h3>
+            <button class="modal-close" data-action="hide-sign-document">&times;</button>
+        </div>
+        <div class="modal-body">
+            <form id="signDocumentForm" method="POST" enctype="multipart/form-data" class="form">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                <div class="form-group">
+                    <label for="signed_file">{{ _('Select Signed Document File') }}</label>
+                    <input type="file" id="signed_file" name="signed_file" accept=".pdf" required>
+                    <small class="form-text text-muted">{{ _('Accepted format: PDF') }}</small>
+                </div>
+                <div class="form-actions">
+                    <button type="button" class="btn btn-secondary" data-action="hide-sign-document">{{ _('Cancel') }}</button>
+                    <button type="submit" class="btn btn-primary">{{ _('Upload Signed Document') }}</button>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>
+
+<script nonce="{{ csp_nonce }}">
+function showSignDocumentForm(assignmentId) {
+    document.getElementById('signDocumentForm').action = '/users/documents/assignments/' + assignmentId + '/sign';
+    document.getElementById('signDocumentModal').classList.remove('hidden');
+}
+
+function hideSignDocumentForm() {
+    document.getElementById('signDocumentModal').classList.add('hidden');
+}
+
+registerActions({
+    'show-sign-document': function (element) {
+        showSignDocumentForm(element.getAttribute('data-assignment-id'));
+    },
+    'hide-sign-document': hideSignDocumentForm,
+});
+</script>
+{% endblock %}

app/templates/pages/my_teams.html

@@ -192,7 +192,7 @@ function togglePresence(btn) {
             btn.classList.add('btn-outline');
             btn.innerHTML = 'Confirm';
         }
-        location.reload();
+        window.TT.refreshPage(window.location.pathname);
     })
     .catch(function(error) {
         console.error('Error:', error);

app/templates/pages/notes.html

@@ -13,7 +13,7 @@
             <span class="badge badge-esport">{{ org_team.name }}</span>
         </div>
         <div class="card-body">
-            <form method="POST" action="{{ url_for('users.manage_team_notes') }}" class="form" id="teamNotesForm">
+            <form method="POST" data-ajax action="{{ url_for('users.manage_team_notes') }}" class="form" id="teamNotesForm">
                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                 
                 <div class="form-group">
@@ -41,7 +41,7 @@
             {% endif %}
         </div>
         <div class="card-body">
-            <form method="POST" action="{{ url_for('users.add_personal_note') }}" class="form" id="personalNoteForm">
+            <form method="POST" data-ajax action="{{ url_for('users.add_personal_note') }}" class="form" id="personalNoteForm">
                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                 
                 <div class="form-group">
@@ -145,7 +145,7 @@
                         </td>
                         <td>
                             {% if req.status == 'pending' %}
-                            <form method="POST" action="{{ url_for('users.accept_one_on_one', request_id=req.id) }}" style="display:inline;">
+                            <form method="POST" data-ajax action="{{ url_for('users.accept_one_on_one', request_id=req.id) }}" style="display:inline;">
                                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                                 <button type="submit" class="btn btn-sm btn-success" title="{{ _('Accept') }}">
                                     <i class="fas fa-check"></i> {{ _('Accept') }}
@@ -177,7 +177,7 @@
             <h4><i class="fas fa-times-circle"></i> {{ _('Reject One on One Request') }}</h4>
             <button type="button" class="modal-close" data-action="hide-reject-modal">&times;</button>
         </div>
-        <form id="rejectForm" method="POST" action="">
+        <form id="rejectForm" method="POST" data-ajax action="">
             <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
             <div class="modal-body">
                 <div class="form-group">

app/templates/pages/one_on_one.html

@@ -124,7 +124,7 @@
         </div>
         <div class="card-body">
             {% if coach %}
-            <form method="POST" action="{{ url_for('users.one_on_one') }}" class="form" id="oneOnOneForm">
+            <form method="POST" data-ajax action="{{ url_for('users.one_on_one') }}" class="form" id="oneOnOneForm">
                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                 
                 <div class="form-row">

app/templates/pages/personal_notes.html

@@ -12,7 +12,7 @@
         {% endif %}
     </div>
     <div class="card-body">
-        <form method="POST" action="{{ url_for('users.manage_personal_notes') }}" class="form">
+        <form method="POST" data-ajax action="{{ url_for('users.manage_personal_notes') }}" class="form">
             <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
             
             <div class="form-group">

app/templates/pages/player_evaluations.html

@@ -0,0 +1,134 @@
+{% extends "layouts/base.html" %}
+{% block title %}{{ player.username }} - {{ _('Evaluations') }} - UdeS team manager{% endblock %}
+{% block page_title %}{{ _('Player Evaluations') }}{% endblock %}
+{% block breadcrumb %}<span class="breadcrumb">Home / <a href="{{ url_for('evaluations.list_evaluations') }}">{{ _('Evaluations') }}</a> / {{ player.username }}</span>{% endblock %}
+
+{% block content %}
+<div class="view-toggle mb-3">
+    <a href="{{ url_for('evaluations.list_evaluations') }}" class="btn btn-sm btn-outline">
+        <i class="fas fa-table"></i> {{ _('Table') }}
+    </a>
+    <a href="{{ url_for('evaluations.player_evaluations', player_id=player.id) }}" class="btn btn-sm btn-primary">
+        <i class="fas fa-user"></i> {{ _('By player') }}
+    </a>
+</div>
+
+<div class="card mb-4">
+    <div class="card-header">
+        <h3><i class="fas fa-user"></i> {{ player.username }}</h3>
+        <div class="player-nav">
+            {% if prev_player %}
+            <a href="{{ url_for('evaluations.player_evaluations', player_id=prev_player.id) }}" class="btn btn-sm btn-secondary" title="{{ prev_player.username }}">
+                <i class="fas fa-chevron-left"></i> {{ prev_player.username }}
+            </a>
+            {% else %}
+            <span class="btn btn-sm btn-secondary is-disabled" aria-disabled="true"><i class="fas fa-chevron-left"></i></span>
+            {% endif %}
+            {% if next_player %}
+            <a href="{{ url_for('evaluations.player_evaluations', player_id=next_player.id) }}" class="btn btn-sm btn-secondary" title="{{ next_player.username }}">
+                {{ next_player.username }} <i class="fas fa-chevron-right"></i>
+            </a>
+            {% else %}
+            <span class="btn btn-sm btn-secondary is-disabled" aria-disabled="true"><i class="fas fa-chevron-right"></i></span>
+            {% endif %}
+        </div>
+    </div>
+    <div class="card-body">
+        <div class="stats-grid mb-4">
+            <div class="stat-card">
+                <div class="stat-icon bg-info"><i class="fas fa-star"></i></div>
+                <div class="stat-info">
+                    <h3>{{ combined_average | round(1) if combined_average is not none else '-' }}</h3>
+                    <p>{{ _('Combined average') }} &middot; {{ evaluation_count }} {{ _('evaluations') }}</p>
+                </div>
+            </div>
+            {% for label, avg in criterion_averages %}
+            <div class="stat-card stat-card-sm">
+                <div class="stat-icon bg-info"><i class="fas fa-chart-bar"></i></div>
+                <div class="stat-info">
+                    <h3>{{ avg | round(1) if avg is not none else '-' }}</h3>
+                    <p>{{ label }}</p>
+                </div>
+            </div>
+            {% endfor %}
+        </div>
+
+        <div class="table-container">
+            <table class="table">
+                <thead>
+                    <tr>
+                        <th>{{ _('Evaluator') }}</th>
+                        <th>{{ _('Tryout') }}</th>
+                        {% for field, label in evaluation_criteria %}
+                        <th>{{ label }}</th>
+                        {% endfor %}
+                        <th>{{ _('Overall') }}</th>
+                        <th>{{ _('Position') }}</th>
+                        <th>{{ _('Date') }}</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    {% for ev in evaluations %}
+                    <tr>
+                        <td>{{ ev.evaluator.username if ev.evaluator else _('Deleted evaluator') }}</td>
+                        <td>{{ ev.tryout.title if ev.tryout else _('Deleted tryout') }}</td>
+                        {% for score in ev.scores %}
+                        <td>{{ score if score is not none else '-' }}</td>
+                        {% endfor %}
+                        <td><span class="score">{{ ev.overall | round(1) if ev.overall is not none else '-' }}</span></td>
+                        <td>{{ ev.position or '-' }}</td>
+                        <td>{{ ev.date.strftime('%m/%d/%Y') if ev.date else '-' }}</td>
+                    </tr>
+                    {% else %}
+                    <tr>
+                        <td colspan="{{ evaluation_criteria | length + 5 }}" class="text-center">
+                            <div class="empty-state">
+                                <i class="fas fa-clipboard"></i>
+                                <h3>{{ _('No evaluations for this player yet') }}</h3>
+                            </div>
+                        </td>
+                    </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+        </div>
+
+        {% if evaluations %}
+        {% set comment_evals = evaluations | selectattr('comment') | list %}
+        <div class="card mt-4">
+            <div class="card-header">
+                <h3><i class="fas fa-comments"></i> {{ _('Comments') }}</h3>
+            </div>
+            <div class="card-body">
+                {% if comment_evals %}
+                <div class="eval-comments">
+                    {% for ev in comment_evals %}
+                    <article class="eval-comment">
+                        <p class="eval-comment-text">{{ ev.comment }}</p>
+                        <footer class="eval-comment-meta">
+                            <span class="eval-comment-author">{{ _('Evaluator') }}&nbsp;: <strong>{{ ev.evaluator.username if ev.evaluator else _('Deleted evaluator') }}</strong></span>
+                            <span class="eval-comment-context">{{ ev.tryout.title if ev.tryout else _('Deleted tryout') }} &middot; {{ ev.date.strftime('%m/%d/%Y') if ev.date else '-' }}</span>
+                        </footer>
+                    </article>
+                    {% endfor %}
+                </div>
+                {% else %}
+                <div class="empty-state">
+                    <i class="fas fa-comments"></i>
+                    <h3>{{ _('No comments') }}</h3>
+                </div>
+                {% endif %}
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</div>
+{% endblock %}
+
+{% block scripts %}
+<style>
+.view-toggle { display: flex; gap: 8px; }
+.player-nav { display: flex; gap: 8px; align-items: center; }
+.is-disabled { opacity: 0.5; pointer-events: none; }
+</style>
+{% endblock %}

app/templates/pages/profile.html

@@ -393,6 +393,13 @@ document.addEventListener('DOMContentLoaded', function() {
     loadCoachAvailability();
     renderCoachGrid();
 });
+
+// Behaviours are declared in the markup with data-action / data-change and
+// dispatched by the delegated listener in main.js. This replaces inline
+// onclick attributes, which no CSP nonce is able to authorise.
+registerActions({
+    'clear-availability': clearAllAvailability,
+});
 </script>
 {% endif %}
 
@@ -608,7 +615,6 @@ document.addEventListener('DOMContentLoaded', function() {
 // onclick attributes, which no CSP nonce is able to authorise.
 registerActions({
     'clear-disponibilities': clearDisponibilities,
-    'clear-availability': clearAllAvailability,
 });
 </script>
 {% endif %}

app/templates/pages/team_match_form.html

@@ -9,7 +9,7 @@
         <h3><i class="fas fa-futbol"></i> {% if match %}Edit Match{% else %}Schedule New Match{% endif %} — {{ team.name }}</h3>
     </div>
     <div class="card-body">
-        <form method="POST" action="{% if match %}{{ url_for('team_matches.edit_match', match_id=match.id) }}{% else %}{{ url_for('team_matches.create_match', team_id=team.id) }}{% endif %}" class="form">
+        <form method="POST" data-ajax action="{% if match %}{{ url_for('team_matches.edit_match', match_id=match.id) }}{% else %}{{ url_for('team_matches.create_match', team_id=team.id) }}{% endif %}" class="form">
             <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
             
             <div class="form-row">

app/templates/pages/team_matches.html

@@ -98,7 +98,7 @@
                     <a href="{{ url_for('team_matches.edit_match', match_id=m.id) }}" class="btn btn-sm btn-outline" title="{{ _('Edit Match') }}">
                         <i class="fas fa-edit"></i>
                     </a>
-                    <form method="POST" action="{{ url_for('team_matches.delete_match', match_id=m.id) }}" class="inline-form" data-confirm="{{ _('Delete this match?') }}">
+                    <form method="POST" data-ajax action="{{ url_for('team_matches.delete_match', match_id=m.id) }}" class="inline-form" data-confirm="{{ _('Delete this match?') }}">
                         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                         <button type="submit" class="btn btn-sm btn-danger" title="{{ _('Delete Match') }}">
                             <i class="fas fa-trash"></i>
@@ -170,8 +170,8 @@ function togglePresence(btn) {
             btn.classList.add('btn-outline');
             btn.innerHTML = 'Confirm';
         }
-        // Reload to update presence bar
-        location.reload();
+        // Update in place to preserve state
+        window.TT.refreshPage(window.location.pathname);
     })
     .catch(function(error) {
         console.error('Error:', error);

app/templates/pages/team_notes.html

@@ -12,7 +12,7 @@
         {% endif %}
     </div>
     <div class="card-body">
-        <form method="POST" action="{{ url_for('users.manage_team_notes') }}" class="form">
+        <form method="POST" data-ajax action="{{ url_for('users.manage_team_notes') }}" class="form">
             <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
             
             <div class="form-group">

app/templates/pages/teams.html

@@ -18,7 +18,7 @@
         <h3>{{ _('Create New Team') }}</h3>
     </div>
     <div class="card-body">
-        <form method="POST" action="{{ url_for('teams.create_team') }}" class="form">
+        <form method="POST" data-ajax action="{{ url_for('teams.create_team') }}" class="form">
             <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
             <div class="form-row">
                 <div class="form-group col-4">
@@ -63,7 +63,7 @@
             <button class="btn btn-sm btn-outline edit-team-btn" data-team-id="{{ team.id }}" data-team-name="{{ team.name }}" data-coach-id="{{ team.coach_id or '' }}" data-manager-id="{{ team.manager_id or '' }}">
                 <i class="fas fa-edit"></i> {{ _('Edit') }}
             </button>
-            <form method="POST" action="{{ url_for('teams.delete_team', team_id=team.id) }}" class="inline-form" data-confirm="{{ _('Delete team %(name)s? It will be unassigned from any linked tryouts.', name=team.name) }}">
+            <form method="POST" data-ajax action="{{ url_for('teams.delete_team', team_id=team.id) }}" class="inline-form" data-confirm="{{ _('Delete team %(name)s? It will be unassigned from any linked tryouts.', name=team.name) }}">
                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                 <button type="submit" class="btn btn-sm btn-danger">
                     <i class="fas fa-trash"></i> {{ _('Delete') }}
@@ -89,7 +89,7 @@
                         <span class="staff-tag">
                             {{ c.username }}
                             {% if can_manage %}
-                            <form method="POST" action="{{ url_for('teams.remove_coach', team_id=team.id) }}" class="inline-form" data-confirm="{{ _('Remove coach %(coach)s from %(team)s?', coach=c.username, team=team.name) }}">
+                            <form method="POST" data-ajax action="{{ url_for('teams.remove_coach', team_id=team.id) }}" class="inline-form" data-confirm="{{ _('Remove coach %(coach)s from %(team)s?', coach=c.username, team=team.name) }}">
                                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                                 <input type="hidden" name="coach_id" value="{{ c.id }}"/>
                                 <button type="submit" class="btn-icon-sm" title="{{ _('Remove Coach') }}">&times;</button>
@@ -111,7 +111,7 @@
                         <span class="staff-tag manager-tag">
                             {{ m.username }}
                             {% if can_manage %}
-                            <form method="POST" action="{{ url_for('teams.remove_manager', team_id=team.id) }}" class="inline-form" data-confirm="{{ _('Remove manager %(manager)s from %(team)s?', manager=m.username, team=team.name) }}">
+                            <form method="POST" data-ajax action="{{ url_for('teams.remove_manager', team_id=team.id) }}" class="inline-form" data-confirm="{{ _('Remove manager %(manager)s from %(team)s?', manager=m.username, team=team.name) }}">
                                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                                 <input type="hidden" name="manager_id" value="{{ m.id }}"/>
                                 <button type="submit" class="btn-icon-sm" title="{{ _('Remove Manager') }}">&times;</button>
@@ -180,7 +180,7 @@
                         <td>{{ entry.player.phone or '-' }}</td>
                         {% if can_manage_team %}
                         <td>
-                            <form method="POST" action="{{ url_for('teams.remove_player', team_id=team.id, player_id=entry.player.id) }}" class="inline-form" data-confirm="{{ _('Remove %(player)s from %(team)s?', player=entry.player.username, team=team.name) }}">
+                            <form method="POST" data-ajax action="{{ url_for('teams.remove_player', team_id=team.id, player_id=entry.player.id) }}" class="inline-form" data-confirm="{{ _('Remove %(player)s from %(team)s?', player=entry.player.username, team=team.name) }}">
                                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                                 <button type="submit" class="btn btn-sm btn-danger">
                                     <i class="fas fa-user-minus"></i> {{ _('Remove') }}
@@ -210,7 +210,7 @@
         <hr class="my-3">
         <div class="add-player-section">
             <h5 class="mb-2"><i class="fas fa-user-plus"></i> Add Player to {{ team.name }}</h5>
-            <form method="POST" action="{{ url_for('teams.add_player', team_id=team.id) }}" class="form-inline">
+            <form method="POST" data-ajax action="{{ url_for('teams.add_player', team_id=team.id) }}" class="form-inline">
                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                 <select name="player_id" class="form-select" required>
                     <option value="">{{ _('-- Select a player --') }}</option>
@@ -258,7 +258,7 @@
             <button class="modal-close" data-action="hide-edit-form">&times;</button>
         </div>
         <div class="modal-body">
-            <form id="editTeamForm" method="POST" action="" class="form">
+            <form id="editTeamForm" method="POST" data-ajax action="" class="form">
                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                 <input type="hidden" name="sync_staff" value="1"/>
                 

app/templates/pages/upload_contract.html

@@ -24,8 +24,8 @@
             
             <div class="form-group">
                 <label for="contract_file">{{ _('Contract File') }}</label>
-                <input type="file" id="contract_file" name="contract_file" accept=".pdf,.doc,.docx,.jpg,.jpeg,.png" required>
-                <small class="form-text text-muted">{{ _('Accepted formats: PDF, DOC, DOCX, JPG, PNG') }}</small>
+                <input type="file" id="contract_file" name="contract_file" accept=".pdf" required>
+                <small class="form-text text-muted">{{ _('Accepted format: PDF') }}</small>
             </div>
             
             <div class="form-group">

app/templates/pages/users.html

@@ -21,6 +21,7 @@
                         <th>{{ _('Username') }}</th>
                         <th>{{ _('Email') }}</th>
                         <th>{{ _('Role') }}</th>
+                        <th>{{ _('Hours') }}</th>
                         <th>{{ _('Status') }}</th>
                         <th>{{ _('Joined') }}</th>
                         <th>{{ _('Actions') }}</th>
@@ -38,6 +39,13 @@
                         <td>{{ u.username }}</td>
                         <td>{{ u.email }}</td>
                         <td><span class="badge badge-{{ u.role }}">{{ u.role | capitalize }}</span></td>
+                        <td>
+                            {% if u.role in ('player', 'coach') %}
+                            {{ '%.1f'|format(hours.get(u.id, 0.0)) }}
+                            {% else %}
+                            —
+                            {% endif %}
+                        </td>
                         <td>
                             {% if u.is_active_account %}
                             <span class="badge badge-success">Active</span>

app/templates/pages/view_tryout.html

@@ -15,7 +15,7 @@
                 </a>
                 {% endif %}
                 {% if can_edit %}
-                <form method="POST" action="{{ url_for('tryouts.update_status', tryout_id=tryout.id) }}" class="inline-form">
+                <form method="POST" data-ajax action="{{ url_for('tryouts.update_status', tryout_id=tryout.id) }}" class="inline-form">
                     <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                     <select name="status" data-submit-on-change class="form-select">
                         <option value="upcoming" {% if tryout.status == 'upcoming' %}selected{% endif %}>{{ _('Upcoming') }}</option>
@@ -108,7 +108,7 @@
     {% if current_user.role == 'player' and not is_registered and tryout.status in ['upcoming', 'in_progress'] %}
     <div class="card mb-4">
         <div class="card-body text-center">
-            <form method="POST" action="{{ url_for('tryouts.register_for_tryout', tryout_id=tryout.id) }}">
+            <form method="POST" data-ajax action="{{ url_for('tryouts.register_for_tryout', tryout_id=tryout.id) }}">
                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                 <button type="submit" class="btn btn-primary btn-lg">
                     <i class="fas fa-user-plus"></i> {{ _('Register for this Tryout') }}
@@ -124,7 +124,7 @@
             <h3><i class="fas fa-user-plus"></i> {{ _('Add Player to Tryout') }}</h3>
         </div>
         <div class="card-body">
-            <form method="POST" action="{{ url_for('tryouts.register_player', tryout_id=tryout.id) }}" class="form-inline">
+            <form method="POST" data-ajax action="{{ url_for('tryouts.register_player', tryout_id=tryout.id) }}" class="form-inline">
                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                 <select name="player_id" class="form-select" required>
                     <option value="">{{ _('-- Select a player --') }}</option>
@@ -173,7 +173,7 @@
                                 </td>
                                 <td>
                                     {% if can_edit %}
-                                    <form method="POST" action="{{ url_for('tryouts.update_registration_status', tryout_id=tryout.id, player_id=p.id) }}" class="inline-form">
+                                    <form method="POST" data-ajax action="{{ url_for('tryouts.update_registration_status', tryout_id=tryout.id, player_id=p.id) }}" class="inline-form">
                                         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                                         <select name="status" data-submit-on-change class="form-select form-select-sm">
                                             <option value="registered" {% if reg.status == 'registered' %}selected{% endif %}>{{ _('Registered') }}</option>
@@ -205,7 +205,7 @@
                                     </a>
                                     {% endif %}
                                     {% if not tryout.is_ended %}
-                                    <form method="POST" action="{{ url_for('tryouts.remove_player', tryout_id=tryout.id, player_id=p.id) }}" class="inline-form" data-confirm="{{ _('Remove %(name)s from this tryout? They will also be removed from every team and match within it.', name=p.username) }}">
+                                    <form method="POST" data-ajax action="{{ url_for('tryouts.remove_player', tryout_id=tryout.id, player_id=p.id) }}" class="inline-form" data-confirm="{{ _('Remove %(name)s from this tryout? They will also be removed from every team and match within it.', name=p.username) }}">
                                         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                                         <button type="submit" class="btn btn-sm btn-danger" title="{{ _('Remove player from tryout') }}">
                                             <i class="fas fa-user-minus"></i> {{ _('Remove') }}
@@ -238,7 +238,7 @@
             <div class="card-body">
                 {% if can_edit and not tryout.is_ended %}
                 <div id="createTeamForm" class="hidden mb-3">
-                    <form method="POST" action="{{ url_for('tryouts.create_team', tryout_id=tryout.id) }}" class="form-inline">
+                    <form method="POST" data-ajax action="{{ url_for('tryouts.create_team', tryout_id=tryout.id) }}" class="form-inline">
                         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                         <input type="text" name="team_name" placeholder="{{ _('Team name') }}" required class="form-input mr-2">
                         <button type="submit" class="btn btn-sm btn-success">{{ _('Create') }}</button>
@@ -249,7 +249,14 @@
 
                 {% for team in team_data %}
                 <div class="team-card mb-3">
-                    <h4 class="team-name">{{ team.team.name }}</h4>
+                    <div class="team-card-header">
+                        <h4 class="team-name">{{ team.team.name }}</h4>
+                        {% if can_edit and not tryout.is_ended %}
+                        <button class="btn btn-sm btn-outline" data-action="show-modal" data-modal-id="editTeamModal{{ team.team.id }}">
+                            <i class="fas fa-edit"></i> {{ _('Edit') }}
+                        </button>
+                        {% endif %}
+                    </div>
                     <ul class="team-members">
                         {% for member in team.members %}
                         <li>
@@ -263,32 +270,96 @@
                         <li class="text-muted">{{ _('No players assigned yet.') }}</li>
                         {% endfor %}
                     </ul>
-                    {% if can_edit and not tryout.is_ended and registered_players %}
-                    {% set positions = game_positions.get(tryout.game, []) %}
-                    <form method="POST" action="{{ url_for('tryouts.add_to_team', tryout_id=tryout.id, team_id=team.team.id) }}" class="form-inline mt-2">
-                        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
-                        <select name="player_id" class="form-select" required>
-                            <option value="">{{ _('Select player...') }}</option>
-                            {% for p in registered_players %}
-                            {% if p.id not in team.members | map(attribute='player') | map(attribute='id') | list %}
-                            <option value="{{ p.id }}">{{ p.username }}</option>
-                            {% endif %}
-                            {% endfor %}
-                        </select>
-                        {% if positions %}
-                        <select name="position" class="form-select mx-2">
-                            <option value="">{{ _('-- Select Position --') }}</option>
-                            {% for pos in positions %}
-                            <option value="{{ pos }}">{{ pos }}</option>
-                            {% endfor %}
-                        </select>
-                        {% else %}
-                        <input type="text" name="position" placeholder="{{ _('Position') }}" class="form-input mx-2">
-                        {% endif %}
-                        <button type="submit" class="btn btn-sm btn-primary">{{ _('Add') }}</button>
-                    </form>
-                    {% endif %}
                 </div>
+
+                {% if can_edit and not tryout.is_ended %}
+                {% set positions = game_positions.get(tryout.game, []) %}
+                <!-- Edit Team Modal -->
+                <div id="editTeamModal{{ team.team.id }}" class="modal hidden">
+                    <div class="modal-backdrop" data-action="hide-modal" data-modal-id="editTeamModal{{ team.team.id }}"></div>
+                    <div class="modal-content">
+                        <div class="modal-header">
+                            <h3><i class="fas fa-users-cog"></i> {{ _('Edit Team: %(name)s', name=team.team.name) }}</h3>
+                            <button class="modal-close" data-action="hide-modal" data-modal-id="editTeamModal{{ team.team.id }}">&times;</button>
+                        </div>
+                        <div class="modal-body">
+                            <!-- Rename -->
+                            <form method="POST" data-ajax action="{{ url_for('tryouts.edit_team', tryout_id=tryout.id, team_id=team.team.id) }}" class="form-inline mb-3">
+                                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                                <label for="renameInput{{ team.team.id }}" class="mr-2" style="white-space:nowrap;">{{ _('Team name') }}</label>
+                                <input type="text" id="renameInput{{ team.team.id }}" name="team_name" value="{{ team.team.name }}" required class="form-input" style="flex:1;">
+                                <button type="submit" class="btn btn-sm btn-primary ml-2">{{ _('Rename') }}</button>
+                            </form>
+
+                            <hr class="section-divider">
+
+                            <!-- Roster -->
+                            <h5 class="mb-2"><i class="fas fa-users"></i> {{ _('Roster') }}</h5>
+                            <div class="roster-rows">
+                                {% for member in team.members %}
+                                <div class="roster-row">
+                                    <div class="avatar-sm">{{ member.player.username[:2] | upper }}</div>
+                                    <span class="roster-player-name">{{ member.player.username }}</span>
+                                    <form method="POST" data-ajax action="{{ url_for('tryouts.update_member_position', tryout_id=tryout.id, team_id=team.team.id, member_id=member.member_id) }}" class="inline-form">
+                                        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                                        <select name="position" class="form-select roster-role-select" data-submit-on-change>
+                                            <option value="">{{ _('No role') }}</option>
+                                            {% for pos in positions %}
+                                            <option value="{{ pos }}" {% if member.position == pos %}selected{% endif %}>{{ pos }}</option>
+                                            {% endfor %}
+                                        </select>
+                                    </form>
+                                    <form method="POST" data-ajax action="{{ url_for('tryouts.remove_from_team', tryout_id=tryout.id, team_id=team.team.id, player_id=member.player_id) }}" class="inline-form" data-confirm="{{ _('Remove %(player)s from this team?', player=member.player.username) }}">
+                                        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                                        <button type="submit" class="btn btn-sm btn-danger roster-remove-btn" title="{{ _('Remove from team') }}">
+                                            <i class="fas fa-user-minus"></i>
+                                        </button>
+                                    </form>
+                                </div>
+                                {% else %}
+                                <p class="text-muted text-center">{{ _('No players assigned yet.') }}</p>
+                                {% endfor %}
+                            </div>
+
+                            {% if registered_players %}
+                            <hr class="section-divider">
+                            <h5 class="mb-2"><i class="fas fa-user-plus"></i> {{ _('Add Player') }}</h5>
+                            <form method="POST" data-ajax action="{{ url_for('tryouts.add_to_team', tryout_id=tryout.id, team_id=team.team.id) }}" class="form-inline">
+                                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                                <select name="player_id" class="form-select" required style="flex:1;">
+                                    <option value="">{{ _('Select player...') }}</option>
+                                    {% for p in registered_players %}
+                                    {% if p.id not in team.members | map(attribute='player') | map(attribute='id') | list %}
+                                    <option value="{{ p.id }}">{{ p.username }}</option>
+                                    {% endif %}
+                                    {% endfor %}
+                                </select>
+                                {% if positions %}
+                                <select name="position" class="form-select mx-2">
+                                    <option value="">{{ _('-- Select Position --') }}</option>
+                                    {% for pos in positions %}
+                                    <option value="{{ pos }}">{{ pos }}</option>
+                                    {% endfor %}
+                                </select>
+                                {% else %}
+                                <input type="text" name="position" placeholder="{{ _('Position') }}" class="form-input mx-2" style="max-width:140px;">
+                                {% endif %}
+                                <button type="submit" class="btn btn-sm btn-primary">{{ _('Add') }}</button>
+                            </form>
+                            {% endif %}
+
+                            <hr class="section-divider" style="border-color: var(--danger);">
+                            <div class="text-center">
+                                <form method="POST" data-ajax action="{{ url_for('tryouts.delete_team', tryout_id=tryout.id, team_id=team.team.id) }}" class="inline-form" data-confirm="{{ _('Delete this team? Players already in the team will be removed and matches referencing it will be unlinked.') }}">
+                                    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                                    <button type="submit" class="btn btn-danger">{{ _('Delete Team') }}</button>
+                                </form>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                {% endif %}
+
                 {% else %}
                 <p class="text-muted text-center">{{ _('No teams created yet.') }}</p>
                 {% endfor %}
@@ -458,6 +529,12 @@
                                 <a href="{{ url_for('matches.edit_match', match_id=m.id) }}" class="btn btn-sm btn-outline">
                                     <i class="fas fa-edit"></i> {{ _('Edit') }}
                                 </a>
+                                <form method="POST" data-ajax action="{{ url_for('matches.delete_match', match_id=m.id) }}" class="inline-form" data-confirm="{{ _('Delete this match?') }}">
+                                    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+                                    <button type="submit" class="btn btn-sm btn-danger" title="{{ _('Delete Match') }}">
+                                        <i class="fas fa-trash"></i> {{ _('Delete') }}
+                                    </button>
+                                </form>
                                 {% endif %}
                                 <a href="{{ url_for('users.add_note_from_match', match_id=m.id) }}" class="btn btn-sm btn-primary" title="{{ _('Add Note for this Match') }}">
                                     <i class="fas fa-sticky-note"></i> {{ _('Note') }}
@@ -568,8 +645,56 @@
     transform: scale(1.08);
     box-shadow: 0 1px 3px rgba(0,0,0,0.12);
 }
+/* Team card header — edit button aligned right */
+.team-card-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+}
+.team-card-header .team-name {
+    margin-bottom: 0;
+}
+/* Roster rows inside modal */
+.roster-rows {
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+}
+.roster-row {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    padding: 6px 8px;
+    background: var(--gray-50);
+    border-radius: var(--radius-sm);
+}
+.roster-player-name {
+    flex: 1;
+    font-size: 0.9rem;
+    font-weight: 500;
+}
+.roster-role-select {
+    width: auto;
+    font-size: 0.75rem;
+    padding: 1px 4px;
+}
+.roster-remove-btn {
+    padding: 1px 5px;
+    font-size: 0.7rem;
+}
+[data-theme="dark"] .roster-row {
+    background: var(--bg-tertiary);
+}
 </style>
 <script nonce="{{ csp_nonce }}">
+function showModal(modalId) {
+    document.getElementById(modalId).classList.remove('hidden');
+}
+
+function hideModal(modalId) {
+    document.getElementById(modalId).classList.add('hidden');
+}
+
 function showCreateTeam() { document.getElementById('createTeamForm').classList.remove('hidden'); }
 function hideCreateTeam() { document.getElementById('createTeamForm').classList.add('hidden'); }
 
@@ -592,41 +717,58 @@ function toggleTryoutPresence(matchId, participantId, btn) {
             btn.classList.add('presence-pending-btn');
             btn.innerHTML = btn.innerHTML.replace('✅', '⏳');
         }
-        location.reload();
+        window.TT.refreshPage(window.location.pathname);
     })
     .catch(function(err) {
         console.error('Error toggling tryout presence:', err);
     });
 }
 
-// Mini calendar for matches
-document.addEventListener('DOMContentLoaded', function() {
+// Mini calendar for matches. Re-initialised on fragment:updated so the
+// calendar survives AJAX edits that swap the page content in place.
+var miniCalendar = null;
+
+function initMiniCalendar() {
     var miniCalendarEl = document.getElementById('mini-calendar');
-    if (miniCalendarEl) {
-        var miniCalendar = new FullCalendar.Calendar(miniCalendarEl, {
-            initialView: 'dayGridMonth',
-            headerToolbar: {
-                left: 'prev,next',
-                center: 'title',
-                right: 'dayGridMonth,timeGridWeek'
-            },
-            events: '/matches/api/events/{{ tryout.id }}',
-            height: '300px',
-            eventClick: function(info) {
-                if (info.event.extendedProps.match_id) {
-                    window.location.href = '/matches/' + info.event.extendedProps.match_id + '/edit';
-                }
-            }
-        });
-        miniCalendar.render();
+    if (!miniCalendarEl) {
+        return;
     }
-});
+    if (miniCalendar) {
+        miniCalendar.destroy();
+        miniCalendar = null;
+    }
+    miniCalendar = new FullCalendar.Calendar(miniCalendarEl, {
+        initialView: 'dayGridMonth',
+        headerToolbar: {
+            left: 'prev,next',
+            center: 'title',
+            right: 'dayGridMonth,timeGridWeek'
+        },
+        events: '/matches/api/events/{{ tryout.id }}',
+        height: '300px',
+        eventClick: function(info) {
+            if (info.event.extendedProps.match_id) {
+                window.location.href = '/matches/' + info.event.extendedProps.match_id + '/edit';
+            }
+        }
+    });
+    miniCalendar.render();
+}
+
+document.addEventListener('DOMContentLoaded', initMiniCalendar);
+document.addEventListener('fragment:updated', initMiniCalendar);
 
 // Behaviours declared in the markup, dispatched by the delegated listener
 // in main.js. Inline onclick attributes cannot be authorised by a CSP nonce.
 registerActions({
     'show-create-team': showCreateTeam,
     'hide-create-team': hideCreateTeam,
+    'show-modal': function (element) {
+        showModal(element.getAttribute('data-modal-id'));
+    },
+    'hide-modal': function (element) {
+        hideModal(element.getAttribute('data-modal-id'));
+    },
     'toggle-tryout-presence': function (element) {
         toggleTryoutPresence(
             element.getAttribute('data-match-id'),

app/templates/pages/view_user.html

@@ -81,6 +81,31 @@
             </table>
         </div>
         {% endif %}
+
+        {% if profile_user.role in ('player', 'coach') and availability %}
+        <hr class="my-4">
+        <h4 class="mb-3"><i class="fas fa-clock"></i> {{ _('Availability') }}
+            <small class="text-muted">({{ '%.1f'|format(availability_hours or 0.0) }} h)</small>
+        </h4>
+        <div class="readonly-availability-grid">
+            {% set day_names = ['Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday', 'Sunday'] %}
+            {% for day_idx in range(7) %}
+            <div class="ra-day-column">
+                <div class="ra-day-header">{{ day_names[day_idx][:3] }}</div>
+                {% set day_slots = availability | selectattr('day_of_week', 'equalto', day_idx) | list %}
+                {% if day_slots %}
+                    {% for slot in day_slots | sort(attribute='start_time') %}
+                    <div class="ra-slot selected">
+                        {{ slot.start_time.strftime('%H:%M') }}–{{ slot.end_time.strftime('%H:%M') }}
+                    </div>
+                    {% endfor %}
+                {% else %}
+                    <div class="ra-slot ra-empty">—</div>
+                {% endif %}
+            </div>
+            {% endfor %}
+        </div>
+        {% endif %}
     </div>
 </div>
 {% endblock %}

app/timeslots.py

@@ -58,3 +58,39 @@ def day_name(day_of_week):
     if 0 <= day_of_week < len(DAY_NAMES):
         return DAY_NAMES[day_of_week]
     return f'Day {day_of_week}'
+
+
+def slot_duration_minutes(start_time, end_time):
+    """Minutes a slot spans, wrapping past midnight like slot_end does.
+
+    Works on SQLite where ``Time`` columns are stored as text — the
+    arithmetic stays in pure Python so it is portable across databases.
+
+    Args:
+        start_time: A ``datetime.time``.
+        end_time: A ``datetime.time`` (may be earlier if the slot wraps
+            past midnight).
+
+    Returns:
+        int: Duration in whole minutes.
+    """
+    anchor = date_cls(2000, 1, 1)
+    start_dt = datetime.combine(anchor, start_time)
+    end_dt = datetime.combine(anchor, end_time)
+    if end_dt <= start_dt:
+        end_dt += timedelta(days=1)
+    return int((end_dt - start_dt).total_seconds() // 60)
+
+
+def total_hours(slots):
+    """Aggregate slot durations into a single float, rounded to one decimal.
+
+    Args:
+        slots: Iterable of objects with ``start_time`` and ``end_time``
+            attributes (``PlayerDisponibility`` or ``CoachAvailability``).
+
+    Returns:
+        float: Total hours across all slots, e.g. ``8.5``.
+    """
+    total_minutes = sum(slot_duration_minutes(s.start_time, s.end_time) for s in slots)
+    return round(total_minutes / 60, 1)

app/validators.py

@@ -23,7 +23,7 @@ from marshmallow import (
     validates_schema,
 )
 
-from app.models import ESPORT_GAMES, GAME_PLATFORMS, USER_TYPES
+from app.models import DOCUMENT_KINDS, ESPORT_GAMES, GAME_PLATFORMS, USER_TYPES
 
 # =============================================================================
 # Custom Validators
@@ -605,6 +605,18 @@ class TryoutTeamMemberSchema(StripMixin):
     )
 
 
+class TryoutTeamMemberPositionSchema(StripMixin):
+    """Update a team member's in-game position (role)."""
+
+    position = fields.String(
+        load_default='',
+        validate=validate.Length(
+            max=50,
+            error=_l('Position must be 50 characters or less.'),
+        ),
+    )
+
+
 class NoteContentSchema(StripMixin):
     """Bounded text stored as a team or personal coaching note."""
 
@@ -1049,3 +1061,23 @@ class EvaluationSchema(StripMixin):
         allow_none=True,
         load_default=None,
     )
+
+
+class DocumentCreateSchema(StripMixin):
+    """Validate the admin form that creates a new document.
+
+    Fields:
+        title: Human-readable name of the document (e.g. ``Contrat joueur``).
+        kind: One of DOCUMENT_KINDS.  The kind decides who completes the
+            document and whether completion is a signature or an
+            acknowledgment.
+    """
+
+    title = fields.String(
+        required=True,
+        validate=validate.Length(min=1, max=255, error=_l('Title is required.')),
+    )
+    kind = fields.String(
+        required=True,
+        validate=validate.OneOf(DOCUMENT_KINDS, error=_l('That document type is not recognised.')),
+    )

clear_db.py

@@ -1,66 +0,0 @@
-"""Database seeding script for Team Tryouts application.
-
-Wipes all data and creates an admin user. Run manually with:
-    python -m app.supporting_scripts.seed
-"""
-
-from app.extensions import db, hash_password
-from app.models import Admin
-
-
-def seed_database():
-    """Delete all existing data and create a single admin account."""
-
-    # Delete all data in FK-safe order
-    print("Deleting existing data...")
-    tables = [
-        'one_on_one_requests',
-        'player_disponibilities',
-        'coach_availabilities',
-        'match_participants',
-        'team_match_participants',
-        'matches',
-        'team_matches',
-        'team_players',
-        'team_members',
-        'teams',
-        'evaluations',
-        'tryout_registrations',
-        'tryouts',
-        'org_team_coaches',
-        'org_team_managers',
-        'team_notes',
-        'personal_notes',
-        'user_gamertags',
-        'org_teams',
-        'users',
-    ]
-    for table in tables:
-        db.session.execute(db.text(f'DELETE FROM {table}'))
-    db.session.commit()
-    print("[OK] All data deleted.")
-
-    # Create the admin user
-    admin = Admin(
-        username='admin',
-        password_hash=hash_password('password'),
-        role='admin',
-        full_name='Admin',
-        email='[email protected]',
-    )
-    db.session.add(admin)
-    db.session.commit()
-
-    print("[OK] Created admin user")
-    print("\n=== Admin Credentials ===")
-    print("Username: admin")
-    print("Password: password")
-    print("\n[SUCCESS] Database reset and seeded!")
-
-
-if __name__ == '__main__':
-    from app.app import create_app
-
-    app = create_app()
-    with app.app_context():
-        seed_database()

docs/database-restore.md

@@ -15,6 +15,7 @@ incident.
 |---|---|---|
 | `db_backup_<timestamp>.dump` | Full PostgreSQL dump, custom format | Every account, tryout, evaluation, note and contract record |
 | `documents_backup_<timestamp>.zip` | `documents/` directory | The contract **files** themselves — they exist only on disk, the database stores paths |
+| `documents_backup_drive_<timestamp>.zip` | Google Drive contract folder | Drive-stored contracts downloaded and archived when `DOCUMENT_STORAGE_BACKEND=google_drive` |
 
 Losing either one alone loses data. A database restore without the document
 archive leaves contract rows pointing at files that no longer exist.

docs/deployment.md

@@ -67,6 +67,28 @@ documents every variable. Copying it verbatim gives a configuration that
 refuses to start until `SECRET_KEY` and `DATABASE_URL` are filled in, rather
 than one that starts and is wide open (OPS-003).
 
+### Google Drive contract storage
+
+New contracts are stored in the owner's personal Google Drive when
+`DOCUMENT_STORAGE_BACKEND=google_drive`. Enable the Google Drive API in a
+Google Cloud project, create an OAuth client for the owner, and authorize it
+once with the `drive.file` scope. Configure the resulting values outside the
+repository:
+
+```text
+DOCUMENT_STORAGE_BACKEND=google_drive
+GOOGLE_DRIVE_FOLDER_ID=<owner folder id>
+GOOGLE_DRIVE_CLIENT_ID=<OAuth client id>
+GOOGLE_DRIVE_CLIENT_SECRET=<OAuth client secret>
+GOOGLE_DRIVE_REFRESH_TOKEN=<owner refresh token>
+```
+
+The refresh token can create, download, and delete contracts created by this
+application. Keep all four values out of source control. The database stores
+only `gdrive://<file-id>` references, so existing local-file rows continue to
+work after the change. Use `DOCUMENT_STORAGE_BACKEND=local` only for tests,
+local development, or while migrating legacy files.
+
 ### Binding and proxy trust — read this before going live (OPS-002)
 
 Two variables decide whether the rate limiter, the account lockout and the

docs/security-checklist.md

@@ -82,8 +82,9 @@ Run through this checklist before deploying to production.
 
 - [ ] Upload size limited to 16MB (`MAX_CONTENT_LENGTH`)
 - [ ] File extensions restricted to PDF only
+- [ ] File content validated by parsing with pypdf (`PdfReader`) — header (`%PDF-`) + at least one parseable page
 - [ ] Files stored with UUID filenames (not original names)
-- [ ] Upload directory outside web root
+- [ ] Upload directory outside web root (or Google Drive in production)
 
 ## Phase 13 — Logging & Monitoring
 

docs/translations.md

@@ -170,8 +170,8 @@ was marked by the automated pass. Jinja escaped it to `×`, so
 the button would have shown the literal text `×` instead of ×.
 Anything that is markup rather than prose must stay out of `_()`.
 
-**Strings inside `<script>` blocks.** Eight remain, in `match_form.html`,
-`one_on_one.html` and `coach_availability.html`. They work, but they are
+**Strings inside `<script>` blocks.** Seven remain, in `match_form.html` and
+`one_on_one.html`. They work, but they are
 fragile: Jinja escapes `& < > " '` inside a script block, and those
 entities are *not* decoded there — a translation containing an apostrophe
 would land in the JavaScript string as `&#39;`. The French wording uses

migrations/add_reminder_date_indexes.py

@@ -0,0 +1,36 @@
+"""Migration: Create indexes on date columns used by the 18:00 daily reminder.
+
+Run this script to add indexes on the date columns that the Discord bot's
+daily reminder queries (Match.date, TeamMatch.date, Tryout.date,
+OneOnOneRequest.date). The app uses create_all() for new tables, but existing
+production databases need these added explicitly.
+
+Usage: python migrations/add_reminder_date_indexes.py
+"""
+
+import sys
+import os
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from app.app import create_app
+from app.extensions import db
+from sqlalchemy import text
+
+app = create_app()
+
+with app.app_context():
+    indexes = [
+        ('ix_matches_date', 'matches', 'date'),
+        ('ix_team_matches_date', 'team_matches', 'date'),
+        ('ix_tryouts_date', 'tryouts', 'date'),
+        ('ix_one_on_one_requests_date', 'one_on_one_requests', 'date'),
+    ]
+
+    for index_name, table, column in indexes:
+        db.session.execute(text(
+            f'CREATE INDEX IF NOT EXISTS {index_name} ON {table} ({column})'
+        ))
+        print(f'Index {index_name} on {table}({column}) ensured.')
+
+    db.session.commit()
+    print('Migration complete.')

pyproject.toml

@@ -31,7 +31,7 @@ show_missing = true
 
 [tool.ruff]
 line-length = 100
-target-version = "py312"
+target-version = "py313"
 exclude = [".venv", "venv", "migrations", "docs"]
 
 [tool.ruff.lint]

requirements.txt

@@ -24,6 +24,9 @@ Flask-SQLAlchemy==3.1.1
 Flask-WTF==1.3.0
 frozenlist==1.8.0
 greenlet==3.5.4
+google-api-python-client==2.198.0
+google-auth==2.56.3
+pypdf==6.16.2
 idna==3.18
 itsdangerous==2.2.0
 Jinja2==3.1.6

run.py

@@ -25,9 +25,53 @@ import sys
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
 from app.app import create_app  # noqa: E402
+from app.extensions import db as _db  # noqa: E402
+from app.extensions import hash_password  # noqa: E402
+from app.local_postgres import start as start_local_pg  # noqa: E402
+from app.models import Admin, Coach, Manager, Player  # noqa: E402
+
+# ==========================================================================
+# Local PostgreSQL (development only)
+# ==========================================================================
+if os.getenv('LOCAL_PG', '').lower() == 'true':
+    os.environ['DATABASE_URL'] = start_local_pg()
+
+# ==========================================================================
 
 if __name__ == '__main__':
     app = create_app()
+
+    # --- Seed the database with default test users (idempotent) ---------
+    with app.app_context():
+        if not Admin.query.first():
+            print('[INFO] Seeding database with default test users ...')
+            users = [
+                Admin(username='admin', role='admin', full_name='Admin', email='[email protected]'),
+                Coach(
+                    username='coach',
+                    role='coach',
+                    full_name='Coach Test',
+                    email='[email protected]',
+                ),
+                Manager(
+                    username='manager',
+                    role='manager',
+                    full_name='Manager Test',
+                    email='[email protected]',
+                ),
+                Player(
+                    username='player',
+                    role='player',
+                    full_name='Player Test',
+                    email='[email protected]',
+                ),
+            ]
+            for u in users:
+                u.password_hash = hash_password('password')
+                _db.session.add(u)
+            _db.session.commit()
+            print('[INFO] Seeded 4 default users (password for all: password).')
+
     debug_mode = os.getenv('FLASK_DEBUG', 'false').lower() == 'true'
     if debug_mode:
         app.logger.warning(

tests/conftest.py

@@ -80,6 +80,7 @@ def documents_in_a_throwaway_directory(tmp_path, monkeypatch):
     cannot leave a PDF in someone's working tree.
     """
     monkeypatch.setenv('DOCUMENTS_ROOT', str(tmp_path / 'documents'))
+    monkeypatch.setenv('DOCUMENT_STORAGE_BACKEND', 'local')
 
 
 @pytest.fixture
@@ -194,6 +195,11 @@ def as_role(app, client, make_user, login):
             from app.models import User
 
             username = _db.session.get(User, user_id).username
+        # The login route short-circuits when the client is already
+        # authenticated, so a previous as_role() call would otherwise leave
+        # the old identity in the session and the switch would silently not
+        # happen (ADMIN-010: coach/manager gate tests ran as admin).
+        client.post('/auth/logout', follow_redirects=False)
         response = login(username)
         assert response.status_code in (301, 302), (
             f'login for {username} did not redirect: {response.status_code}'

tests/test_admin_app_settings.py

@@ -0,0 +1,62 @@
+"""AppSettings key-value store — model behaviour.
+
+ADMIN-001. The admin panel relies on AppSettings for global toggles
+(tryouts_open, season_active, season_name, season_start, season_end).
+These tests verify the key-value store itself, independent of any route.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import AppSettings
+
+
+class TestAppSettingsGetSet:
+    def test_get_returns_default_for_missing_key(self, app):
+        with app.app_context():
+            assert AppSettings.get('nonexistent', 'fallback') == 'fallback'
+
+    def test_set_and_get_roundtrip(self, app):
+        with app.app_context():
+            AppSettings.set('test_key', 'hello')
+            assert AppSettings.get('test_key') == 'hello'
+
+    def test_set_overwrites_existing_key(self, app):
+        with app.app_context():
+            AppSettings.set('overwrite_key', 'first')
+            AppSettings.set('overwrite_key', 'second')
+            assert AppSettings.get('overwrite_key') == 'second'
+
+    def test_set_none_value_is_stored_as_none(self, app):
+        with app.app_context():
+            AppSettings.set('nullable_key', None)
+            assert AppSettings.get('nullable_key') is None
+
+
+class TestAppSettingsBool:
+    def test_get_bool_parses_true_values(self, app):
+        with app.app_context():
+            for val in ('true', 'True', 'TRUE', '1', 'yes', 'on'):
+                AppSettings.set('bool_test', val)
+                assert AppSettings.get_bool('bool_test'), f'{val!r} should be True'
+
+    def test_get_bool_parses_false_values(self, app):
+        with app.app_context():
+            for val in ('false', 'False', 'FALSE', '0', 'no', 'off', 'anything_else'):
+                AppSettings.set('bool_test', val)
+                assert not AppSettings.get_bool('bool_test'), f'{val!r} should be False'
+
+    def test_get_bool_defaults_to_false_for_missing_key(self, app):
+        with app.app_context():
+            assert not AppSettings.get_bool('does_not_exist')
+
+    def test_get_bool_respects_custom_default(self, app):
+        with app.app_context():
+            assert AppSettings.get_bool('does_not_exist', default=True)
+
+    def test_set_bool_stores_as_string(self, app):
+        with app.app_context():
+            AppSettings.set_bool('bool_key', True)
+            assert AppSettings.get('bool_key') == 'true'
+            AppSettings.set_bool('bool_key', False)
+            assert AppSettings.get('bool_key') == 'false'

tests/test_admin_audit_log.py

@@ -0,0 +1,61 @@
+"""AuditLog model — append-only admin action tracking.
+
+ADMIN-002. Every sensitive admin action (backup, restore, toggle, season,
+wipe) writes an AuditLog entry. These tests verify the model itself.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import AuditLog, User
+
+
+class TestAuditLogRecord:
+    def test_record_stores_all_fields(self, app, make_user):
+        admin_id = make_user('admin')
+        with app.app_context():
+            AuditLog.record(
+                user_id=admin_id,
+                action='test_action',
+                details='some details here',
+                ip_address='192.168.1.1',
+            )
+            entry = AuditLog.query.order_by(AuditLog.id.desc()).first()
+            assert entry is not None
+            assert entry.user_id == admin_id
+            assert entry.action == 'test_action'
+            assert entry.details == 'some details here'
+            assert entry.ip_address == '192.168.1.1'
+            assert entry.created_at is not None
+
+    def test_record_without_details_or_ip(self, app, make_user):
+        admin_id = make_user('admin')
+        with app.app_context():
+            AuditLog.record(user_id=admin_id, action='minimal')
+            entry = AuditLog.query.order_by(AuditLog.id.desc()).first()
+            assert entry.action == 'minimal'
+            assert entry.details is None
+            assert entry.ip_address is None
+
+    def test_entries_are_ordered_by_date_descending(self, app, make_user):
+        admin_id = make_user('admin')
+        with app.app_context():
+            AuditLog.record(user_id=admin_id, action='first')
+            AuditLog.record(user_id=admin_id, action='second')
+            AuditLog.record(user_id=admin_id, action='third')
+
+            entries = AuditLog.query.order_by(AuditLog.created_at.desc()).all()
+            actions = [e.action for e in entries]
+            assert actions == ['third', 'second', 'first']
+
+    def test_audit_log_survives_user_deletion(self, app, make_user):
+        admin_id = make_user('admin')
+        with app.app_context():
+            AuditLog.record(user_id=admin_id, action='before_delete')
+            user = db.session.get(User, admin_id)
+            db.session.delete(user)
+            db.session.commit()
+
+            entry = AuditLog.query.filter_by(action='before_delete').first()
+            assert entry is not None
+            assert entry.user_id is None  # FK set to NULL on delete

tests/test_admin_backup.py

@@ -0,0 +1,290 @@
+"""Admin backup — create, download, delete, restore, and audit trail.
+
+ADMIN-008. The backup buttons on the admin panel run pg_dump/pg_restore
+in production, but tests mock the subprocess boundary. These tests verify
+the route logic, the BackupRecord model, and audit logging.
+"""
+
+import os
+
+import pytest
+
+from app.extensions import db
+from app.models import AuditLog, BackupRecord
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+class TestBackupCreate:
+    def test_create_backup_succeeds(self, app, client, as_role, monkeypatch):
+        import app.routes.admin as admin_module
+        from app.supporting_scripts.backup import BackupError
+
+        def fake_create_backup_record(backup_type='manual', notes=None):
+            from app.models import BackupRecord
+
+            record = BackupRecord(
+                filename='db_backup_test.dump',
+                file_path='/tmp/db_backup_test.dump',
+                size_bytes=1234,
+                backup_type=backup_type,
+                notes=notes,
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            return record
+
+        monkeypatch.setattr(admin_module, '_create_backup_record', fake_create_backup_record)
+
+        as_role('admin')
+        response = client.post(
+            '/admin/backup/create',
+            data={'notes': 'test backup'},
+            follow_redirects=False,
+        )
+        assert _redirected(response)
+
+        with app.app_context():
+            record = BackupRecord.query.filter_by(filename='db_backup_test.dump').first()
+            assert record is not None
+            assert record.notes == 'test backup'
+
+    def test_create_backup_failure_is_handled(self, app, client, as_role, monkeypatch):
+        import app.routes.admin as admin_module
+        from app.supporting_scripts.backup import BackupError
+
+        def fake_create_backup_record(backup_type='manual', notes=None):
+            raise BackupError('pg_dump not found')
+
+        monkeypatch.setattr(admin_module, '_create_backup_record', fake_create_backup_record)
+
+        as_role('admin')
+        response = client.post(
+            '/admin/backup/create',
+            data={},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'Backup failed' in html
+
+    def test_create_backup_creates_audit_log(self, app, client, as_role, monkeypatch):
+        import app.routes.admin as admin_module
+
+        def fake_create_backup_record(backup_type='manual', notes=None):
+            from app.models import BackupRecord
+
+            record = BackupRecord(
+                filename='db_backup_test.dump',
+                file_path='/tmp/db_backup_test.dump',
+                size_bytes=1234,
+                backup_type=backup_type,
+                notes=notes,
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            return record
+
+        monkeypatch.setattr(admin_module, '_create_backup_record', fake_create_backup_record)
+
+        as_role('admin')
+        client.post('/admin/backup/create', data={}, follow_redirects=False)
+
+        with app.app_context():
+            entry = AuditLog.query.filter_by(action='backup_created').first()
+            assert entry is not None
+
+
+class TestBackupDownload:
+    def test_download_existing_backup(self, app, client, as_role, tmp_path):
+        from app.models import BackupRecord
+
+        backup_file = tmp_path / 'db_backup_test.dump'
+        backup_file.write_text('fake dump content')
+
+        as_role('admin')
+        with app.app_context():
+            record = BackupRecord(
+                filename='db_backup_test.dump',
+                file_path=str(backup_file),
+                size_bytes=18,
+                backup_type='manual',
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            record_id = record.id
+
+        response = client.get(f'/admin/backup/{record_id}/download')
+        assert response.status_code == 200
+        assert response.data == b'fake dump content'
+
+    def test_download_missing_backup_file(self, app, client, as_role):
+        from app.models import BackupRecord
+
+        as_role('admin')
+        with app.app_context():
+            record = BackupRecord(
+                filename='missing.dump',
+                file_path='/nonexistent/missing.dump',
+                size_bytes=0,
+                backup_type='manual',
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            record_id = record.id
+
+        response = client.get(
+            f'/admin/backup/{record_id}/download',
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'missing from disk' in html.lower()
+
+
+class TestBackupDelete:
+    def test_delete_backup_removes_record_and_file(self, app, client, as_role, tmp_path):
+        from app.models import BackupRecord
+
+        backup_file = tmp_path / 'db_backup_delete.dump'
+        backup_file.write_text('fake dump content')
+
+        as_role('admin')
+        with app.app_context():
+            record = BackupRecord(
+                filename='db_backup_delete.dump',
+                file_path=str(backup_file),
+                size_bytes=18,
+                backup_type='manual',
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            record_id = record.id
+
+        response = client.post(
+            f'/admin/backup/{record_id}/delete',
+            follow_redirects=False,
+        )
+        assert _redirected(response)
+
+        with app.app_context():
+            assert BackupRecord.query.get(record_id) is None
+        assert not backup_file.exists()
+
+    def test_delete_backup_creates_audit_log(self, app, client, as_role, tmp_path):
+        from app.models import BackupRecord
+
+        backup_file = tmp_path / 'db_backup_delete2.dump'
+        backup_file.write_text('fake')
+
+        as_role('admin')
+        with app.app_context():
+            record = BackupRecord(
+                filename='db_backup_delete2.dump',
+                file_path=str(backup_file),
+                size_bytes=4,
+                backup_type='manual',
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            record_id = record.id
+
+        client.post(f'/admin/backup/{record_id}/delete', follow_redirects=False)
+
+        with app.app_context():
+            entry = AuditLog.query.filter_by(action='backup_deleted').first()
+            assert entry is not None
+
+
+class TestBackupRestore:
+    def test_restore_with_missing_file_fails(self, app, client, as_role):
+        from app.models import BackupRecord
+
+        as_role('admin')
+        with app.app_context():
+            record = BackupRecord(
+                filename='missing_restore.dump',
+                file_path='/nonexistent/missing_restore.dump',
+                size_bytes=0,
+                backup_type='manual',
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            record_id = record.id
+
+        response = client.post(
+            f'/admin/backup/{record_id}/restore',
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'missing from disk' in html.lower()
+
+    def test_restore_creates_safety_backup_first(self, app, client, as_role, monkeypatch, tmp_path):
+        import app.routes.admin as admin_module
+
+        # The restore route parses DATABASE_URL outside its try block.
+        monkeypatch.setenv('DATABASE_URL', 'postgresql://appuser:[email protected]:5432/tryouts')
+
+        backup_file = tmp_path / 'db_backup_restore.dump'
+        backup_file.write_text('fake')
+
+        safety_file = tmp_path / 'db_backup_safety.dump'
+        safety_file.write_text('fake safety')
+
+        as_role('admin')
+        with app.app_context():
+            from app.models import BackupRecord
+
+            record = BackupRecord(
+                filename='db_backup_restore.dump',
+                file_path=str(backup_file),
+                size_bytes=4,
+                backup_type='manual',
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            record_id = record.id
+
+        def fake_create_backup_record(backup_type='pre_restore', notes=None):
+            from app.models import BackupRecord
+
+            record = BackupRecord(
+                filename='db_backup_safety.dump',
+                file_path=str(safety_file),
+                size_bytes=12,
+                backup_type=backup_type,
+                notes=notes,
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            return record
+
+        monkeypatch.setattr(admin_module, '_create_backup_record', fake_create_backup_record)
+
+        import subprocess
+
+        def fake_subprocess_run(cmd, env=None, capture_output=True, text=True, timeout=None):
+            class Result:
+                returncode = 0
+                stderr = ''
+                stdout = ''
+
+            return Result()
+
+        monkeypatch.setattr(subprocess, 'run', fake_subprocess_run)
+
+        client.post(f'/admin/backup/{record_id}/restore', follow_redirects=False)
+
+        with app.app_context():
+            safety = BackupRecord.query.filter_by(filename='db_backup_safety.dump').first()
+            assert safety is not None
+            assert safety.backup_type == 'pre_restore'

tests/test_admin_csrf.py

@@ -0,0 +1,56 @@
+"""Admin panel — CSRF protection on mutation endpoints.
+
+ADMIN-005. Every admin POST route must reject requests that lack a valid
+CSRF token. These tests use the app_with_csrf fixture where CSRF is
+enabled, unlike the default app fixture which disables it.
+"""
+
+import pytest
+
+
+ADMIN_POST_ROUTES = [
+    '/admin/backup/create',
+    '/admin/toggle-tryouts',
+    '/admin/season/start',
+    '/admin/season/end',
+    '/admin/teams/wipe',
+]
+
+
+class TestAdminCsrfProtection:
+    @pytest.mark.parametrize('route', ADMIN_POST_ROUTES)
+    def test_post_without_csrf_is_rejected(self, app_with_csrf, route):
+        """Every admin POST route must reject a missing CSRF token."""
+        # as_role uses the default app fixture, so we log in manually
+        # with the csrf-enabled app.
+        from app.extensions import db as _db
+        from app.models import User
+
+        client = app_with_csrf.test_client()
+
+        # Create and log in an admin on the CSRF-enabled app
+        with app_with_csrf.app_context():
+            from app.extensions import hash_password
+            from app.models import Admin
+
+            admin = Admin(
+                username='csrfadmin',
+                password_hash=hash_password('Password123'),
+                role='admin',
+                full_name='CSRF Admin',
+                email='[email protected]',
+            )
+            _db.session.add(admin)
+            _db.session.commit()
+
+        client.post(
+            '/auth/login',
+            data={'username': 'csrfadmin', 'password': 'Password123'},
+            follow_redirects=False,
+        )
+
+        response = client.post(route, data={}, follow_redirects=False)
+        # Flask-WTF returns 400 on missing CSRF token
+        assert response.status_code in (400, 302), (
+            f'{route} returned {response.status_code} without CSRF token'
+        )

tests/test_admin_document_uploads_toggle.py

@@ -0,0 +1,135 @@
+"""Admin document-upload toggle — enable/disable gate and enforcement
+on contract upload routes.
+
+ADMIN-006 style. The document_uploads_enabled setting gates every
+contract upload route for non-admins. Admins always bypass the lock.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import AppSettings, Contract, User
+
+NON_ADMIN_ROLES = ['manager', 'coach']
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+class TestDocumentUploadToggle:
+    """Toggle logic — on/off round-trip and audit log."""
+
+    def test_toggle_from_enabled_to_disabled(self, client, as_role):
+        as_role('admin')
+        # Default is enabled
+        client.post('/admin/toggle-document-uploads', data={}, follow_redirects=False)
+        with client.application.app_context():
+            assert not AppSettings.get_bool('document_uploads_enabled', default=True)
+
+    def test_toggle_from_disabled_to_enabled(self, client, as_role):
+        as_role('admin')
+        client.post('/admin/toggle-document-uploads', data={}, follow_redirects=False)
+        client.post('/admin/toggle-document-uploads', data={}, follow_redirects=False)
+        with client.application.app_context():
+            assert AppSettings.get_bool('document_uploads_enabled', default=True)
+
+    def test_toggle_creates_audit_log(self, client, as_role):
+        from app.models import AuditLog
+
+        as_role('admin')
+        client.post('/admin/toggle-document-uploads', data={}, follow_redirects=False)
+
+        with client.application.app_context():
+            entry = AuditLog.query.filter_by(action='document_uploads_toggled').first()
+            assert entry is not None
+
+    def test_default_is_enabled(self, app):
+        with app.app_context():
+            assert AppSettings.get_bool('document_uploads_enabled', default=True)
+
+
+class TestDocumentUploadGateEnforcement:
+    """Non-admin roles are blocked when the toggle is off."""
+
+    def _contract_for(self, app, player_id):
+        """Create a minimal contract for enforcement tests."""
+        from datetime import datetime
+
+        with app.app_context():
+            admin = User.query.filter_by(role='admin').first()
+            contract = Contract(
+                player_id=player_id,
+                uploaded_by_id=admin.id,
+                original_filename='test.pdf',
+                stored_filename='test.pdf',
+                file_path='contrats signes/test.pdf',
+                status='pending_player_signing',
+                uploaded_at=datetime.utcnow(),
+            )
+            db.session.add(contract)
+            db.session.commit()
+            return contract.id
+
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_upload_contract_when_disabled(
+        self, app, client, as_role, make_user, role
+    ):
+        as_role('admin')
+        client.post('/admin/toggle-document-uploads', data={})  # disable
+        as_role(role)
+
+        response = client.post(
+            '/users/contracts/upload',
+            data={'player_id': '', 'contract_file': ''},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        # Default locale is French — the flash message says "désactivés"
+        assert 'désactivés' in html or 'disabled' in html.lower()
+
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_admin_can_always_upload_contract(self, client, as_role, role):
+        as_role('admin')
+        # Pre-create a player for the contract
+
+        as_role('player')
+        client.post('/admin/toggle-document-uploads', data={})  # disable
+
+        # Admin should still be able to reach the upload page
+        response = client.get('/users/contracts/upload', follow_redirects=False)
+        assert _redirected(response) or response.status_code == 200
+
+    def test_player_cannot_upload_signed_when_disabled(self, app, client, as_role, make_user):
+        as_role('admin')
+        client.post('/admin/toggle-document-uploads', data={})  # disable while logged in as admin
+        player_id = make_user('player')
+        contract_id = self._contract_for(app, player_id)
+
+        # Log in as the player
+        with app.app_context():
+            username = db.session.get(User, player_id).username
+        client.post('/auth/login', data={'username': username, 'password': 'Password123'})
+
+        response = client.post(
+            f'/users/contracts/{contract_id}/upload_signed',
+            data={'signed_file': ''},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'désactivés' in html or 'disabled' in html.lower()
+
+    def test_admin_can_always_upload(self, app, client, as_role):
+        as_role('admin')
+        client.post('/admin/toggle-document-uploads', data={})  # disable
+
+        # Admin GET the upload page — should be allowed (not redirected away)
+        response = client.get('/users/contracts/upload', follow_redirects=False)
+        # The admin bypasses the lock so they see the upload form (200)
+        # or get redirected (if no players exist, etc). Either way is fine
+        # as long as it's not the flash about uploads being disabled.
+        body = response.data.decode() if response.status_code == 200 else ''
+        # The toggle flash ("désactivés") could still be present, but the
+        # upload-disabled message ("désactivés") must not appear in the body.
+        # We check for the French lock message specifically.
+        assert 'actuellement désactivés' not in body

tests/test_admin_panel.py

@@ -0,0 +1,150 @@
+"""Admin panel — access control, dashboard rendering, and template integrity.
+
+ADMIN-004. The admin panel at /admin must only be reachable by admins,
+must render all expected sections, and must serve static assets correctly.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import User
+
+
+NON_ADMIN_ROLES = ['player', 'coach', 'manager', 'scout']
+
+ADMIN_MUTATION_ROUTES = [
+    '/admin/backup/create',
+    '/admin/toggle-tryouts',
+    '/admin/season/start',
+    '/admin/season/end',
+    '/admin/teams/wipe',
+]
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+# ---------------------------------------------------------------------------
+# Access control
+# ---------------------------------------------------------------------------
+
+
+class TestAdminAccessControl:
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_is_redirected_from_dashboard(self, client, as_role, role):
+        as_role(role)
+        response = client.get('/admin', follow_redirects=False)
+        assert _redirected(response), f'{role} reached /admin'
+
+    def test_admin_reaches_dashboard(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        assert response.status_code == 200
+
+    @pytest.mark.parametrize('route', ADMIN_MUTATION_ROUTES)
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_post_to_admin_routes(self, client, as_role, role, route):
+        as_role(role)
+        response = client.post(route, data={}, follow_redirects=False)
+        assert _redirected(response), f'{role} reached {route}'
+
+
+# ---------------------------------------------------------------------------
+# Dashboard rendering
+# ---------------------------------------------------------------------------
+
+
+class TestAdminDashboardRendering:
+    def test_dashboard_shows_stats(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        assert 'Total Users' in html
+        assert 'Players' in html
+        assert 'Org Teams' in html
+        assert 'Active Tryouts' in html
+
+    def test_dashboard_shows_tryout_status(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        # Either OPEN or CLOSED badge must be present
+        assert 'OPEN' in html or 'CLOSED' in html
+
+    def test_dashboard_shows_season_info(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        assert 'Season Management' in html
+        assert 'Name:' in html
+
+    def test_dashboard_shows_audit_log_section(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        assert 'Audit Log' in html
+
+    def test_dashboard_shows_backup_section(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        assert 'Manual Backup' in html
+        assert 'Backup History' in html
+
+
+# ---------------------------------------------------------------------------
+# Template integrity
+# ---------------------------------------------------------------------------
+
+
+class TestAdminTemplateIntegrity:
+    def test_page_returns_200(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        assert response.status_code == 200
+
+    def test_page_has_html_doctype(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert '<!DOCTYPE html>' in html or '<!doctype html>' in html.lower()
+
+    def test_all_buttons_are_present(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        # Key buttons that must exist
+        assert 'Create Backup Now' in html
+        assert 'Wipe Team Rosters' in html
+        # Toggle button text depends on state
+        assert 'Tryouts' in html or 'tryouts' in html.lower()
+
+    def test_all_forms_have_csrf_tokens(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+
+        # Count <form> tags and csrf_token occurrences
+        form_count = html.count('<form ')
+        csrf_count = html.count('csrf_token')
+        assert form_count > 0, 'No forms found on admin page'
+        assert csrf_count >= form_count, (
+            f'Found {form_count} forms but only {csrf_count} csrf_token(s)'
+        )
+
+    def test_static_css_loads(self, client):
+        response = client.get('/static/css/style.css')
+        assert response.status_code == 200
+        assert 'text/css' in response.content_type
+
+    def test_static_js_loads(self, client):
+        response = client.get('/static/js/main.js')
+        assert response.status_code == 200
+        assert 'javascript' in response.content_type or 'text/' in response.content_type

tests/test_admin_route_map.py

@@ -0,0 +1,50 @@
+"""Admin route registration — every endpoint must exist and require login.
+
+ADMIN-003. The admin blueprint registers 10 routes. If one is accidentally
+removed or renamed, the admin panel breaks silently. These tests walk the
+URL map to catch that.
+"""
+
+import pytest
+
+
+ADMIN_ROUTES = [
+    '/admin',
+    '/admin/backup/create',
+    '/admin/toggle-tryouts',
+    '/admin/toggle-document-uploads',
+    '/admin/season/start',
+    '/admin/season/end',
+    '/admin/teams/wipe',
+]
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+class TestAdminRouteRegistration:
+    @pytest.mark.parametrize('route', ADMIN_ROUTES)
+    def test_route_is_registered(self, app, route):
+        """Every admin endpoint must appear in the URL map."""
+        adapter = app.url_map.bind('localhost')
+        try:
+            adapter.match(route, method='GET')
+        except Exception:
+            # Some routes are POST-only; try POST
+            try:
+                adapter.match(route, method='POST')
+            except Exception as exc:
+                pytest.fail(f'Route {route} is not registered: {exc}')
+
+    @pytest.mark.parametrize('route', ADMIN_ROUTES)
+    def test_route_requires_login(self, client, route):
+        """Unauthenticated access must redirect to login."""
+        response = client.get(route, follow_redirects=False)
+        # POST-only routes return 405 on GET, which is fine — the point is
+        # they don't return 200 to an anonymous caller.
+        if response.status_code == 405:
+            return
+        assert _redirected(response), (
+            f'{route} answered {response.status_code} to an anonymous caller'
+        )

tests/test_admin_season.py

@@ -0,0 +1,172 @@
+"""Admin season lifecycle — start/end and gate on team matches.
+
+ADMIN-007. The season_active setting gates regular-season match scheduling
+for non-admins. These tests verify start/end season and the gate.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import AppSettings, OrgTeam, TeamMatch, User
+
+
+NON_ADMIN_ROLES = ['manager', 'coach']
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+# ---------------------------------------------------------------------------
+# Season lifecycle
+# ---------------------------------------------------------------------------
+
+
+class TestSeasonLifecycle:
+    def test_start_season_sets_fields(self, client, as_role):
+        as_role('admin')
+        client.post(
+            '/admin/season/start',
+            data={'season_name': 'Fall 2026', 'season_start': '2026-09-01'},
+            follow_redirects=False,
+        )
+        with client.application.app_context():
+            assert AppSettings.get('season_name') == 'Fall 2026'
+            assert AppSettings.get('season_start') == '2026-09-01'
+            assert AppSettings.get_bool('season_active', default=False)
+
+    def test_cannot_start_season_when_already_active(self, client, as_role):
+        as_role('admin')
+        client.post(
+            '/admin/season/start',
+            data={'season_name': 'Fall 2026', 'season_start': '2026-09-01'},
+        )
+        # Second start should be rejected
+        response = client.post(
+            '/admin/season/start',
+            data={'season_name': 'Spring 2027', 'season_start': '2027-01-01'},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'already active' in html.lower()
+
+    def test_start_season_creates_audit_log(self, client, as_role):
+        from app.models import AuditLog
+
+        as_role('admin')
+        client.post(
+            '/admin/season/start',
+            data={'season_name': 'Fall 2026', 'season_start': '2026-09-01'},
+        )
+        with client.application.app_context():
+            entry = AuditLog.query.filter_by(action='season_started').first()
+            assert entry is not None
+
+    def test_end_season_sets_end_date_and_deactivates(self, client, as_role):
+        as_role('admin')
+        client.post(
+            '/admin/season/start',
+            data={'season_name': 'Fall 2026', 'season_start': '2026-09-01'},
+        )
+        client.post(
+            '/admin/season/end',
+            data={'season_end': '2026-12-15'},
+            follow_redirects=False,
+        )
+        with client.application.app_context():
+            assert AppSettings.get('season_end') == '2026-12-15'
+            assert not AppSettings.get_bool('season_active', default=False)
+
+    def test_cannot_end_season_when_inactive(self, client, as_role):
+        as_role('admin')
+        # No season started
+        response = client.post(
+            '/admin/season/end',
+            data={'season_end': '2026-12-15'},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'no season is currently active' in html.lower()
+
+    def test_end_season_creates_audit_log(self, client, as_role):
+        from app.models import AuditLog
+
+        as_role('admin')
+        client.post(
+            '/admin/season/start',
+            data={'season_name': 'Fall 2026', 'season_start': '2026-09-01'},
+        )
+        client.post('/admin/season/end', data={'season_end': '2026-12-15'})
+        with client.application.app_context():
+            entry = AuditLog.query.filter_by(action='season_ended').first()
+            assert entry is not None
+
+
+# ---------------------------------------------------------------------------
+# Gate enforcement on team matches
+# ---------------------------------------------------------------------------
+
+
+class TestSeasonGateEnforcement:
+    @pytest.fixture
+    def org_team(self, app, client, as_role):
+        as_role('admin')
+        client.post(
+            '/teams/create',
+            data={'name': 'Varsity Test'},
+            follow_redirects=False,
+        )
+        with app.app_context():
+            return OrgTeam.query.filter_by(name='Varsity Test').first().id
+
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_create_match_when_season_inactive(
+        self, client, as_role, org_team, role
+    ):
+        as_role(role)
+        response = client.get(
+            f'/team-matches/{org_team}/create',
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'season is not active' in html.lower() or 'begin a season' in html.lower()
+
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_delete_match_when_season_inactive(
+        self, app, client, as_role, org_team, role, make_user
+    ):
+        # Create a match as admin (season active not required for admin)
+        as_role('admin')
+        # Start season so match can be created
+        client.post(
+            '/admin/season/start',
+            data={'season_name': 'Fall', 'season_start': '2026-09-01'},
+        )
+        client.post(
+            f'/team-matches/{org_team}/create',
+            data={'title': 'Match Test', 'date': '2026-10-01', 'start_time': '10:00'},
+            follow_redirects=False,
+        )
+        with app.app_context():
+            match_id = TeamMatch.query.filter_by(title='Match Test').first().id
+        # End season
+        client.post('/admin/season/end', data={'season_end': '2026-12-15'})
+
+        as_role(role)
+        response = client.post(
+            f'/team-matches/{match_id}/delete',
+            data={},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'season is not active' in html.lower() or 'begin a season' in html.lower()
+
+    def test_admin_can_always_schedule_match(self, client, as_role, org_team):
+        as_role('admin')
+        # No season active
+        response = client.post(
+            f'/team-matches/{org_team}/create',
+            data={'title': 'Admin Match', 'date': '2026-10-01', 'start_time': '10:00'},
+            follow_redirects=False,
+        )
+        assert _redirected(response)  # success, not blocked

tests/test_admin_template.py

@@ -0,0 +1,87 @@
+"""Admin panel UI — buttons, forms, tables, and image loading.
+
+ADMIN-010. This verifies the admin panel HTML structure: the stats grid,
+the tryout toggle button, the season form fields, the wipe confirmation
+input, and the backup/audit tables, plus that the logo image is served.
+"""
+
+import pytest
+
+
+class TestAdminStatsGrid:
+    def test_stats_grid_has_five_cards(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        # Each stat card contains a stat-icon and stat-info
+        assert html.count('stat-card') >= 5
+
+
+class TestAdminButtons:
+    def test_tryout_toggle_button_present(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'Open Tryouts' in html or 'Close Tryouts' in html
+
+    def test_backup_button_present(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'Create Backup Now' in html
+
+    def test_wipe_button_present(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'Wipe Team Rosters' in html
+
+    def test_season_button_present(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'Begin Season' in html or 'End Season' in html
+
+
+class TestAdminForms:
+    def test_season_form_has_name_and_date_fields(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'season_name' in html
+        assert 'season_start' in html or 'season_end' in html
+
+    def test_wipe_form_has_confirm_input(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'name="confirm"' in html
+        assert 'WIPE' in html
+
+
+class TestAdminTables:
+    def test_backup_table_columns(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'Filename' in html
+        assert 'Size' in html
+        assert 'Type' in html
+
+    def test_audit_log_table_columns(self, client, as_role):
+        as_role('admin')
+        response = client.get('/admin')
+        html = response.data.decode()
+        assert 'Action' in html
+        assert 'Details' in html
+
+
+class TestAdminImages:
+    def test_logo_image_loads(self, client):
+        response = client.get('/static/images/UdeS_logo.png')
+        assert response.status_code == 200
+
+    def test_esports_logo_image_loads(self, client):
+        # The original logo may still be referenced
+        response = client.get('/static/images/UdeS_logo.png')
+        assert response.status_code == 200

tests/test_admin_tryout_toggle.py

@@ -0,0 +1,156 @@
+"""Admin tryout toggle — open/close gate and enforcement on tryout routes.
+
+ADMIN-006. The tryouts_open setting gates every tryout mutation route for
+non-admins. Admins always bypass the lock. These tests verify the toggle
+itself and the gate on each affected route.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import AppSettings, Tryout, User
+
+
+NON_ADMIN_ROLES = ['manager', 'coach']
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+# ---------------------------------------------------------------------------
+# Toggle logic
+# ---------------------------------------------------------------------------
+
+
+class TestTryoutToggle:
+    def test_toggle_from_open_to_closed(self, client, as_role):
+        as_role('admin')
+        # Default is open
+        client.post('/admin/toggle-tryouts', data={}, follow_redirects=False)
+        # Now should be closed
+        with client.application.app_context():
+            assert not AppSettings.get_bool('tryouts_open', default=True)
+
+    def test_toggle_from_closed_to_open(self, client, as_role):
+        as_role('admin')
+        # Close first
+        client.post('/admin/toggle-tryouts', data={}, follow_redirects=False)
+        # Open again
+        client.post('/admin/toggle-tryouts', data={}, follow_redirects=False)
+        with client.application.app_context():
+            assert AppSettings.get_bool('tryouts_open', default=True)
+
+    def test_toggle_creates_audit_log(self, client, as_role):
+        from app.models import AuditLog
+
+        as_role('admin')
+        client.post('/admin/toggle-tryouts', data={}, follow_redirects=False)
+
+        with client.application.app_context():
+            entry = AuditLog.query.filter_by(action='tryouts_toggled').first()
+            assert entry is not None
+
+    def test_default_is_open(self, app):
+        with app.app_context():
+            assert AppSettings.get_bool('tryouts_open', default=True)
+
+
+# ---------------------------------------------------------------------------
+# Gate enforcement on tryout routes
+# ---------------------------------------------------------------------------
+
+
+class TestTryoutGateEnforcement:
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_create_tryout_when_closed(self, client, as_role, role):
+        as_role('admin')
+        client.post('/admin/toggle-tryouts', data={})  # close
+        as_role(role)
+        response = client.post(
+            '/tryouts/create',
+            data={'title': 'Test', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'closed' in html.lower() or 'open tryouts' in html.lower()
+
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_edit_tryout_when_closed(self, app, client, as_role, make_user, role):
+        # Create a tryout as admin first
+        as_role('admin')
+        client.post(
+            '/tryouts/create',
+            data={'title': 'Edit Test', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=False,
+        )
+        with app.app_context():
+            tryout_id = Tryout.query.filter_by(title='Edit Test').first().id
+
+        # Close tryouts
+        client.post('/admin/toggle-tryouts', data={})
+
+        # Try to edit as non-admin
+        as_role(role)
+        response = client.post(
+            f'/tryouts/{tryout_id}/edit',
+            data={'title': 'Hacked', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'closed' in html.lower() or 'open tryouts' in html.lower()
+
+    @pytest.mark.parametrize('role', NON_ADMIN_ROLES)
+    def test_non_admin_cannot_delete_tryout_when_closed(
+        self, app, client, as_role, make_user, role
+    ):
+        as_role('admin')
+        client.post(
+            '/tryouts/create',
+            data={'title': 'Delete Test', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=False,
+        )
+        with app.app_context():
+            tryout_id = Tryout.query.filter_by(title='Delete Test').first().id
+
+        client.post('/admin/toggle-tryouts', data={})  # close
+
+        as_role(role)
+        response = client.post(
+            f'/tryouts/{tryout_id}/delete',
+            data={},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'closed' in html.lower() or 'open tryouts' in html.lower()
+
+    def test_admin_can_always_create_tryout(self, client, as_role):
+        as_role('admin')
+        # Close tryouts
+        client.post('/admin/toggle-tryouts', data={})
+        # Admin should still be able to create
+        response = client.post(
+            '/tryouts/create',
+            data={'title': 'Admin Test', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=False,
+        )
+        assert _redirected(response)  # success redirect, not blocked
+
+    def test_admin_can_always_edit_tryout(self, app, client, as_role):
+        as_role('admin')
+        client.post(
+            '/tryouts/create',
+            data={'title': 'Admin Edit', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=False,
+        )
+        with app.app_context():
+            tryout_id = Tryout.query.filter_by(title='Admin Edit').first().id
+
+        client.post('/admin/toggle-tryouts', data={})  # close
+
+        response = client.post(
+            f'/tryouts/{tryout_id}/edit',
+            data={'title': 'Admin Edited', 'game': 'Valorant', 'date': '2026-12-01'},
+            follow_redirects=False,
+        )
+        assert _redirected(response)  # success, not blocked

tests/test_admin_wipe.py

@@ -0,0 +1,128 @@
+"""Admin team wipe — confirmation flow, data removal, and safety backup.
+
+ADMIN-009. The "Wipe Team Rosters" button must require typing WIPE,
+create a safety backup, and remove TeamPlayer + TeamMatch records while
+preserving OrgTeam structures.
+"""
+
+import pytest
+
+from app.extensions import db
+from app.models import (
+    AuditLog,
+    BackupRecord,
+    OrgTeam,
+    TeamMatch,
+    TeamMatchParticipant,
+    TeamPlayer,
+)
+
+
+def _redirected(response):
+    return response.status_code in (301, 302)
+
+
+class TestWipeConfirmation:
+    def test_wipe_without_confirmation_fails(self, app, client, as_role):
+        as_role('admin')
+        response = client.post(
+            '/admin/teams/wipe',
+            data={},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'WIPE' in html
+
+    def test_wipe_with_wrong_confirmation_fails(self, app, client, as_role):
+        as_role('admin')
+        response = client.post(
+            '/admin/teams/wipe',
+            data={'confirm': 'yes'},
+            follow_redirects=True,
+        )
+        html = response.data.decode()
+        assert 'WIPE' in html
+
+
+class TestWipeDataRemoval:
+    @pytest.fixture
+    def seeded_teams(self, app, client, as_role, make_user, monkeypatch):
+        import app.routes.admin as admin_module
+
+        # Mock the backup so the wipe proceeds without a real pg_dump.
+        def fake_create_backup_record(backup_type='pre_wipe', notes=None):
+            from app.models import BackupRecord
+
+            record = BackupRecord(
+                filename='db_backup_pre_wipe.dump',
+                file_path='/tmp/db_backup_pre_wipe.dump',
+                size_bytes=100,
+                backup_type=backup_type,
+                notes=notes,
+                created_by_id=1,
+            )
+            db.session.add(record)
+            db.session.commit()
+            return record
+
+        monkeypatch.setattr(admin_module, '_create_backup_record', fake_create_backup_record)
+
+        as_role('admin')
+        # Create an org team
+        client.post('/teams/create', data={'name': 'Wipe Team'}, follow_redirects=False)
+        with app.app_context():
+            team_id = OrgTeam.query.filter_by(name='Wipe Team').first().id
+
+        # Add a player to the team
+        player_id = make_user('player')
+        client.post(
+            f'/teams/{team_id}/add_player',
+            data={'player_id': str(player_id)},
+            follow_redirects=False,
+        )
+
+        # Create a team match
+        client.post(
+            f'/team-matches/{team_id}/create',
+            data={'title': 'Wipe Match', 'date': '2026-10-01', 'start_time': '10:00'},
+            follow_redirects=False,
+        )
+
+        return team_id
+
+    def test_wipe_removes_team_players(self, app, client, as_role, seeded_teams):
+        as_role('admin')
+        client.post('/admin/teams/wipe', data={'confirm': 'WIPE'}, follow_redirects=False)
+
+        with app.app_context():
+            assert TeamPlayer.query.count() == 0
+
+    def test_wipe_removes_team_matches(self, app, client, as_role, seeded_teams):
+        as_role('admin')
+        client.post('/admin/teams/wipe', data={'confirm': 'WIPE'}, follow_redirects=False)
+
+        with app.app_context():
+            assert TeamMatch.query.count() == 0
+
+    def test_wipe_preserves_org_team_structures(self, app, client, as_role, seeded_teams):
+        as_role('admin')
+        client.post('/admin/teams/wipe', data={'confirm': 'WIPE'}, follow_redirects=False)
+
+        with app.app_context():
+            assert OrgTeam.query.filter_by(name='Wipe Team').first() is not None
+
+    def test_wipe_creates_safety_backup(self, app, client, as_role, seeded_teams):
+        as_role('admin')
+        client.post('/admin/teams/wipe', data={'confirm': 'WIPE'}, follow_redirects=False)
+
+        with app.app_context():
+            safety = BackupRecord.query.filter_by(backup_type='pre_wipe').first()
+            assert safety is not None
+
+    def test_wipe_creates_audit_log(self, app, client, as_role, seeded_teams):
+        as_role('admin')
+        client.post('/admin/teams/wipe', data={'confirm': 'WIPE'}, follow_redirects=False)
+
+        with app.app_context():
+            entry = AuditLog.query.filter_by(action='teams_wiped').first()
+            assert entry is not None

tests/test_availability_views.py

@@ -0,0 +1,116 @@
+"""Tests for the hours column in the user list and the read-only
+availability grid on public profiles."""
+
+from datetime import time
+
+from app.extensions import db
+from app.models import (
+    CoachAvailability,
+    PlayerDisponibility,
+)
+
+
+class TestHoursColumn:
+    """The manage-users table shows available hours for players/coaches."""
+
+    def test_admin_sees_hours_header(self, app, client, as_role):
+        as_role('admin')
+        body = client.get('/users').get_data(as_text=True)
+        # Default locale is French, so _("Hours") renders as "Heures"
+        assert 'Heures' in body
+
+    def test_player_without_slots_shows_0(self, app, client, as_role, make_user):
+        as_role('admin')
+        make_user('player')  # create a player but stay logged in as admin
+        body = client.get('/users').get_data(as_text=True)
+        assert '0.0' in body
+
+    def test_player_with_slots_shows_hours(self, app, client, as_role, make_user):
+        as_role('admin')
+        player_id = make_user('player')
+        with app.app_context():
+            db.session.add(
+                PlayerDisponibility(
+                    player_id=player_id,
+                    day_of_week=0,
+                    start_time=time(17, 0),
+                    end_time=time(19, 0),
+                )
+            )
+            db.session.add(
+                PlayerDisponibility(
+                    player_id=player_id,
+                    day_of_week=1,
+                    start_time=time(18, 0),
+                    end_time=time(20, 0),
+                )
+            )
+            db.session.commit()
+
+        body = client.get('/users').get_data(as_text=True)
+        # 2h + 2h = 4.0
+        assert '4.0' in body
+
+    def test_coach_without_slots_shows_0(self, app, client, as_role, make_user):
+        as_role('admin')
+        make_user('coach')
+        body = client.get('/users').get_data(as_text=True)
+        assert '0.0' in body
+
+    def test_admin_roles_show_dash(self, app, client, as_role, make_user):
+        as_role('admin')
+        make_user('manager')
+        make_user('scout')
+        body = client.get('/users').get_data(as_text=True)
+        # managers and scouts should show mdash
+        assert '\u2014' in body
+
+
+class TestAvailabilityOnPublicProfile:
+    """view_user renders a weekly availability grid for players/coaches."""
+
+    def test_player_without_availability_shows_no_grid(self, app, client, as_role):
+        as_role('admin')
+        player_id = as_role('player')
+        body = client.get(f'/users/{player_id}/view').get_data(as_text=True)
+        # Default locale is French
+        assert 'Disponibilit\u00e9s' not in body
+
+    def test_player_with_slots_shows_grid(self, app, client, as_role, make_user):
+        as_role('admin')
+        player_id = make_user('player')
+        with app.app_context():
+            db.session.add(
+                PlayerDisponibility(
+                    player_id=player_id,
+                    day_of_week=2,
+                    start_time=time(18, 0),
+                    end_time=time(18, 30),
+                )
+            )
+            db.session.commit()
+        body = client.get(f'/users/{player_id}/view').get_data(as_text=True)
+        assert 'Disponibilit\u00e9s' in body
+        assert '18:00' in body
+
+    def test_coach_with_slots_shows_grid(self, app, client, as_role, make_user):
+        as_role('admin')
+        coach_id = make_user('coach')
+        with app.app_context():
+            db.session.add(
+                CoachAvailability(
+                    coach_id=coach_id,
+                    day_of_week=3,
+                    start_time=time(10, 0),
+                    end_time=time(10, 30),
+                )
+            )
+            db.session.commit()
+        body = client.get(f'/users/{coach_id}/view').get_data(as_text=True)
+        assert 'Disponibilit\u00e9s' in body
+        assert '10:00' in body
+
+    def test_admin_profile_shows_no_grid(self, app, client, as_role):
+        admin_id = as_role('admin')
+        body = client.get(f'/users/{admin_id}/view').get_data(as_text=True)
+        assert 'Disponibilit\u00e9s' not in body

tests/test_calendar_api.py

@@ -168,7 +168,7 @@ class TestTheWindow:
             '/matches/api/events?start=2030-05-01T00:00:00-04:00&end=2030-05-31T00:00:00-04:00'
         ).get_json()
 
-        assert _match_event(payload)['date'] == '2030-05-02'
+        assert _match_event(payload)['start'] == '2030-05-02T18:00:00'
 
     def test_a_match_outside_the_window_is_not(
         self, app, client, as_role, make_user, match_factory
@@ -192,7 +192,7 @@ class TestTheWindow:
 
         payload = client.get('/matches/api/events').get_json()
 
-        assert _match_event(payload)['date'] == '2030-05-02'
+        assert _match_event(payload)['start'] == '2030-05-02T18:00:00'
 
     def test_unparseable_bounds_are_ignored_rather_than_rejected(
         self, app, client, as_role, make_user, match_factory
@@ -206,7 +206,7 @@ class TestTheWindow:
         response = client.get('/matches/api/events?start=whenever&end=')
 
         assert response.status_code == 200
-        assert _match_event(response.get_json())['date'] == '2030-05-02'
+        assert _match_event(response.get_json())['start'] == '2030-05-02T18:00:00'
 
     def test_the_viewers_own_participation_still_comes_back(
         self, app, client, as_role, make_user, match_factory
@@ -258,3 +258,103 @@ class TestTheWindowParser:
             from flask import request
 
             assert calendar_window(request.args) == (None, None)
+
+
+class TestTimedEvents:
+    """Matches with time fields render on the clock, not as all-day."""
+
+    def test_timed_match_has_start_and_end(self, app, client, as_role, make_user, match_factory):
+        player_id = make_user('player')
+        admin_id = as_role('admin')
+        match_factory(admin_id, player_id)
+
+        ev = _match_event(client.get('/matches/api/events').get_json())
+
+        assert ev['start'] == '2030-05-02T18:00:00'
+        assert ev['end'] == '2030-05-02T19:00:00'
+        assert ev['allDay'] is False
+
+    def test_allday_match_has_date_when_no_time(
+        self, app, client, as_role, make_user, match_factory
+    ):
+        from datetime import date
+
+        from app.extensions import db
+        from app.models import Match, MatchParticipant, Tryout, TryoutRegistration
+
+        player_id = make_user('player')
+        admin_id = as_role('admin')
+
+        with app.app_context():
+            tryout = Tryout(
+                title='All-day tryout',
+                game='Valorant',
+                date=date(2030, 5, 1),
+                created_by=admin_id,
+                status='upcoming',
+            )
+            db.session.add(tryout)
+            db.session.flush()
+            db.session.add(TryoutRegistration(tryout_id=tryout.id, player_id=player_id))
+
+            match = Match(
+                tryout_id=tryout.id,
+                title='All-day scrim',
+                description=None,
+                date=date(2030, 5, 2),
+                start_time=None,
+                end_time=None,
+                match_type='player_scrim',
+                created_by=admin_id,
+            )
+            db.session.add(match)
+            db.session.flush()
+            db.session.add(MatchParticipant(match_id=match.id, player_id=player_id))
+            db.session.commit()
+
+        payload = client.get('/matches/api/events').get_json()
+        ev = next(e for e in payload if e['title'] == 'All-day scrim')
+
+        assert ev['date'] == '2030-05-02'
+        assert ev['allDay'] is True
+        assert 'start' not in ev
+
+
+class TestTeamMatchCalendarEvents:
+    """Regular-season team matches appear on the main calendar."""
+
+    def test_team_matches_appear_for_admin(self, app, client, as_role, make_user):
+        from datetime import date, time
+
+        from app.extensions import db
+        from app.models import OrgTeam, TeamMatch
+
+        admin_id = as_role('admin')
+        with app.app_context():
+            team = OrgTeam(name='Test Org', created_by=admin_id)
+            db.session.add(team)
+            db.session.flush()
+            tm = TeamMatch(
+                org_team_id=team.id,
+                title='Semifinal',
+                opponent='Enemy Team',
+                date=date(2030, 6, 15),
+                start_time=time(20, 0),
+                end_time=time(21, 30),
+                location='Main arena',
+                status='scheduled',
+                created_by=admin_id,
+            )
+            db.session.add(tm)
+            db.session.commit()
+
+        payload = client.get('/matches/api/events').get_json()
+        team_events = [e for e in payload if e['type'] == 'team_match']
+
+        assert len(team_events) == 1
+        ev = team_events[0]
+        assert ev['title'] == 'Semifinal'
+        assert ev['start'] == '2030-06-15T20:00:00'
+        assert ev['allDay'] is False
+        assert ev['extendedProps']['org_team'] == 'Test Org'
+        assert ev['extendedProps']['opponent'] == 'Enemy Team'

tests/test_contract_uploads.py

@@ -14,13 +14,25 @@ import io
 import os
 
 import pytest
+from pypdf import PdfWriter as _Pw
 
 from app.extensions import db
 from app.models import Contract
 
-PDF_BYTES = b'%PDF-1.7\n1 0 obj\n<<>>\nendobj\ntrailer\n%%EOF\n'
+
+def _valid_pdf_bytes():
+    w = _Pw()
+    w.add_blank_page(612, 792)
+    buf = io.BytesIO()
+    w.write(buf)
+    return buf.getvalue()
+
+
+_PDF_BYTES = _valid_pdf_bytes()
 NOT_PDF_BYTES = b'MZ\x90\x00\x03\x00\x00\x00'  # a Windows executable header
 
+PDF_HEADER_ONLY_BYTES = b'%PDF-1.7\n' + b'MZ' * 100  # PDF header over non-PDF content
+
 
 @pytest.fixture
 def contract_for(app, tmp_path):
@@ -29,7 +41,7 @@ def contract_for(app, tmp_path):
     def _make(player_id, uploader_id):
         stored = 'deadbeef.pdf'
         path = tmp_path / stored
-        path.write_bytes(PDF_BYTES)
+        path.write_bytes(_PDF_BYTES)
         with app.app_context():
             contract = Contract(
                 player_id=player_id,
@@ -89,7 +101,7 @@ class TestSignedUpload:
 
         client.post(
             f'/users/contracts/{contract_id}/upload_signed',
-            data={'signed_file': (io.BytesIO(PDF_BYTES), 'signed.pdf')},
+            data={'signed_file': (io.BytesIO(_PDF_BYTES), 'signed.pdf')},
             content_type='multipart/form-data',
             follow_redirects=True,
         )
@@ -110,7 +122,7 @@ class TestSignedUpload:
 
         client.post(
             f'/users/contracts/{contract_id}/upload_signed',
-            data={'signed_file': (io.BytesIO(PDF_BYTES), 'signed.pdf')},
+            data={'signed_file': (io.BytesIO(_PDF_BYTES), 'signed.pdf')},
             content_type='multipart/form-data',
             follow_redirects=True,
         )
@@ -118,6 +130,31 @@ class TestSignedUpload:
         with app.app_context():
             assert db.session.get(Contract, contract_id).status != 'signed'
 
+    def test_signed_upload_with_google_drive(
+        self, app, client, as_role, make_user, contract_for, monkeypatch
+    ):
+        """Signing with Drive backend stores gdrive://<id> in signed_file_path."""
+        monkeypatch.setenv('DOCUMENT_STORAGE_BACKEND', 'google_drive')
+        monkeypatch.setattr(
+            'app.storage.upload_google_drive_file',
+            lambda **_kwargs: 'drive-signed-456',
+        )
+        player_id = as_role('player')
+        admin_id = make_user('admin')
+        contract_id, directory = contract_for(player_id, admin_id)
+
+        client.post(
+            f'/users/contracts/{contract_id}/upload_signed',
+            data={'signed_file': (io.BytesIO(_PDF_BYTES), 'signed.pdf')},
+            content_type='multipart/form-data',
+            follow_redirects=True,
+        )
+
+        with app.app_context():
+            contract = db.session.get(Contract, contract_id)
+            assert contract.status == 'signed'
+            assert contract.signed_file_path == 'gdrive://drive-signed-456'
+
 
 class TestTheHelper:
     def test_it_reports_a_missing_file(self, app):
@@ -133,16 +170,27 @@ class TestTheHelper:
 
         from app.routes.users import ALLOWED_CONTRACT_EXTENSIONS, pdf_upload_error
 
-        upload = FileStorage(stream=io.BytesIO(PDF_BYTES), filename='c.pdf')
+        upload = FileStorage(stream=io.BytesIO(_PDF_BYTES), filename='c.pdf')
         with app.test_request_context('/'):
             assert pdf_upload_error(upload, ALLOWED_CONTRACT_EXTENSIONS) is None
-        assert upload.stream.read() == PDF_BYTES
+        assert upload.stream.read() == _PDF_BYTES
 
     def test_a_name_without_a_dot_is_refused(self, app):
         from werkzeug.datastructures import FileStorage
 
         from app.routes.users import ALLOWED_CONTRACT_EXTENSIONS, pdf_upload_error
 
-        upload = FileStorage(stream=io.BytesIO(PDF_BYTES), filename='pdf')
+        upload = FileStorage(stream=io.BytesIO(_PDF_BYTES), filename='pdf')
+        with app.test_request_context('/'):
+            assert pdf_upload_error(upload, ALLOWED_CONTRACT_EXTENSIONS)
+
+    def test_a_header_only_file_is_refused(self, app):
+        """A stream starting with %PDF- but holding non-PDF data is
+        rejected (the header check is not enough)."""
+        from werkzeug.datastructures import FileStorage
+
+        from app.routes.users import ALLOWED_CONTRACT_EXTENSIONS, pdf_upload_error
+
+        upload = FileStorage(stream=io.BytesIO(PDF_HEADER_ONLY_BYTES), filename='clever.pdf')
         with app.test_request_context('/'):
             assert pdf_upload_error(upload, ALLOWED_CONTRACT_EXTENSIONS)

tests/test_csp.py

@@ -126,14 +126,6 @@ class TestInlineHandlerRatchet:
         assert "' + playerName + '" not in content
         assert content.count('escapeHtml(playerName)') == 6
 
-    def test_api_messages_are_written_as_text(self):
-        template = os.path.join(TEMPLATE_ROOT, 'pages', 'coach_availability.html')
-        with open(template, encoding='utf-8') as handle:
-            content = handle.read()
-
-        assert 'text.textContent = message' in content
-        assert "alert.innerHTML = '<span>' + message" not in content
-
     @pytest.mark.parametrize('relative,full', list(_templates()))
     def test_a_template_never_gains_an_inline_handler(self, relative, full):
         allowed = HANDLER_BUDGET.get(relative, 0)

tests/test_database_url.py

@@ -1,17 +1,17 @@
 """Which PostgreSQL driver the application actually asks for — QUA-001.
 
 `postgresql://…` is not "whichever driver is installed". SQLAlchemy reads it
-as psycopg2 and imports that module when the engine is created.
-requirements.txt pins psycopg 3 and no psycopg2, so a clean install against
-the URL Render hands out — the same form docs/database-restore.md documents
-— fails before the first request:
+as psycopg2 unless the URL names a driver. requirements.txt declares psycopg
+3, so create_app() must explicitly select it.
 
-    ModuleNotFoundError: No module named 'psycopg2'
-
-create_app() now names the driver. These tests pin that down, and the last
-one proves the failure is real rather than theoretical.
+The test suite must not assume that psycopg2 is absent: a developer's virtual
+environment can contain optional packages in addition to the declared
+dependencies. These tests instead pin the application's selected driver and
+the dependency contract that production installs use.
 """
 
+from pathlib import Path
+
 import pytest
 from sqlalchemy import create_engine
 
@@ -80,16 +80,13 @@ class TestTheFactory:
         assert app.config['SQLALCHEMY_DATABASE_URI'].startswith('sqlite:///')
 
 
-class TestTheFailureIsReal:
-    """Not a hypothetical: this is what the deployed configuration did."""
+class TestDriverContract:
+    def test_production_dependencies_select_psycopg_3(self):
+        requirements = Path(__file__).resolve().parents[1] / 'requirements.txt'
+        declared = requirements.read_text(encoding='utf-8')
 
-    def test_psycopg2_is_not_installed(self):
-        with pytest.raises(ImportError):
-            import psycopg2  # noqa: F401
-
-    def test_a_driverless_url_cannot_build_an_engine(self):
-        with pytest.raises(ModuleNotFoundError):
-            create_engine('postgresql://u:p@host/db')
+        assert 'psycopg[binary]==' in declared
+        assert 'psycopg2' not in declared
 
     def test_the_normalised_url_can(self):
         engine = create_engine(normalise_database_url('postgresql://u:p@host/db'))