# Plateforme centralisée de tryouts

## Security Configuration

### Required Environment Variables

Before deploying, create a `.env` file which integrates everything in the .env.exemple.
Ensure you follow the comments of the exemple if you are to use this tool in production.


### Security Features Implemented

- **Rate Limiting**: Login endpoint limited to 10 requests per minute to prevent brute-force attacks
- **Secure Session Cookies**: HTTPSOnly, SameSite=Lax, and Secure flags enabled
- **CSRF Protection**: Enabled by default on all forms
- **HTTPS Enforcement**: Automatic redirect to HTTPS in production
- **Security Headers**: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, HSTS
- **Open Redirect Prevention**: URL validation on login redirect
- **Authorization Checks**: Proper ownership validation on all sensitive operations
- **nginx**: reverse-proxy and load balancer
- **Waitress WSGI**: Production ready WSGI   

### When true in .env:
- **Forces HTTPS only**
- **Forcer secure cookies**

## App details

### Code

- Full python backend using flask
- statics are pure HTML and CSS
- Some js to add logic to styling and showing certain pages/cards

### Functionalities

- **User base with sign-ins**: Forces users to create an account and register pertinent information for tryouts and teams. The admin can attribute them a role.
- **User-Role-Based Permissions**: admin - full acces, coach/manager - access to team management, player - views what he is registered in (no management), scout - view only
- **Tryout Management**: manage internal tryout teams, organise internal tryouts matches (3 formats, team vs team, PvP, scrim). Coaches can Evaluate players based on 10 criteria
- **Team Management**: manage teams for the season, create matches and practices. When planning a practice there will be a calendar showing player availabitlities slots to help chose a time
- **Coach and Player Availabilities**: Allow better planning for the coaches, and for players to book One on Ones with their coach.
- **Player Notes**: Coaches can give notes to their players. The players will see them and there is a history which keeps the most recent notes.
- **Team Notes**: Coaches can give notes to their teams, where all players from that team can see the note.
- **One on One**: Players can request a One on One meeting with their coach. This sends a discord dm to the coach to accept or refuse. The player is then notified of the response.
- **Availabilities**: Allow players and coach to enter the moments they are available. Allows for easier practice setup and One on One planning.


## Discord Integration

The application supports sending Discord direct messages to coaches when players request One on One sessions, 
when matches/tryouts/practices are created and a player is in it, and the players get match reminders 24h before a match.

When sending a **One on One** request, the coach can accept via the platform or react to the discord message to answer the booking request.
Same thing with **matches** and **practices**, the players can react or answer on the platform.

### Setup Instructions

#### 1. Create a Discord Bot (Not needed for UdeS user, the bot already exists)

1. Go to the [Discord Developer Portal](https://discord.com/developers/applications)
2. Create a new application
3. Go to the "Bot" tab and create a bot user
4. Copy the bot token - this will be your `DISCORD_BOT_TOKEN`
5. Enable the "Message Content Intent" under Privileged Gateway Intents (required for sending messages)

#### 2. Add Bot to your server

For the bot to send DMs:
1. Each user must have the bot added to their Discord server OR be friends with the bot
2. Users need to add their Discord User ID to their profile:
   - Enable Developer Mode in Discord (User Settings → Advanced → Developer Mode)
   - Right-click on their profile → Copy ID
   - Enter this numeric ID in the "Discord User ID" field in their profile settings


### How It Works

When a player submits a One on One request:
1. The system checks if the coach has a Discord User ID configured
2. If configured, a direct message is sent to the coach via the Discord bot

### Message Format

The Discord DM includes:
- Player name
- Team name
- Requested date and time slot
- Discussion points (if provided)
- Link to the application for approval/rejection
- Two provided reactions to accept or refuse via discord