79 lines
2.8 KiB
Markdown
79 lines
2.8 KiB
Markdown
### Plateforme centralisée de tryouts
|
|
|
|
## Security Configuration
|
|
|
|
### Required Environment Variables
|
|
|
|
Before deploying, create a `.env` file with the following:
|
|
|
|
```
|
|
# Flask Configuration (REQUIRED)
|
|
SECRET_KEY=your-secure-random-secret-key-here
|
|
|
|
# Production Settings
|
|
FLASK_DEBUG=false
|
|
FORCE_HTTPS=true
|
|
SESSION_COOKIE_SECURE=true
|
|
```
|
|
|
|
### Security Features Implemented
|
|
|
|
- **Rate Limiting**: Login endpoint limited to 10 requests per minute to prevent brute-force attacks
|
|
- **Secure Session Cookies**: HTTPOnly, SameSite=Lax, and Secure flags enabled
|
|
- **CSRF Protection**: Enabled by default on all forms
|
|
- **HTTPS Enforcement**: Automatic redirect to HTTPS in production
|
|
- **Security Headers**: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, HSTS
|
|
- **Open Redirect Prevention**: URL validation on login redirect
|
|
- **Authorization Checks**: Proper ownership validation on all sensitive operations
|
|
|
|
## Discord Integration for One on One Requests
|
|
|
|
The application supports sending Discord direct messages to coaches when players request One on One sessions.
|
|
|
|
### Setup Instructions
|
|
|
|
#### 1. Create a Discord Bot
|
|
|
|
1. Go to the [Discord Developer Portal](https://discord.com/developers/applications)
|
|
2. Create a new application
|
|
3. Go to the "Bot" tab and create a bot user
|
|
4. Copy the bot token - this will be your `DISCORD_BOT_TOKEN`
|
|
5. Enable the "Message Content Intent" under Privileged Gateway Intents (required for sending messages)
|
|
|
|
#### 2. Configure Environment Variables
|
|
|
|
Add the following to your `.env` file (create one if it doesn't exist):
|
|
|
|
```
|
|
DISCORD_BOT_TOKEN=your_bot_token_here
|
|
DISCORD_WEBHOOK_URL=optional_webhook_url_for_backup
|
|
```
|
|
|
|
- `DISCORD_BOT_TOKEN`: Required for sending direct messages to coaches
|
|
- `DISCORD_WEBHOOK_URL`: Optional fallback for webhook-based notifications
|
|
|
|
#### 3. Add Coaches to the Bot
|
|
|
|
For the bot to send DMs to coaches:
|
|
1. Each coach must have the bot added to their Discord server OR be friends with the bot
|
|
2. Coaches need to add their Discord User ID to their profile:
|
|
- Enable Developer Mode in Discord (User Settings → Advanced → Developer Mode)
|
|
- Right-click on their profile → Copy ID
|
|
- Enter this numeric ID in the "Discord User ID" field in their profile settings
|
|
|
|
### How It Works
|
|
|
|
When a player submits a One on One request:
|
|
1. The system checks if the coach has a Discord User ID configured
|
|
2. If configured, a direct message is sent to the coach via the Discord bot
|
|
3. If the bot fails or no Discord User ID is set, the system falls back to the webhook URL (if configured)
|
|
4. The message includes player name, team, requested date/time, and discussion points
|
|
|
|
### Message Format
|
|
|
|
The Discord DM includes:
|
|
- Player name
|
|
- Team name
|
|
- Requested date and time slot
|
|
- Discussion points (if provided)
|
|
- Link to the application for approval/rejection |