GGThedandClaude Opus 5
92d72e4d48
ARCH-002. La question "a quelles equipes ce coach est-il rattache ?" etait
posee a huit endroits, de cinq facons differentes, et trois d entre elles
donnaient une mauvaise reponse en production.
Le motif fautif, present tel quel dans six routes :
OrgTeam.query.filter_by(coach_id=user.id).first()
Il repond au plus une equipe, et seulement par la colonne heritee. Deux
pannes en decoulaient, silencieuses -- les pages s affichaient, vides :
- un coach rattache uniquement par la relation many-to-many n avait
aucune equipe, donc aucun joueur, aucun contrat, aucune note d equipe,
aucun match a venir sur son tableau de bord ;
- un coach de deux equipes n en voyait qu une. Le formulaire de contrat
lui proposait la moitie de son effectif, alors que la route POST
acceptait l autre moitie.
app/permissions.py devient le module ou la question se pose une fois :
coach_org_teams, manager_org_teams, attached_org_teams, visible_org_teams,
can_manage_org_team, org_team_player_ids, coach_player_ids,
can_manage_player_contract, coach_tryouts, coach_manages_tryout. Toutes
lisent les deux rattachements et toutes les equipes.
Le meme ecart existait dans le modele : Coach.get_visible_tryouts ne lisait
que la relation m2m -- calendrier vide pour un coach rattache par la
colonne -- et can_manage_this_tryout ignorait la colonne pour l equipe
cible. Les deux delegent desormais.
Corrections de portee, au passage
- one_on_one lisait org_team.coach_id : un joueur dont l equipe declare
ses coachs par la relation etait informe qu il n avait pas de coach, et
le formulaire de demande restait ferme. Passe par get_coaches(), qui
retombe deja sur la colonne heritee.
- notes_dashboard conditionnait les notes personnelles du coach a
l existence d une equipe : un coach sans equipe ne voyait pas ses
propres notes.
- can_manage_team_match reformulait can_manage_this_org_team ; la
reformulation avait derive. Elle appelle maintenant la regle.
Limite assumee : le panneau de notes d equipe reste ecrit pour une seule
equipe et affiche donc la premiere. La resolution est corrigee, la mise en
page multi-equipes ne l est pas -- c est un choix produit, pas un bug.
14 tests ajoutes. Cinq echouent sur le code d avant, verifie en remettant
les routes et le modele a leur etat precedent.
ARCH-001 fera disparaitre la colonne heritee ; cela demande une migration
de donnees, donc Alembic. D ici la, ce module est ce qui rend la
duplication inoffensive.
Co-Authored-By: Claude Opus 5 <[email protected]>
Plateforme centralisée de tryouts
Security Configuration
Required Environment Variables
Before deploying, create a .env file which integrates everything in the .env.exemple.
Ensure you follow the comments of the exemple if you are to use this tool in production.
Security Features Implemented
- Rate Limiting: Login endpoint limited to 10 requests per minute to prevent brute-force attacks
- Secure Session Cookies: HTTPSOnly, SameSite=Lax, and Secure flags enabled
- CSRF Protection: Enabled by default on all forms
- HTTPS Enforcement: Automatic redirect to HTTPS in production
- Security Headers: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, HSTS
- Open Redirect Prevention: URL validation on login redirect
- Authorization Checks: Proper ownership validation on all sensitive operations
- nginx: reverse-proxy and load balancer
- Waitress WSGI: Production ready WSGI
When true in .env:
- Forces HTTPS only
- Forcer secure cookies
App details
Code
- Full python backend using flask
- statics are pure HTML and CSS
- Some js to add logic to styling and showing certain pages/cards
Functionalities
- User base with sign-ins: Forces users to create an account and register pertinent information for tryouts and teams. The admin can attribute them a role.
- User-Role-Based Permissions: admin - full acces, coach/manager - access to team management, player - views what he is registered in (no management), scout - view only
- Tryout Management: manage internal tryout teams, organise internal tryouts matches (3 formats, team vs team, PvP, scrim). Coaches can Evaluate players based on 10 criteria
- Team Management: manage teams for the season, create matches and practices. When planning a practice there will be a calendar showing player availabitlities slots to help chose a time
- Coach and Player Availabilities: Allow better planning for the coaches, and for players to book One on Ones with their coach.
- Player Notes: Coaches can give notes to their players. The players will see them and there is a history which keeps the most recent notes.
- Team Notes: Coaches can give notes to their teams, where all players from that team can see the note.
- One on One: Players can request a One on One meeting with their coach. This sends a discord dm to the coach to accept or refuse. The player is then notified of the response.
- Availabilities: Allow players and coach to enter the moments they are available. Allows for easier practice setup and One on One planning.
Discord Integration
The application supports sending Discord direct messages to coaches when players request One on One sessions, when matches/tryouts/practices are created and a player is in it, and the players get match reminders 24h before a match.
When sending a One on One request, the coach can accept via the platform or react to the discord message to answer the booking request. Same thing with matches and practices, the players can react or answer on the platform.
Setup Instructions
1. Create a Discord Bot (Not needed for UdeS user, the bot already exists)
- Go to the Discord Developer Portal
- Create a new application
- Go to the "Bot" tab and create a bot user
- Copy the bot token - this will be your
DISCORD_BOT_TOKEN - Enable the "Message Content Intent" under Privileged Gateway Intents (required for sending messages)
2. Add Bot to your server
For the bot to send DMs:
- Each user must have the bot added to their Discord server OR be friends with the bot
- Users need to add their Discord User ID to their profile:
- Enable Developer Mode in Discord (User Settings → Advanced → Developer Mode)
- Right-click on their profile → Copy ID
- Enter this numeric ID in the "Discord User ID" field in their profile settings
How It Works
When a player submits a One on One request:
- The system checks if the coach has a Discord User ID configured
- If configured, a direct message is sent to the coach via the Discord bot
Message Format
The Discord DM includes:
- Player name
- Team name
- Requested date and time slot
- Discussion points (if provided)
- Link to the application for approval/rejection
- Two provided reactions to accept or refuse via discord