90 lines
4.3 KiB
Markdown
90 lines
4.3 KiB
Markdown
# Plateforme centralisée de tryouts
|
|
|
|
## Security Configuration
|
|
|
|
### Required Environment Variables
|
|
|
|
Before deploying, create a `.env` file which integrates everything in the .env.exemple.
|
|
Ensure you follow the comments of the exemple if you are to use this tool in production.
|
|
|
|
|
|
### Security Features Implemented
|
|
|
|
- **Rate Limiting**: Login endpoint limited to 10 requests per minute to prevent brute-force attacks
|
|
- **Secure Session Cookies**: HTTPSOnly, SameSite=Lax, and Secure flags enabled
|
|
- **CSRF Protection**: Enabled by default on all forms
|
|
- **HTTPS Enforcement**: Automatic redirect to HTTPS in production
|
|
- **Security Headers**: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, HSTS
|
|
- **Open Redirect Prevention**: URL validation on login redirect
|
|
- **Authorization Checks**: Proper ownership validation on all sensitive operations
|
|
- **nginx**: reverse-proxy and load balancer
|
|
- **Waitress WSGI**: Production ready WSGI
|
|
|
|
### When true in .env:
|
|
- **Forces HTTPS only**
|
|
- **Forcer secure cookies**
|
|
|
|
## App details
|
|
|
|
### Code
|
|
|
|
- Full python backend using flask
|
|
- statics are pure HTML and CSS
|
|
- Some js to add logic to styling and showing certain pages/cards
|
|
|
|
### Functionalities
|
|
|
|
- **User base with sign-ins**: Forces users to create an account and register pertinent information for tryouts and teams. The admin can attribute them a role.
|
|
- **User-Role-Based Permissions**: admin - full acces, coach/manager - access to team management, player - views what he is registered in (no management), scout - view only
|
|
- **Tryout Management**: manage internal tryout teams, organise internal tryouts matches (3 formats, team vs team, PvP, scrim). Coaches can Evaluate players based on 10 criteria
|
|
- **Team Management**: manage teams for the season, create matches and practices. When planning a practice there will be a calendar showing player availabitlities slots to help chose a time
|
|
- **Coach and Player Availabilities**: Allow better planning for the coaches, and for players to book One on Ones with their coach.
|
|
- **Player Notes**: Coaches can give notes to their players. The players will see them and there is a history which keeps the most recent notes.
|
|
- **Team Notes**: Coaches can give notes to their teams, where all players from that team can see the note.
|
|
- **One on One**: Players can request a One on One meeting with their coach. This sends a discord dm to the coach to accept or refuse. The player is then notified of the response.
|
|
- **Availabilities**: Allow players and coach to enter the moments they are available. Allows for easier practice setup and One on One planning.
|
|
|
|
|
|
## Discord Integration
|
|
|
|
The application supports sending Discord direct messages to coaches when players request One on One sessions,
|
|
when matches/tryouts/practices are created and a player is in it, and the players get match reminders 24h before a match.
|
|
|
|
When sending a **One on One** request, the coach can accept via the platform or react to the discord message to answer the booking request.
|
|
Same thing with **matches** and **practices**, the players can react or answer on the platform.
|
|
|
|
### Setup Instructions
|
|
|
|
#### 1. Create a Discord Bot (Not needed for UdeS user, the bot already exists)
|
|
|
|
1. Go to the [Discord Developer Portal](https://discord.com/developers/applications)
|
|
2. Create a new application
|
|
3. Go to the "Bot" tab and create a bot user
|
|
4. Copy the bot token - this will be your `DISCORD_BOT_TOKEN`
|
|
5. Enable the "Message Content Intent" under Privileged Gateway Intents (required for sending messages)
|
|
|
|
#### 2. Add Bot to your server
|
|
|
|
For the bot to send DMs:
|
|
1. Each user must have the bot added to their Discord server OR be friends with the bot
|
|
2. Users need to add their Discord User ID to their profile:
|
|
- Enable Developer Mode in Discord (User Settings → Advanced → Developer Mode)
|
|
- Right-click on their profile → Copy ID
|
|
- Enter this numeric ID in the "Discord User ID" field in their profile settings
|
|
|
|
|
|
### How It Works
|
|
|
|
When a player submits a One on One request:
|
|
1. The system checks if the coach has a Discord User ID configured
|
|
2. If configured, a direct message is sent to the coach via the Discord bot
|
|
|
|
### Message Format
|
|
|
|
The Discord DM includes:
|
|
- Player name
|
|
- Team name
|
|
- Requested date and time slot
|
|
- Discussion points (if provided)
|
|
- Link to the application for approval/rejection
|
|
- Two provided reactions to accept or refuse via discord |