GGThedandClaude Opus 5
a793b7ed0d
SEC-AUTHZ-002. add_to_team recevait tryout_id et team_id independamment
dans l'URL, controlait l'autorisation sur le tryout, puis operait sur
l'equipe sans jamais etablir de lien entre les deux. Un gestionnaire du
tryout A pouvait donc modifier une equipe du tryout B.
Le lint pointait exactement dessus : `team` etait charge ligne 463 puis
jamais utilise. La correction automatique proposee etait de supprimer la
variable, ce qui aurait fait taire l'avertissement en cimentant la faille.
Elle est desormais utilisee pour ce a quoi elle servait.
Trois defauts sur la meme route, corriges ensemble :
- team.tryout_id != tryout_id repond maintenant 404
- seuls les joueurs inscrits au tryout peuvent rejoindre ses equipes
- int(player_id) sur une entree de formulaire brute levait ValueError,
donc une erreur 500, sur toute valeur non numerique
Nettoyage automatique par ruff : 34 imports et variables morts retires
sur l'ensemble du paquet. La suite de tests a servi de filet, elle passe
a l'identique avant et apres. Aucun changement de comportement.
A noter, OneOnOneRequestSchema figurait aussi parmi les imports morts :
c'est un quatrieme schema jamais appele, la route one_on_one validant ses
dates a la main. Unifier la validation reste a faire (ARCH-005).
Co-Authored-By: Claude Opus 5 <[email protected]>
139 lines
6.4 KiB
Python
139 lines
6.4 KiB
Python
"""Main dashboard routes for the Team Tryouts application.
|
|
|
|
Uses polymorphic isinstance checks instead of role-string comparisons.
|
|
"""
|
|
|
|
from flask import Blueprint, render_template, redirect, url_for
|
|
from flask_login import login_required, current_user
|
|
from app.extensions import db
|
|
from app.models import (
|
|
Admin, Manager, Coach, Player, Scout,
|
|
User, Tryout, Evaluation, TryoutRegistration, TeamMember,
|
|
Match, MatchParticipant, OrgTeam,
|
|
)
|
|
from sqlalchemy import func
|
|
from datetime import date
|
|
|
|
main_bp = Blueprint('main', __name__)
|
|
|
|
|
|
@main_bp.route('/')
|
|
def index():
|
|
"""Redirect root URL to login page."""
|
|
return redirect(url_for('auth.login'))
|
|
|
|
|
|
@main_bp.route('/dashboard')
|
|
@login_required
|
|
def dashboard():
|
|
"""Render the main dashboard with role-specific statistics.
|
|
|
|
Each User subclass provides its own stats view.
|
|
"""
|
|
user = current_user
|
|
stats = {}
|
|
|
|
if isinstance(user, Admin):
|
|
stats['total_users'] = User.query.count()
|
|
stats['total_players'] = User.query.filter_by(role='player').count()
|
|
stats['total_tryouts'] = Tryout.query.count()
|
|
stats['total_evaluations'] = Evaluation.query.count()
|
|
stats['active_tryouts'] = Tryout.query.filter_by(status='in_progress').count()
|
|
stats['completed_tryouts'] = Tryout.query.filter_by(status='completed').count()
|
|
stats['recent_users'] = User.query.order_by(User.created_at.desc()).limit(10).all()
|
|
stats['recent_tryouts'] = Tryout.query.order_by(Tryout.created_at.desc()).limit(10).all()
|
|
today = date.today()
|
|
stats['upcoming_matches'] = Match.query.filter(
|
|
Match.status == 'scheduled', Match.date >= today,
|
|
).order_by(Match.date, Match.start_time).limit(5).all()
|
|
|
|
elif isinstance(user, Manager):
|
|
stats['total_tryouts'] = Tryout.query.filter_by(created_by=user.id).count()
|
|
stats['active_tryouts'] = Tryout.query.filter_by(
|
|
created_by=user.id, status='in_progress').count()
|
|
stats['total_evaluations'] = Evaluation.query.filter_by(evaluator_id=user.id).count()
|
|
stats['my_tryouts'] = Tryout.query.filter_by(
|
|
created_by=user.id).order_by(Tryout.date.desc()).limit(5).all()
|
|
today = date.today()
|
|
manager_tryout_ids = [t.id for t in Tryout.query.filter_by(created_by=user.id).all()]
|
|
stats['upcoming_matches'] = Match.query.filter(
|
|
Match.tryout_id.in_(manager_tryout_ids),
|
|
Match.status == 'scheduled', Match.date >= today,
|
|
).order_by(Match.date, Match.start_time).limit(5).all() if manager_tryout_ids else []
|
|
|
|
elif isinstance(user, Coach):
|
|
stats['my_evaluations'] = Evaluation.query.filter_by(evaluator_id=user.id).count()
|
|
registrations = TryoutRegistration.query.filter(
|
|
TryoutRegistration.status.in_(['registered', 'attended'])).all()
|
|
registered_player_ids = [r.player_id for r in registrations]
|
|
evaluated_player_ids = [e.player_id for e in Evaluation.query.filter_by(evaluator_id=user.id).all()]
|
|
stats['pending_evaluations'] = len(set(registered_player_ids) - set(evaluated_player_ids))
|
|
stats['my_recent_evaluations'] = Evaluation.query.filter_by(
|
|
evaluator_id=user.id).order_by(Evaluation.created_at.desc()).limit(10).all()
|
|
today = date.today()
|
|
org_team = OrgTeam.query.filter_by(coach_id=user.id).first()
|
|
coach_tryout_ids = [t.id for t in Tryout.query.filter_by(
|
|
target_org_team_id=org_team.id).all()] if org_team else []
|
|
stats['upcoming_matches'] = Match.query.filter(
|
|
Match.tryout_id.in_(coach_tryout_ids),
|
|
Match.status == 'scheduled', Match.date >= today,
|
|
).order_by(Match.date, Match.start_time).limit(5).all() if coach_tryout_ids else []
|
|
|
|
elif isinstance(user, Player):
|
|
stats['my_tryouts'] = TryoutRegistration.query.filter_by(player_id=user.id).count()
|
|
stats['my_registrations'] = TryoutRegistration.query.filter_by(
|
|
player_id=user.id).order_by(TryoutRegistration.registered_at.desc()).limit(5).all()
|
|
|
|
today = date.today()
|
|
next_matches = []
|
|
all_registrations = TryoutRegistration.query.filter_by(player_id=user.id).all()
|
|
registered_tryout_ids = [r.tryout_id for r in all_registrations]
|
|
player_participant_matches = MatchParticipant.query.filter_by(player_id=user.id).all()
|
|
player_match_ids = [p.match_id for p in player_participant_matches]
|
|
player_team_memberships = TeamMember.query.filter_by(player_id=user.id).all()
|
|
player_team_ids = [tm.team_id for tm in player_team_memberships]
|
|
|
|
upcoming_matches = Match.query.filter(
|
|
Match.tryout_id.in_(registered_tryout_ids),
|
|
Match.status == 'scheduled', Match.date >= today,
|
|
).order_by(Match.date, Match.start_time).all()
|
|
|
|
for match in upcoming_matches:
|
|
is_participant = False
|
|
team = None
|
|
if match.match_type == 'team_vs_team':
|
|
if match.team1_id in player_team_ids:
|
|
is_participant = True
|
|
team = next((tm for tm in player_team_memberships
|
|
if tm.team_id == match.team1_id), None)
|
|
elif match.team2_id in player_team_ids:
|
|
is_participant = True
|
|
team = next((tm for tm in player_team_memberships
|
|
if tm.team_id == match.team2_id), None)
|
|
else:
|
|
if match.id in player_match_ids:
|
|
is_participant = True
|
|
|
|
if is_participant:
|
|
next_matches.append({
|
|
'tryout': match.tryout, 'match': match,
|
|
'team': team.team if team else None,
|
|
})
|
|
|
|
stats['next_matches'] = next_matches
|
|
|
|
elif isinstance(user, Scout):
|
|
stats['total_players'] = User.query.filter_by(role='player').count()
|
|
stats['total_evaluations'] = Evaluation.query.count()
|
|
stats['avg_scores'] = db.session.query(
|
|
Evaluation.player_id,
|
|
func.avg(Evaluation.overall_score).label('avg_score'),
|
|
).group_by(Evaluation.player_id).order_by(
|
|
func.avg(Evaluation.overall_score).desc()).limit(5).all()
|
|
stats['top_players'] = []
|
|
for row in stats['avg_scores']:
|
|
p = User.query.get(row.player_id)
|
|
if p:
|
|
stats['top_players'].append((p, round(row.avg_score, 1)))
|
|
|
|
return render_template('pages/dashboard.html', user=user, stats=stats) |