Le site s'affiche desormais en francais par defaut, avec un selecteur de langue permettant de basculer vers l'anglais. Choix de conception : les chaines sources restent en anglais Elles servent d'identifiants gettext, et le francais est fourni par catalogue avec BABEL_DEFAULT_LOCALE = 'fr'. Le code reste ainsi dans une seule langue -- la meme que ses commentaires et docstrings -- tandis que ce qu'un membre voit est du francais. Consequence qui rend la migration praticable : une chaine non encore traduite retombe en anglais, pas sur un identifiant brut. Les gabarits peuvent donc etre migres un par un sans jamais laisser le site a moitie casse. Selection de la langue (app/i18n.py) 1. choix explicite via le selecteur, garde en session 2. sinon en-tete Accept-Language du navigateur, restreint a fr et en 3. sinon francais Un choix explicite prime toujours, y compris sur un navigateur anglophone. Selecteur Extrait en partiel et inclus dans les deux branches de la mise en page : barre laterale une fois connecte, ET page d'authentification. Quelqu'un qui ne lit pas la langue courante doit pouvoir en changer AVANT de se connecter -- le laisser derriere l'authentification aurait ete un defaut d'accessibilite. Chaque langue est ecrite dans sa propre langue. La route /lang/<locale> valide le Referer avant de rediriger : sans ce controle, elle constituait une redirection ouverte. Migre dans cette passe navigation complete, page de connexion, les cinq pages d'erreur, et l'integralite des messages flash de routes/auth.py. 64 chaines, dont aucune non traduite. Verification 25 tests, dont deux garde-fous d'integrite : un catalogue .mo manquant ou une entree non traduite font echouer la suite. Sans cela, une compilation oubliee servirait de l'anglais partout, en silence et sans rien dans les journaux. Un test existant a du etre corrige, et c'est instructif test_login_failure_message_does_not_reveal_account_existence cherchait la sous-chaine anglaise 'attempt(s) remaining'. La page etant desormais en francais, elle etait absente des deux cotes, l'assertion passait, et le mode strict a signale le faux succes. Le test comparait donc l'anglais, pas le comportement. Il compare desormais les messages flash rendus, quelle que soit la langue. La faille SEC-AUTH-006 reste ouverte, et le test la documente toujours. Les catalogues .po ET .mo sont versionnes : le deploiement est un simple miroir de fichiers, sans etape de compilation. messages.pot, regenerable, ne l'est pas. docs/translations.md documente le processus, les deux pieges (concatenation de phrases, traduction a l'import), et l'etat de la migration. A noter pour la suite : les chaines dans les blocs <script> ne peuvent pas etre balisees telles quelles, il faudra les passer par des attributs data- -- ce qui rejoint le chantier de sortie de unsafe-inline (OPS-010). Co-Authored-By: Claude Opus 5 <[email protected]>
164 lines
7.4 KiB
Python
164 lines
7.4 KiB
Python
"""Main dashboard routes for the Team Tryouts application.
|
|
|
|
Uses polymorphic isinstance checks instead of role-string comparisons.
|
|
"""
|
|
|
|
from flask import Blueprint, render_template, redirect, url_for, flash, request
|
|
from flask_login import login_required, current_user
|
|
from app.extensions import db
|
|
from app.models import (
|
|
Admin, Manager, Coach, Player, Scout,
|
|
User, Tryout, Evaluation, TryoutRegistration, TeamMember,
|
|
Match, MatchParticipant, OrgTeam,
|
|
)
|
|
from sqlalchemy import func
|
|
from datetime import date
|
|
|
|
main_bp = Blueprint('main', __name__)
|
|
|
|
|
|
@main_bp.route('/')
|
|
def index():
|
|
"""Redirect root URL to login page."""
|
|
return redirect(url_for('auth.login'))
|
|
|
|
|
|
@main_bp.route('/lang/<locale>')
|
|
def set_language(locale):
|
|
"""Switch the interface language and return where the user came from.
|
|
|
|
Available to anonymous visitors too: the login page has to be readable
|
|
before anyone can sign in.
|
|
|
|
A GET link rather than a form: the only thing a forged request could
|
|
achieve is changing the visitor's own display language, which carries
|
|
no consequence worth a token. The redirect target is still validated —
|
|
an unchecked `Referer` would make this an open redirect.
|
|
"""
|
|
from app.i18n import set_locale
|
|
from app.routes.auth import is_safe_url
|
|
|
|
if not set_locale(locale):
|
|
flash('That language is not available.', 'warning')
|
|
|
|
target = request.referrer
|
|
if target and is_safe_url(target):
|
|
return redirect(target)
|
|
return redirect(url_for('main.dashboard') if current_user.is_authenticated
|
|
else url_for('auth.login'))
|
|
|
|
|
|
@main_bp.route('/dashboard')
|
|
@login_required
|
|
def dashboard():
|
|
"""Render the main dashboard with role-specific statistics.
|
|
|
|
Each User subclass provides its own stats view.
|
|
"""
|
|
user = current_user
|
|
stats = {}
|
|
|
|
if isinstance(user, Admin):
|
|
stats['total_users'] = User.query.count()
|
|
stats['total_players'] = User.query.filter_by(role='player').count()
|
|
stats['total_tryouts'] = Tryout.query.count()
|
|
stats['total_evaluations'] = Evaluation.query.count()
|
|
stats['active_tryouts'] = Tryout.query.filter_by(status='in_progress').count()
|
|
stats['completed_tryouts'] = Tryout.query.filter_by(status='completed').count()
|
|
stats['recent_users'] = User.query.order_by(User.created_at.desc()).limit(10).all()
|
|
stats['recent_tryouts'] = Tryout.query.order_by(Tryout.created_at.desc()).limit(10).all()
|
|
today = date.today()
|
|
stats['upcoming_matches'] = Match.query.filter(
|
|
Match.status == 'scheduled', Match.date >= today,
|
|
).order_by(Match.date, Match.start_time).limit(5).all()
|
|
|
|
elif isinstance(user, Manager):
|
|
stats['total_tryouts'] = Tryout.query.filter_by(created_by=user.id).count()
|
|
stats['active_tryouts'] = Tryout.query.filter_by(
|
|
created_by=user.id, status='in_progress').count()
|
|
stats['total_evaluations'] = Evaluation.query.filter_by(evaluator_id=user.id).count()
|
|
stats['my_tryouts'] = Tryout.query.filter_by(
|
|
created_by=user.id).order_by(Tryout.date.desc()).limit(5).all()
|
|
today = date.today()
|
|
manager_tryout_ids = [t.id for t in Tryout.query.filter_by(created_by=user.id).all()]
|
|
stats['upcoming_matches'] = Match.query.filter(
|
|
Match.tryout_id.in_(manager_tryout_ids),
|
|
Match.status == 'scheduled', Match.date >= today,
|
|
).order_by(Match.date, Match.start_time).limit(5).all() if manager_tryout_ids else []
|
|
|
|
elif isinstance(user, Coach):
|
|
stats['my_evaluations'] = Evaluation.query.filter_by(evaluator_id=user.id).count()
|
|
registrations = TryoutRegistration.query.filter(
|
|
TryoutRegistration.status.in_(['registered', 'attended'])).all()
|
|
registered_player_ids = [r.player_id for r in registrations]
|
|
evaluated_player_ids = [e.player_id for e in Evaluation.query.filter_by(evaluator_id=user.id).all()]
|
|
stats['pending_evaluations'] = len(set(registered_player_ids) - set(evaluated_player_ids))
|
|
stats['my_recent_evaluations'] = Evaluation.query.filter_by(
|
|
evaluator_id=user.id).order_by(Evaluation.created_at.desc()).limit(10).all()
|
|
today = date.today()
|
|
org_team = OrgTeam.query.filter_by(coach_id=user.id).first()
|
|
coach_tryout_ids = [t.id for t in Tryout.query.filter_by(
|
|
target_org_team_id=org_team.id).all()] if org_team else []
|
|
stats['upcoming_matches'] = Match.query.filter(
|
|
Match.tryout_id.in_(coach_tryout_ids),
|
|
Match.status == 'scheduled', Match.date >= today,
|
|
).order_by(Match.date, Match.start_time).limit(5).all() if coach_tryout_ids else []
|
|
|
|
elif isinstance(user, Player):
|
|
stats['my_tryouts'] = TryoutRegistration.query.filter_by(player_id=user.id).count()
|
|
stats['my_registrations'] = TryoutRegistration.query.filter_by(
|
|
player_id=user.id).order_by(TryoutRegistration.registered_at.desc()).limit(5).all()
|
|
|
|
today = date.today()
|
|
next_matches = []
|
|
all_registrations = TryoutRegistration.query.filter_by(player_id=user.id).all()
|
|
registered_tryout_ids = [r.tryout_id for r in all_registrations]
|
|
player_participant_matches = MatchParticipant.query.filter_by(player_id=user.id).all()
|
|
player_match_ids = [p.match_id for p in player_participant_matches]
|
|
player_team_memberships = TeamMember.query.filter_by(player_id=user.id).all()
|
|
player_team_ids = [tm.team_id for tm in player_team_memberships]
|
|
|
|
upcoming_matches = Match.query.filter(
|
|
Match.tryout_id.in_(registered_tryout_ids),
|
|
Match.status == 'scheduled', Match.date >= today,
|
|
).order_by(Match.date, Match.start_time).all()
|
|
|
|
for match in upcoming_matches:
|
|
is_participant = False
|
|
team = None
|
|
if match.match_type == 'team_vs_team':
|
|
if match.team1_id in player_team_ids:
|
|
is_participant = True
|
|
team = next((tm for tm in player_team_memberships
|
|
if tm.team_id == match.team1_id), None)
|
|
elif match.team2_id in player_team_ids:
|
|
is_participant = True
|
|
team = next((tm for tm in player_team_memberships
|
|
if tm.team_id == match.team2_id), None)
|
|
else:
|
|
if match.id in player_match_ids:
|
|
is_participant = True
|
|
|
|
if is_participant:
|
|
next_matches.append({
|
|
'tryout': match.tryout, 'match': match,
|
|
'team': team.team if team else None,
|
|
})
|
|
|
|
stats['next_matches'] = next_matches
|
|
|
|
elif isinstance(user, Scout):
|
|
stats['total_players'] = User.query.filter_by(role='player').count()
|
|
stats['total_evaluations'] = Evaluation.query.count()
|
|
stats['avg_scores'] = db.session.query(
|
|
Evaluation.player_id,
|
|
func.avg(Evaluation.overall_score).label('avg_score'),
|
|
).group_by(Evaluation.player_id).order_by(
|
|
func.avg(Evaluation.overall_score).desc()).limit(5).all()
|
|
stats['top_players'] = []
|
|
for row in stats['avg_scores']:
|
|
p = User.query.get(row.player_id)
|
|
if p:
|
|
stats['top_players'].append((p, round(row.avg_score, 1)))
|
|
|
|
return render_template('pages/dashboard.html', user=user, stats=stats) |