Phase 3 : hardening qualite de code - typage strict, securite, dead code, a11y

Config strictement stricte partout (ruff, mypy --strict, bandit, vulture,
import-linter, eslint, stylelint), aucune regle desactivee "pour ne pas
casser le build" - l'existant a ete corrige pour la satisfaire plutot que
l'inverse. Hooks pre-commit locaux (language: system) bloquants.

- Typage mypy --strict propage a tout le moteur (db, screens, auth, core,
  ai, routes, puis publish/scripts/tests/app.py/build_css.py).
- Securite : fuite de handle fichier Windows corrigee dans l'export SCORM
  (routes/publish/export_scorm.py), CSRF/RNG non-crypto/xAPI documentes
  (# nosec, # NOSONAR justifies), nouveau db.json_for_script() (echappe
  "</script>" dans le JSON embarque en <script>, 25 sites).
- Architecture : imports circulaires/F811 nettoyes, contrats
  import-linter respectes, code mort retire (vulture).
- Accessibilite : 69 champs de formulaire sans label correctement
  associe corriges (for/id ou aria-label) sur 11 templates.
- ESLint/Stylelint : lot mecanique JS/CSS, regles ajustees puis
  appliquees (aucune desactivee sans verification individuelle).
- Tests : isolation du compte admin partage (nettoyage ponctuel +
  fixture de teardown automatique en filet de securite), suite complete
  verte (591 tests Python, 241 tests JS).
- SonarQube Community Build self-heberge (Docker + PostgreSQL) : rapport
  complet analyse point par point, faux positifs documentes.
- .gitattributes ajoute (LF force) : core.autocrlf=true sur cette machine
  faisait echouer ESLint (linebreak-style) via un bug connu de git
  (checkout "en place" qui ignore l'eol force sur un fichier deja
  present sur disque - contourne en supprimant puis recreant chaque
  fichier suivi).

djLint (H021, styles inline) volontairement saute pour ce commit -
backlog assume, deja documente, traite dans un lot separe.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

db/rows/delete_row.py

@@ -1,12 +1,17 @@
+from typing import Any
+
 from ..connection import connect
 from .ensure_player_id_column import ensure_player_id_column
-from .resolve_row_player_key import resolve_row_player_key, PLAYER_SHARED
+from .resolve_row_player_key import PLAYER_SHARED, resolve_row_player_key
 
 
-def delete_row(slug, definition, row_id, player_id=PLAYER_SHARED):
+def delete_row(slug: str, definition: dict[str, Any], row_id: int, player_id: str = PLAYER_SHARED) -> None:
     ensure_player_id_column(slug, definition["table_name"])
     key = resolve_row_player_key(definition, player_id)
     conn = connect(slug)
-    conn.execute(f"DELETE FROM {definition['table_name']} WHERE id = ? AND player_id = ?", (row_id, key))
+    conn.execute(
+        f"DELETE FROM {definition['table_name']} WHERE id = ? AND player_id = ?",  # nosec B608  # noqa: S608 - table_name vient de slugify()+prefixe obj_, jamais d'une entree brute ; valeurs parametrees (?)
+        (row_id, key),
+    )
     conn.commit()
     conn.close()

db/rows/ensure_player_id_column.py

@@ -1,7 +1,7 @@
 from ..connection import connect
 
 
-def ensure_player_id_column(slug, table_name):
+def ensure_player_id_column(slug: str, table_name: str) -> None:
     """Migration légère (même principe que ensure_field_bounds_schema.py) :
     ajoute player_id à la table d'un objet créé avant l'état par joueur
     (Phase 1) — ses lignes existantes deviennent implicitement

db/rows/get_row.py

@@ -1,9 +1,13 @@
+from typing import Any
+
 from ..connection import connect
 from .ensure_player_id_column import ensure_player_id_column
-from .resolve_row_player_key import resolve_row_player_key, PLAYER_SHARED
+from .resolve_row_player_key import PLAYER_SHARED, resolve_row_player_key
 
 
-def get_row(slug, definition, row_id, player_id=PLAYER_SHARED):
+def get_row(
+    slug: str, definition: dict[str, Any], row_id: int, player_id: str = PLAYER_SHARED
+) -> dict[str, Any] | None:
     """Filtre aussi par player_id (pas seulement id) : même si `row_id` est
     déjà un identifiant unique dans toute la table, ce garde-fou empêche un
     joueur de lire la ligne d'un AUTRE joueur en devinant/altérant un
@@ -13,7 +17,8 @@ def get_row(slug, definition, row_id, player_id=PLAYER_SHARED):
     key = resolve_row_player_key(definition, player_id)
     conn = connect(slug)
     row = conn.execute(
-        f"SELECT * FROM {definition['table_name']} WHERE id = ? AND player_id = ?", (row_id, key)
+        f"SELECT * FROM {definition['table_name']} WHERE id = ? AND player_id = ?",  # nosec B608  # noqa: S608 - table_name vient de slugify()+prefixe obj_, jamais d'une entree brute ; valeurs parametrees (?)
+        (row_id, key),
     ).fetchone()
     conn.close()
     return dict(row) if row else None

db/rows/insert_row.py

@@ -1,11 +1,15 @@
+from typing import Any, Mapping
+
 from ..connection import connect
 from ..quote_ident import quote_ident
-from .row_columns_and_values import row_columns_and_values
 from .ensure_player_id_column import ensure_player_id_column
-from .resolve_row_player_key import resolve_row_player_key, PLAYER_SHARED
+from .resolve_row_player_key import PLAYER_SHARED, resolve_row_player_key
+from .row_columns_and_values import row_columns_and_values
 
 
-def insert_row(slug, definition, form_data, player_id=PLAYER_SHARED):
+def insert_row(
+    slug: str, definition: dict[str, Any], form_data: Mapping[str, str], player_id: str = PLAYER_SHARED
+) -> int:
     """Feature 3 : enregistre en base les données saisies dans le formulaire
     généré à partir de la définition d'objet."""
     ensure_player_id_column(slug, definition["table_name"])
@@ -16,9 +20,9 @@ def insert_row(slug, definition, form_data, player_id=PLAYER_SHARED):
     conn = connect(slug)
     placeholders = ["?"] * len(cols)
     quoted_cols = ", ".join(quote_ident(c) for c in cols)
-    sql = f"INSERT INTO {definition['table_name']} ({quoted_cols}) VALUES ({', '.join(placeholders)})"
+    sql = f"INSERT INTO {definition['table_name']} ({quoted_cols}) VALUES ({', '.join(placeholders)})"  # nosec B608  # noqa: S608 - table_name vient de slugify()+prefixe obj_ (db/table_name_for.py) ; colonnes deja echappees via quote_ident() ; valeurs parametrees (?)
     conn.execute(sql, values)
-    new_id = conn.execute("SELECT last_insert_rowid() AS id").fetchone()["id"]
+    new_id = int(conn.execute("SELECT last_insert_rowid() AS id").fetchone()["id"])
     conn.commit()
     conn.close()
     return new_id

db/rows/list_rows.py

@@ -1,14 +1,17 @@
+from typing import Any
+
 from ..connection import connect
 from .ensure_player_id_column import ensure_player_id_column
-from .resolve_row_player_key import resolve_row_player_key, PLAYER_SHARED
+from .resolve_row_player_key import PLAYER_SHARED, resolve_row_player_key
 
 
-def list_rows(slug, definition, player_id=PLAYER_SHARED):
+def list_rows(slug: str, definition: dict[str, Any], player_id: str = PLAYER_SHARED) -> list[dict[str, Any]]:
     ensure_player_id_column(slug, definition["table_name"])
     key = resolve_row_player_key(definition, player_id)
     conn = connect(slug)
     rows = conn.execute(
-        f"SELECT * FROM {definition['table_name']} WHERE player_id = ? ORDER BY id DESC", (key,)
+        f"SELECT * FROM {definition['table_name']} WHERE player_id = ? ORDER BY id DESC",  # nosec B608  # noqa: S608 - table_name vient de slugify()+prefixe obj_, jamais d'une entree brute ; valeurs parametrees (?)
+        (key,),
     ).fetchall()
     conn.close()
     return [dict(r) for r in rows]

db/rows/relation_options.py

@@ -1,27 +0,0 @@
-from ..connection import connect
-from ..slugify import slugify
-from ..definitions.get_definition import get_definition
-from .ensure_player_id_column import ensure_player_id_column
-from .resolve_row_player_key import PLAYER_SHARED
-
-
-def relation_options(slug, related_definition_id):
-    """Lignes existantes d'un objet lié, pour peupler un <select> de
-    relation — toujours la vue "modèle"/créateur (PLAYER_SHARED), cette
-    fonction n'est utilisée que côté tableau de bord/éditeur, jamais
-    depuis la route publique /jouer/<slug>."""
-    related = get_definition(slug, related_definition_id)
-    ensure_player_id_column(slug, related["table_name"])
-    conn = connect(slug)
-    rows = conn.execute(
-        f"SELECT * FROM {related['table_name']} WHERE player_id = ? ORDER BY id", (PLAYER_SHARED,)
-    ).fetchall()
-    conn.close()
-    display_field = related["fields"][0]["name"] if related["fields"] else "id"
-    display_col = slugify(display_field).replace("-", "_")
-    options = []
-    for r in rows:
-        r = dict(r)
-        label = r.get(display_col, f"#{r['id']}")
-        options.append({"id": r["id"], "label": f"{label} (#{r['id']})"})
-    return options

db/rows/resolve_row_player_key.py

@@ -1,7 +1,9 @@
+from typing import Any
+
 PLAYER_SHARED = "__shared__"
 
 
-def resolve_row_player_key(definition, player_id):
+def resolve_row_player_key(definition: dict[str, Any], player_id: str) -> str:
     """Détermine le player_id à utiliser réellement pour lire/écrire les
     lignes de cet objet : celui du joueur (objet per_player=1, le cas par
     défaut — voir create_definition.py), ou toujours PLAYER_SHARED (objet

db/rows/row_columns_and_values.py

@@ -1,11 +1,16 @@
+from typing import Any, Mapping
+
 from ..slugify import slugify
 
 
-def row_columns_and_values(definition, form_data):
+def row_columns_and_values(
+    definition: dict[str, Any], form_data: Mapping[str, str]
+) -> tuple[list[str], list[int | float | str | None]]:
     """Traduit les données d'un formulaire généré en (colonnes, valeurs)
     prêtes pour un INSERT ou un UPDATE — factorisé pour que les deux
     partagent exactement la même logique de conversion de type."""
-    cols, values = [], []
+    cols: list[str] = []
+    values: list[int | float | str | None] = []
     for f in definition["fields"]:
         fname = slugify(f["name"]).replace("-", "_")
         if f["type"] == "relation":

db/rows/rows_referencing.py

@@ -1,32 +0,0 @@
-from ..connection import connect
-from ..quote_ident import quote_ident
-from ..slugify import slugify
-from ..definitions.definitions_referencing import definitions_referencing
-from ..definitions.get_definition import get_definition
-from .ensure_player_id_column import ensure_player_id_column
-from .resolve_row_player_key import PLAYER_SHARED
-
-
-def rows_referencing(slug, definition_id, row_id):
-    """Pour l'écran de suppression d'une ligne : liste, pour chaque objet
-    qui a une relation vers l'objet de cette ligne, combien de ses lignes
-    pointent vers CETTE ligne précise — pour avertir avant une suppression
-    qui laisserait des relations orphelines (aucune suppression en cascade
-    n'est faite automatiquement, par sécurité). Toujours la vue "modèle"/
-    créateur (PLAYER_SHARED), utilisée uniquement côté tableau de bord."""
-    refs = []
-    for d in definitions_referencing(slug, definition_id):
-        full = get_definition(slug, d["id"])
-        for f in full["fields"]:
-            if f["type"] == "relation" and f["relation_definition_id"] == definition_id:
-                col = slugify(f["name"]).replace("-", "_") + "_id"
-                ensure_player_id_column(slug, full["table_name"])
-                conn = connect(slug)
-                count = conn.execute(
-                    f"SELECT COUNT(*) AS c FROM {full['table_name']} WHERE {quote_ident(col)} = ? AND player_id = ?",
-                    (row_id, PLAYER_SHARED),
-                ).fetchone()["c"]
-                conn.close()
-                if count:
-                    refs.append({"definition_name": full["name"], "field_name": f["name"], "count": count})
-    return refs

db/rows/update_row.py

@@ -1,11 +1,15 @@
+from typing import Any, Mapping
+
 from ..connection import connect
 from ..quote_ident import quote_ident
-from .row_columns_and_values import row_columns_and_values
 from .ensure_player_id_column import ensure_player_id_column
-from .resolve_row_player_key import resolve_row_player_key, PLAYER_SHARED
+from .resolve_row_player_key import PLAYER_SHARED, resolve_row_player_key
+from .row_columns_and_values import row_columns_and_values
 
 
-def update_row(slug, definition, row_id, form_data, player_id=PLAYER_SHARED):
+def update_row(
+    slug: str, definition: dict[str, Any], row_id: int, form_data: Mapping[str, str], player_id: str = PLAYER_SHARED
+) -> None:
     """CRUD — Update : ré-enregistre une ligne existante avec les nouvelles
     valeurs saisies dans le même formulaire généré que pour la création.
     Filtre aussi par player_id (voir get_row.py — même garde-fou contre un
@@ -16,7 +20,7 @@ def update_row(slug, definition, row_id, form_data, player_id=PLAYER_SHARED):
     conn = connect(slug)
     set_clause = ", ".join(f"{quote_ident(c)} = ?" for c in cols)
     conn.execute(
-        f"UPDATE {definition['table_name']} SET {set_clause} WHERE id = ? AND player_id = ?",
+        f"UPDATE {definition['table_name']} SET {set_clause} WHERE id = ? AND player_id = ?",  # nosec B608  # noqa: S608 - table_name vient de slugify()+prefixe obj_ (db/table_name_for.py) ; set_clause deja echappe via quote_ident() ; valeurs parametrees (?)
         values + [row_id, key],
     )
     conn.commit()

db/rows/update_row_field.py

@@ -1,11 +1,20 @@
+from typing import Any
+
 from ..connection import connect
 from ..quote_ident import quote_ident
 from ..slugify import slugify
 from .ensure_player_id_column import ensure_player_id_column
-from .resolve_row_player_key import resolve_row_player_key, PLAYER_SHARED
+from .resolve_row_player_key import PLAYER_SHARED, resolve_row_player_key
 
 
-def update_row_field(slug, definition, row_id, field_def, new_value, player_id=PLAYER_SHARED):
+def update_row_field(
+    slug: str,
+    definition: dict[str, Any],
+    row_id: int,
+    field_def: dict[str, Any],
+    new_value: Any,
+    player_id: str = PLAYER_SHARED,
+) -> None:
     """Met à jour UNE SEULE colonne d'une ligne existante — utilisé par les
     actions "Modifier une donnée" du mode jouable, qui ne doivent jamais
     écraser les autres champs de la ligne (contrairement à update_row, qui
@@ -17,7 +26,7 @@ def update_row_field(slug, definition, row_id, field_def, new_value, player_id=P
     col = f"{fname}_id" if field_def["type"] == "relation" else fname
     conn = connect(slug)
     conn.execute(
-        f"UPDATE {definition['table_name']} SET {quote_ident(col)} = ? WHERE id = ? AND player_id = ?",
+        f"UPDATE {definition['table_name']} SET {quote_ident(col)} = ? WHERE id = ? AND player_id = ?",  # nosec B608  # noqa: S608 - table_name vient de slugify()+prefixe obj_ (db/table_name_for.py) ; col deja echappee via quote_ident() ; valeurs parametrees (?)
         (new_value, row_id, key),
     )
     conn.commit()