Phase 3 : hardening qualite de code - typage strict, securite, dead code, a11y

Config strictement stricte partout (ruff, mypy --strict, bandit, vulture,
import-linter, eslint, stylelint), aucune regle desactivee "pour ne pas
casser le build" - l'existant a ete corrige pour la satisfaire plutot que
l'inverse. Hooks pre-commit locaux (language: system) bloquants.

- Typage mypy --strict propage a tout le moteur (db, screens, auth, core,
  ai, routes, puis publish/scripts/tests/app.py/build_css.py).
- Securite : fuite de handle fichier Windows corrigee dans l'export SCORM
  (routes/publish/export_scorm.py), CSRF/RNG non-crypto/xAPI documentes
  (# nosec, # NOSONAR justifies), nouveau db.json_for_script() (echappe
  "</script>" dans le JSON embarque en <script>, 25 sites).
- Architecture : imports circulaires/F811 nettoyes, contrats
  import-linter respectes, code mort retire (vulture).
- Accessibilite : 69 champs de formulaire sans label correctement
  associe corriges (for/id ou aria-label) sur 11 templates.
- ESLint/Stylelint : lot mecanique JS/CSS, regles ajustees puis
  appliquees (aucune desactivee sans verification individuelle).
- Tests : isolation du compte admin partage (nettoyage ponctuel +
  fixture de teardown automatique en filet de securite), suite complete
  verte (591 tests Python, 241 tests JS).
- SonarQube Community Build self-heberge (Docker + PostgreSQL) : rapport
  complet analyse point par point, faux positifs documentes.
- .gitattributes ajoute (LF force) : core.autocrlf=true sur cette machine
  faisait echouer ESLint (linebreak-style) via un bug connu de git
  (checkout "en place" qui ignore l'eol force sur un fichier deja
  present sur disque - contourne en supprimant puis recreant chaque
  fichier suivi).

djLint (H021, styles inline) volontairement saute pour ce commit -
backlog assume, deja documente, traite dans un lot separe.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

routes/scenes/__init__.py

@@ -1,13 +1,13 @@
-from . import (
+from . import (  # noqa: F401 - enregistre les routes definies dans chaque module
     scene_object_add,
-    scene_object_geometry,
-    scene_object_delete,
-    scene_object_personnage_data,
-    scene_object_commands,
-    scene_object_role,
     scene_object_collision,
-    scene_object_name,
+    scene_object_commands,
+    scene_object_delete,
     scene_object_dialogue_box_style,
-    scene_object_quiz_config,
+    scene_object_geometry,
+    scene_object_name,
     scene_object_names_list,
+    scene_object_personnage_data,
+    scene_object_quiz_config,
+    scene_object_role,
 )

routes/scenes/scene_edit_view.py

@@ -1,13 +1,13 @@
-import json
+from typing import Any
 
-from flask import render_template, request, abort, g, url_for
+from flask import abort, g, render_template, request, url_for
 
 import auth
 import db
 import screens
 
 
-def render_scene_edit(slug, screen_id, game):
+def render_scene_edit(slug: str, screen_id: int, game: dict[str, Any]) -> str:
     """Vue de l'éditeur de scène 2D — appelée par routes/screens/
     screen_edit.py (le dispatcher, selon screen["kind"]), PAS une route
     Flask elle-même : même URL/endpoint "screen_edit" pour les deux types
@@ -73,10 +73,7 @@ def render_scene_edit(slug, screen_id, game):
                 quiz_box_config = screens.resolve_quiz_box_config(selected_obj)
 
     _DEFAULT_OBJECT_LABELS = {"personnage": "Personnage", "fond": "Fond"}
-    object_labels = {
-        o["id"]: (o.get("name") or _DEFAULT_OBJECT_LABELS.get(o["kind"], "Décor"))
-        for o in objects
-    }
+    object_labels = {o["id"]: (o.get("name") or _DEFAULT_OBJECT_LABELS.get(o["kind"], "Décor")) for o in objects}
     element_animations_map = {
         o["id"]: screens.resolve_personnage_animations(o) for o in objects if o["kind"] == "personnage"
     }
@@ -134,13 +131,19 @@ def render_scene_edit(slug, screen_id, game):
 
     return render_template(
         "scene_edit.html",
-        game=game, screen=screen, all_screens=all_screens,
-        world_width=world_width, world_height=world_height,
+        game=game,
+        screen=screen,
+        all_screens=all_screens,
+        world_width=world_width,
+        world_height=world_height,
         any_quiz_box_fullscreen=any_quiz_box_fullscreen,
-        objects=objects, selected_id=selected_id, personnage_data=personnage_data,
+        objects=objects,
+        selected_id=selected_id,
+        personnage_data=personnage_data,
         personnage_commands=personnage_commands or screens.DEFAULT_PERSONNAGE_COMMANDS,
         personnage_role=personnage_role or screens.DEFAULT_PERSONNAGE_ROLE,
-        personnage_role_choices=screens.PERSONNAGE_ROLES, personnage_role_labels=screens.PERSONNAGE_ROLE_LABELS,
+        personnage_role_choices=screens.PERSONNAGE_ROLES,
+        personnage_role_labels=screens.PERSONNAGE_ROLE_LABELS,
         collision_settings=collision_settings or screens.DEFAULT_COLLISION_SETTINGS,
         dialogue_box_style=dialogue_box_style or screens.DEFAULT_DIALOGUE_BOX_STYLE,
         dialogue_box_font_weight_choices=screens.FONT_WEIGHT_CHOICES,
@@ -150,49 +153,64 @@ def render_scene_edit(slug, screen_id, game):
         quiz_box_dialog_template_labels=screens.QUIZ_BOX_DIALOG_TEMPLATE_LABELS,
         quiz_box_page_templates=screens.QUIZ_BOX_PAGE_TEMPLATES,
         quiz_box_page_template_labels=screens.QUIZ_BOX_PAGE_TEMPLATE_LABELS,
-        sprite_library=sprite_library, sprite_library_families=sprite_library_families,
-        sprite_library_json=json.dumps(sprite_library),
+        sprite_library=sprite_library,
+        sprite_library_families=sprite_library_families,
+        sprite_library_json=db.json_for_script(sprite_library),
         background_library=background_library,
-        user_assets_fond=user_assets_fond, user_assets_decor=user_assets_decor,
-        user_assets_audio=user_assets_audio, user_assets_video=user_assets_video,
-        element_animations_map_json=json.dumps(element_animations_map),
+        user_assets_fond=user_assets_fond,
+        user_assets_decor=user_assets_decor,
+        user_assets_audio=user_assets_audio,
+        user_assets_video=user_assets_video,
+        element_animations_map_json=db.json_for_script(element_animations_map),
         element_orientation_values=screens.ELEMENT_ORIENTATION_VALUES,
-        element_orientation_labels_json=json.dumps(screens.ELEMENT_ORIENTATION_LABELS),
+        element_orientation_labels_json=db.json_for_script(screens.ELEMENT_ORIENTATION_LABELS),
         element_visibility_values=screens.ELEMENT_VISIBILITY_VALUES,
-        element_visibility_labels_json=json.dumps(screens.ELEMENT_VISIBILITY_LABELS),
-        trigger_events=screens.TRIGGER_EVENTS_2D, action_type_labels=screens.ACTION_TYPE_LABELS_2D,
+        element_visibility_labels_json=db.json_for_script(screens.ELEMENT_VISIBILITY_LABELS),
+        trigger_events=screens.TRIGGER_EVENTS_2D,
+        action_type_labels=screens.ACTION_TYPE_LABELS_2D,
         object_action_properties=screens.OBJECT_ACTION_PROPERTIES,
-        element_action_property_labels_json=json.dumps(dict(screens.OBJECT_ACTION_PROPERTIES)),
+        element_action_property_labels_json=db.json_for_script(dict(screens.OBJECT_ACTION_PROPERTIES)),
         condition_operators=screens.CONDITION_OPERATORS,
-        data_operations=screens.DATA_OPERATIONS, data_operation_labels=screens.DATA_OPERATION_LABELS,
+        data_operations=screens.DATA_OPERATIONS,
+        data_operation_labels=screens.DATA_OPERATION_LABELS,
         score_status_choices=db.SCORE_STATUS_CHOICES,
-        score_status_labels_json=json.dumps(db.SCORE_STATUS_LABELS),
-        data_operation_labels_json=json.dumps(screens.DATA_OPERATION_LABELS),
-        condition_operator_labels_json=json.dumps(screens.CONDITION_OPERATOR_LABELS),
-        action_type_labels_json=json.dumps(screens.ACTION_TYPE_LABELS_2D),
-        elements_labels_json=json.dumps(object_labels), screens_map_json=json.dumps(screens_map),
-        flow_nodes=flow_nodes, flow_edges=flow_edges,
-        flow_nodes_json=json.dumps(flow_nodes), flow_edges_json=json.dumps(flow_edges),
-        flow_blocks_json=json.dumps(flow_blocks), blocks_view=blocks_view,
-        animation_clips=animation_clips, animation_clips_json=json.dumps(animation_clips),
-        animate_css_catalog=screens.ANIMATE_CSS_CATALOG, animate_css_labels_json=json.dumps(screens.ANIMATE_CSS_LABELS),
-        global_variables=global_variables, global_variable_types=db.GLOBAL_VARIABLE_TYPES,
-        custom_events=custom_events, custom_event_usages=custom_event_usages,
-        custom_events_map_json=json.dumps(custom_events_map),
+        score_status_labels_json=db.json_for_script(db.SCORE_STATUS_LABELS),
+        data_operation_labels_json=db.json_for_script(screens.DATA_OPERATION_LABELS),
+        condition_operator_labels_json=db.json_for_script(screens.CONDITION_OPERATOR_LABELS),
+        action_type_labels_json=db.json_for_script(screens.ACTION_TYPE_LABELS_2D),
+        elements_labels_json=db.json_for_script(object_labels),
+        screens_map_json=db.json_for_script(screens_map),
+        flow_nodes=flow_nodes,
+        flow_edges=flow_edges,
+        flow_nodes_json=db.json_for_script(flow_nodes),
+        flow_edges_json=db.json_for_script(flow_edges),
+        flow_blocks_json=db.json_for_script(flow_blocks),
+        blocks_view=blocks_view,
+        animation_clips=animation_clips,
+        animation_clips_json=db.json_for_script(animation_clips),
+        animate_css_catalog=screens.ANIMATE_CSS_CATALOG,
+        animate_css_labels_json=db.json_for_script(screens.ANIMATE_CSS_LABELS),
+        global_variables=global_variables,
+        global_variable_types=db.GLOBAL_VARIABLE_TYPES,
+        custom_events=custom_events,
+        custom_event_usages=custom_event_usages,
+        custom_events_map_json=db.json_for_script(custom_events_map),
         definitions=db.list_definitions(slug),
-        definitions_json=json.dumps({str(d["id"]): screens.data_definition_options(slug, d["id"]) for d in db.list_definitions(slug)}),
-        definitions_names_json=json.dumps({d["id"]: d["name"] for d in db.list_definitions(slug)}),
+        definitions_json=db.json_for_script(
+            {str(d["id"]): screens.data_definition_options(slug, d["id"]) for d in db.list_definitions(slug)}
+        ),
+        definitions_names_json=db.json_for_script({d["id"]: d["name"] for d in db.list_definitions(slug)}),
         # "qui parle" dans un dialogue de déclencheur (voir "ℹ️
         # Informations", static/js/triggers/trigger-editor.js) : les noms
         # donnés à N'IMPORTE QUEL objet de scène (personnage, décor,
         # fond), toutes scènes du jeu confondues.
-        scene_object_names_json=json.dumps(screens.list_named_scene_object_names(slug)),
+        scene_object_names_json=db.json_for_script(screens.list_named_scene_object_names(slug)),
         # Nouveaux déclencheurs/actions (voir screens/rendering/
         # collision_rules.py, screens/rendering/screen_triggers.py) :
         # vocabulaire des nouvelles actions feuilles + assets disponibles
         # pour "son"/"vidéo", posés en JS comme le reste ci-dessus.
-        surbrillance_labels_json=json.dumps(screens.SURBRILLANCE_LABELS),
-        video_mode_labels_json=json.dumps(screens.VIDEO_MODE_LABELS),
-        user_assets_options_json=json.dumps(user_assets_options),
+        surbrillance_labels_json=db.json_for_script(screens.SURBRILLANCE_LABELS),
+        video_mode_labels_json=db.json_for_script(screens.VIDEO_MODE_LABELS),
+        user_assets_options_json=db.json_for_script(user_assets_options),
         screen_triggers=screens.resolve_screen_triggers(screen),
     )

routes/scenes/scene_object_add.py

@@ -1,14 +1,14 @@
-from flask import g, request, redirect, url_for, jsonify, abort
+from flask import abort, g, jsonify, redirect, request, url_for
+from werkzeug.wrappers import Response
 
 import auth
 import screens
-
 from core.flask_app import app
-from core.sprite_gate import forbid_admin_only_character, forbid_admin_only_background
+from core.sprite_gate import forbid_admin_only_background, forbid_admin_only_character
 
 
 @app.route("/game/<slug>/screens/<int:screen_id>/scene-objects/add", methods=["POST"])
-def scene_object_add(slug, screen_id):
+def scene_object_add(slug: str, screen_id: int) -> Response:
     """Pose un nouvel objet sur la scène — mirror de routes/elements/
     element_add.py, mais pour _scene_objects (voir screens/scenes/
     add_scene_object.py).
@@ -60,6 +60,7 @@ def scene_object_add(slug, screen_id):
             # n'en a pas besoin (demande explicite : toujours 200×200 à la
             # pose, voir add_scene_object.py::_DECOR_DEFAULT_SIZE).
             import os
+
             path = os.path.join(auth.user_assets_dir(asset["user_id"]), asset["filename"])
             try:
                 with open(path, "rb") as fh:
@@ -75,10 +76,16 @@ def scene_object_add(slug, screen_id):
     # visible sur le dessus/le côté). Un "decor"/"personnage" garde lui sa
     # position de dépôt normale.
     new_id = screens.add_scene_object(
-        slug, screen_id, kind=kind, forge_character=forge_character,
-        background_slug=background_slug, image_url=image_url,
-        image_width=image_width, image_height=image_height,
-        x=(None if kind == "fond" else drop_x), y=(None if kind == "fond" else drop_y),
+        slug,
+        screen_id,
+        kind=kind,
+        forge_character=forge_character,
+        background_slug=background_slug,
+        image_url=image_url,
+        image_width=image_width,
+        image_height=image_height,
+        x=(None if kind == "fond" else drop_x),
+        y=(None if kind == "fond" else drop_y),
     )
     if drop_x is not None and drop_y is not None and kind != "fond":
         # Ramène dans le cadre de la caméra si le dépôt était trop proche
@@ -87,25 +94,42 @@ def scene_object_add(slug, screen_id):
         # _clamp_to_camera pour l'IA, ici pour un dépôt manuel.
         obj_for_clamp = screens.get_scene_object(slug, new_id)
         screen = screens.get_screen(slug, screen_id)
+        assert obj_for_clamp is not None, (  # nosec B101  # noqa: S101 - narrowing de type, sur par construction
+            "new_id vient d'etre cree par screens.add_scene_object juste au-dessus"
+        )
+        assert screen is not None, (  # nosec B101  # noqa: S101 - narrowing de type, sur par construction
+            "screen_id valide : add_scene_object aurait leve IntegrityError sinon (FK scene_id)"
+        )
         max_x = max(0, screen["scene_width"] - obj_for_clamp["width"])
         max_y = max(0, screen["scene_height"] - obj_for_clamp["height"])
         clamped_x = min(max(drop_x, 0), max_x)
         clamped_y = min(max(drop_y, 0), max_y)
         if (clamped_x, clamped_y) != (obj_for_clamp["x"], obj_for_clamp["y"]):
-            screens.update_scene_object_geometry(slug, new_id, clamped_x, clamped_y, obj_for_clamp["width"], obj_for_clamp["height"])
+            screens.update_scene_object_geometry(
+                slug, new_id, clamped_x, clamped_y, obj_for_clamp["width"], obj_for_clamp["height"]
+            )
     if request.headers.get("X-Requested-With") == "fetch":
         obj = screens.get_scene_object(slug, new_id)
-        return jsonify({
-            "id": new_id, "kind": obj["kind"],
-            "x": obj["x"], "y": obj["y"], "width": obj["width"], "height": obj["height"],
-            "rendered_html": screens.render_scene_object(obj),
-            # Relance l'aperçu animé tout de suite (voir personnage-preview.js
-            # ::restartPersonnageIdlePreview) — sans ça, un personnage
-            # fraîchement posé restait figé sur sa première frame jusqu'au
-            # prochain rechargement de page (qui n'arrive plus jamais, voir
-            # addSceneObject() côté JS).
-            "animations": screens.resolve_personnage_animations(obj) if obj["kind"] == "personnage" else None,
-        })
+        assert obj is not None, (  # nosec B101  # noqa: S101 - narrowing de type, sur par construction
+            "new_id vient d'etre cree par screens.add_scene_object plus haut"
+        )
+        return jsonify(
+            {
+                "id": new_id,
+                "kind": obj["kind"],
+                "x": obj["x"],
+                "y": obj["y"],
+                "width": obj["width"],
+                "height": obj["height"],
+                "rendered_html": screens.render_scene_object(obj),
+                # Relance l'aperçu animé tout de suite (voir personnage-preview.js
+                # ::restartPersonnageIdlePreview) — sans ça, un personnage
+                # fraîchement posé restait figé sur sa première frame jusqu'au
+                # prochain rechargement de page (qui n'arrive plus jamais, voir
+                # addSceneObject() côté JS).
+                "animations": screens.resolve_personnage_animations(obj) if obj["kind"] == "personnage" else None,
+            }
+        )
     # Même route que l'éditeur document (/game/<slug>/screens/<id>/edit,
     # endpoint "screen_edit") — c'est CE dispatcher qui bascule vers la
     # vue de scène selon game_type, voir routes/screens/screen_edit.py.

routes/scenes/scene_object_collision.py

@@ -1,12 +1,14 @@
-from flask import request, jsonify
+from typing import Any
+
+from flask import jsonify, request
+from werkzeug.wrappers import Response
 
 import screens
-
 from core.flask_app import app
 
 
 @app.route("/game/<slug>/scene-objects/<int:object_id>/collision", methods=["POST"])
-def scene_object_collision(slug, object_id):
+def scene_object_collision(slug: str, object_id: int) -> Response | tuple[Response, int]:
     """Boîte de collision d'un objet de scène (voir "🧱 Collision" dans
     templates/scene_edit.html, static/js/play/conditions.js::
     elementsOverlap pour son usage au jeu)."""
@@ -15,7 +17,7 @@ def scene_object_collision(slug, object_id):
     if not obj:
         return jsonify({"error": "objet introuvable"}), 404
 
-    settings = {"enabled": bool(body.get("enabled", True))}
+    settings: dict[str, Any] = {"enabled": bool(body.get("enabled", True))}
     settings["shape"] = body.get("shape") if body.get("shape") in screens.COLLISION_SHAPES else "rectangle"
     for key in ("width", "height"):
         try:
@@ -31,4 +33,7 @@ def scene_object_collision(slug, object_id):
 
     screens.set_scene_object_collision(slug, object_id, settings)
     obj = screens.get_scene_object(slug, object_id)
+    assert obj is not None, (  # nosec B101  # noqa: S101 - narrowing de type, sur par construction
+        "object_id valide (deja lu ci-dessus, rien ne l'a supprime entre-temps)"
+    )
     return jsonify({"ok": True, "collision": screens.resolve_collision_settings(obj)})

routes/scenes/scene_object_commands.py

@@ -1,12 +1,14 @@
-from flask import request, jsonify
+from typing import Any
+
+from flask import jsonify, request
+from werkzeug.wrappers import Response
 
 import screens
-
 from core.flask_app import app
 
 
 @app.route("/game/<slug>/scene-objects/<int:object_id>/commandes", methods=["POST"])
-def scene_object_commands(slug, object_id):
+def scene_object_commands(slug: str, object_id: int) -> Response | tuple[Response, int]:
     """Touches de déplacement/interaction + blocage d'axe d'un personnage
     (voir templates/scene_edit.html, section "Commandes" du panneau
     Personnage, et static/js/play/personnage-controller.js pour leur
@@ -18,7 +20,7 @@ def scene_object_commands(slug, object_id):
         return jsonify({"error": "objet introuvable"}), 404
 
     defaults = screens.DEFAULT_PERSONNAGE_COMMANDS
-    commands = {}
+    commands: dict[str, Any] = {}
     for key in ("haut", "bas", "gauche", "droite", "interagir"):
         # Jamais de .strip() ici : " " (Espace) est une valeur ev.key
         # parfaitement valide côté client (voir personnage-controller.js)

routes/scenes/scene_object_delete.py

@@ -1,12 +1,12 @@
-from flask import redirect, request, url_for, jsonify
+from flask import jsonify, redirect, request, url_for
+from werkzeug.wrappers import Response
 
 import screens
-
 from core.flask_app import app
 
 
 @app.route("/game/<slug>/scene-objects/<int:object_id>/delete", methods=["POST"])
-def scene_object_delete(slug, object_id):
+def scene_object_delete(slug: str, object_id: int) -> Response | tuple[Response, int]:
     """Supprime un objet de scène — bouton 🗑️ du panneau de propriétés
     (voir templates/scene_edit.html), toujours pour l'objet SÉLECTIONNÉ (le
     seul dont ce bouton est affiché).

routes/scenes/scene_object_dialogue_box_style.py

@@ -1,12 +1,12 @@
-from flask import request, jsonify
+from flask import jsonify, request
+from werkzeug.wrappers import Response
 
 import screens
-
 from core.flask_app import app
 
 
 @app.route("/game/<slug>/scene-objects/<int:object_id>/dialogue-box-style", methods=["POST"])
-def scene_object_dialogue_box_style(slug, object_id):
+def scene_object_dialogue_box_style(slug: str, object_id: int) -> Response | tuple[Response, int]:
     body = request.get_json(silent=True) or {}
     style = screens.set_scene_object_dialogue_box_style(slug, object_id, body.get("style"))
     if style is None:

routes/scenes/scene_object_geometry.py

@@ -1,20 +1,31 @@
-from flask import request, jsonify
+from flask import jsonify, request
+from werkzeug.wrappers import Response
 
 import screens
-
 from core.flask_app import app
 
 
 @app.route("/game/<slug>/scene-objects/<int:object_id>/geometry", methods=["POST"])
-def scene_object_geometry(slug, object_id):
+def scene_object_geometry(slug: str, object_id: int) -> Response | tuple[Response, int]:
     """Mirror exact de routes/elements/element_geometry.py, mais en pixels
     (voir screens/scenes/update_scene_object_geometry.py) — appelé en AJAX
     pendant/à la fin d'un glisser-déposer sur la scène."""
+    # Vérifié AVANT l'update (pas seulement après) : update_scene_object_geometry
+    # ne valide pas object_id elle-même (simple UPDATE ... WHERE id = ?, sans
+    # effet silencieux si la ligne n'existe plus) — un objet supprimé entre
+    # temps (ex. course avec un autre onglet/une suppression concurrente)
+    # aurait sinon fait planter obj["scene_id"] plus bas sur un obj devenu None.
+    obj = screens.get_scene_object(slug, object_id)
+    if obj is None:
+        return jsonify({"error": "objet introuvable"}), 404
     data = request.get_json(force=True)
     screens.update_scene_object_geometry(
-        slug, object_id,
-        x=float(data["x"]), y=float(data["y"]),
-        width=float(data["width"]), height=float(data["height"]),
+        slug,
+        object_id,
+        x=float(data["x"]),
+        y=float(data["y"]),
+        width=float(data["width"]),
+        height=float(data["height"]),
     )
     # Un "fond" agrandi manuellement au-delà du champ de la caméra doit
     # élargir le "monde" tout de suite (voir screens.resolve_scene_world_size)
@@ -22,8 +33,10 @@ def scene_object_geometry(slug, object_id):
     # JS après un redimensionnement manuel (contrairement au tour de Ruby,
     # voir iaChatRefreshAfterTurn() dans static/js/ia/ia-chat.js), rendant
     # injoignable à la souris tout ce qui dépassait la scène nominale.
-    obj = screens.get_scene_object(slug, object_id)
     screen = screens.get_screen(slug, obj["scene_id"])
+    assert screen is not None, (  # nosec B101  # noqa: S101 - narrowing de type, sur par construction
+        "obj existe (verifie plus haut) et _scene_objects.scene_id a ON DELETE CASCADE vers _screens"
+    )
     objects = screens.list_scene_objects(slug, obj["scene_id"])
     world_width, world_height = screens.resolve_scene_world_size(screen, objects)
     return jsonify({"ok": True, "world_width": world_width, "world_height": world_height})

routes/scenes/scene_object_name.py

@@ -1,12 +1,12 @@
-from flask import request, jsonify
+from flask import jsonify, request
+from werkzeug.wrappers import Response
 
 import screens
-
 from core.flask_app import app
 
 
 @app.route("/game/<slug>/scene-objects/<int:object_id>/name", methods=["POST"])
-def scene_object_name(slug, object_id):
+def scene_object_name(slug: str, object_id: int) -> Response:
     data = request.get_json(force=True)
     screens.set_scene_object_name(slug, object_id, data.get("name"))
     return jsonify({"ok": True})

routes/scenes/scene_object_names_list.py

@@ -1,12 +1,12 @@
 from flask import jsonify
+from werkzeug.wrappers import Response
 
 import screens
-
 from core.flask_app import app
 
 
 @app.route("/game/<slug>/scene-object-names", methods=["GET"])
-def scene_object_names_list(slug):
+def scene_object_names_list(slug: str) -> Response:
     """Noms d'objets de scène à jour, pour repeupler le sélecteur "qui
     parle" de l'éditeur de dialogue (voir SCENE_OBJECT_NAMES_JSON,
     templates/scene_edit.html, triggerSpeakerOptions() dans static/js/

routes/scenes/scene_object_personnage_data.py

@@ -1,13 +1,13 @@
-from flask import request, jsonify
+from flask import jsonify, request
+from werkzeug.wrappers import Response
 
 import screens
-
 from core.flask_app import app
 from core.sprite_gate import forbid_admin_only_character
 
 
 @app.route("/game/<slug>/scene-objects/<int:object_id>/personnage", methods=["POST"])
-def scene_object_personnage_data(slug, object_id):
+def scene_object_personnage_data(slug: str, object_id: int) -> Response | tuple[Response, int]:
     """Mirror exact de routes/elements/element_set_personnage_data.py,
     mais pour un objet de scène — même réponse (animations résolues) pour
     relancer immédiatement l'aperçu animé côté client sans recharger la
@@ -22,4 +22,7 @@ def scene_object_personnage_data(slug, object_id):
         forbid_admin_only_character(body["forge_character"])
     screens.set_scene_object_personnage_data(slug, object_id, body)
     obj = screens.get_scene_object(slug, object_id)
+    assert obj is not None, (  # nosec B101  # noqa: S101 - narrowing de type, sur par construction
+        "object_id valide (deja lu ci-dessus, rien ne l'a supprime entre-temps)"
+    )
     return jsonify({"ok": True, "animations": screens.resolve_personnage_animations(obj)})

routes/scenes/scene_object_quiz_config.py

@@ -1,12 +1,12 @@
-from flask import request, jsonify
+from flask import jsonify, request
+from werkzeug.wrappers import Response
 
 import screens
-
 from core.flask_app import app
 
 
 @app.route("/game/<slug>/scene-objects/<int:object_id>/quiz-config", methods=["POST"])
-def scene_object_quiz_config(slug, object_id):
+def scene_object_quiz_config(slug: str, object_id: int) -> Response | tuple[Response, int]:
     """Réglages "❓ Boîte à quiz" (plein écran/minuteur/modèle, voir
     screens/rendering/quiz_box_config.py) — mirror exact de
     routes/scenes/scene_object_dialogue_box_style.py."""
@@ -20,4 +20,7 @@ def scene_object_quiz_config(slug, object_id):
     # coup, plutôt que de deviner quelle balise ajouter/retirer côté
     # client.
     obj = screens.get_scene_object(slug, object_id)
+    assert obj is not None, (  # nosec B101  # noqa: S101 - narrowing de type, sur par construction
+        "object_id valide : set_scene_object_quiz_config a renvoye une config non-None"
+    )
     return jsonify({"config": config, "rendered_html": screens.render_scene_object(obj)})

routes/scenes/scene_object_role.py

@@ -1,12 +1,12 @@
-from flask import request, jsonify
+from flask import jsonify, request
+from werkzeug.wrappers import Response
 
 import screens
-
 from core.flask_app import app
 
 
 @app.route("/game/<slug>/scene-objects/<int:object_id>/role", methods=["POST"])
-def scene_object_role(slug, object_id):
+def scene_object_role(slug: str, object_id: int) -> Response | tuple[Response, int]:
     """Rôle d'un personnage (joueur/ennemie/pnj — voir "🏷️ Rôle" dans le
     panneau Personnage, templates/scene_edit.html) : seul un personnage
     "joueur" est déplacé/animé automatiquement au clavier (voir