Phase 3 : hardening qualite de code - typage strict, securite, dead code, a11y

Config strictement stricte partout (ruff, mypy --strict, bandit, vulture, import-linter, eslint, stylelint), aucune regle desactivee "pour ne pas casser le build" - l'existant a ete corrige pour la satisfaire plutot que l'inverse. Hooks pre-commit locaux (language: system) bloquants. - Typage mypy --strict propage a tout le moteur (db, screens, auth, core, ai, routes, puis publish/scripts/tests/app.py/build_css.py). - Securite : fuite de handle fichier Windows corrigee dans l'export SCORM (routes/publish/export_scorm.py), CSRF/RNG non-crypto/xAPI documentes (# nosec, # NOSONAR justifies), nouveau db.json_for_script() (echappe "</script>" dans le JSON embarque en <script>, 25 sites). - Architecture : imports circulaires/F811 nettoyes, contrats import-linter respectes, code mort retire (vulture). - Accessibilite : 69 champs de formulaire sans label correctement associe corriges (for/id ou aria-label) sur 11 templates. - ESLint/Stylelint : lot mecanique JS/CSS, regles ajustees puis appliquees (aucune desactivee sans verification individuelle). - Tests : isolation du compte admin partage (nettoyage ponctuel + fixture de teardown automatique en filet de securite), suite complete verte (591 tests Python, 241 tests JS). - SonarQube Community Build self-heberge (Docker + PostgreSQL) : rapport complet analyse point par point, faux positifs documentes. - .gitattributes ajoute (LF force) : core.autocrlf=true sur cette machine faisait echouer ESLint (linebreak-style) via un bug connu de git (checkout "en place" qui ignore l'eol force sur un fichier deja present sur disque - contourne en supprimant puis recreant chaque fichier suivi). djLint (H021, styles inline) volontairement saute pour ce commit - backlog assume, deja documente, traite dans un lot separe. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-15 16:06:15 +02:00
parent 7db4803b93
commit c57420c8c9
454 changed files with 16448 additions and 6967 deletions
@@ -40,74 +40,99 @@ quelle ici n'aurait eu AUCUN effet, silencieusement.

 Usage : python3 scripts/build_demo_dialogues.py
 """
+
 import json
+import os
 import re
 import sys
-import os
+from typing import Any

 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

-from core.flask_app import app
-from core import jinja_filters  # noqa: F401 - enregistre les filtres Jinja
+from flask.testing import FlaskClient
+from werkzeug.test import TestResponse
+
 import routes  # noqa: F401 - enregistre toutes les routes
+from core import jinja_filters  # noqa: F401 - enregistre les filtres Jinja
+from core.flask_app import app


-def _redirect_id(resp, pattern):
-    return int(re.search(pattern, resp.headers["Location"]).group(1))
+def _redirect_id(resp: TestResponse, pattern: str) -> int:
+    match = re.search(pattern, resp.headers["Location"])  # NOSONAR S8371 - Location attendue, KeyError = echec clair
+    assert match is not None, (  # nosec B101  # noqa: S101 - script d'usage unique, jamais execute en production
+        f"motif {pattern!r} absent de Location: {resp.headers['Location']!r}"  # NOSONAR S8371 - idem
+    )
+    return int(match.group(1))


-def _create_screen(client, slug, name):
+def _create_screen(client: FlaskClient, slug: str, name: str) -> int:
    resp = client.post(f"/game/{slug}/screens/new", data={"name": name}, follow_redirects=False)
    return _redirect_id(resp, r"/screens/(\d+)/edit")


-def _add_element(client, slug, screen_id, widget):
-    resp = client.post(f"/game/{slug}/screens/{screen_id}/elements/add", data={"widget": widget}, follow_redirects=False)
+def _add_element(client: FlaskClient, slug: str, screen_id: int, widget: str) -> int:
+    resp = client.post(
+        f"/game/{slug}/screens/{screen_id}/elements/add", data={"widget": widget}, follow_redirects=False
+    )
    return _redirect_id(resp, r"selected=(\d+)")


-def _add_child(client, slug, parent_id, widget):
-    resp = client.post(f"/game/{slug}/elements/{parent_id}/children/add", data={"widget": widget}, follow_redirects=False)
+def _add_child(client: FlaskClient, slug: str, parent_id: int, widget: str) -> int:
+    resp = client.post(
+        f"/game/{slug}/elements/{parent_id}/children/add", data={"widget": widget}, follow_redirects=False
+    )
    return _redirect_id(resp, r"selected=(\d+)")


-def _save(client, slug, element_id, **ctrl):
+def _save(client: FlaskClient, slug: str, element_id: int, **ctrl: Any) -> None:
    data = {f"ctrl_{k}": v for k, v in ctrl.items()}
    client.post(f"/game/{slug}/elements/{element_id}/save", data=data)


-def _add_node(client, slug, screen_id, **fields):
+def _add_node(client: FlaskClient, slug: str, screen_id: int, **fields: Any) -> int:
    resp = client.post(
        f"/game/{slug}/screens/{screen_id}/flow/nodes/add",
        data=json.dumps({**fields}),
        content_type="application/json",
    )
-    assert resp.status_code == 200, resp.get_data(as_text=True)
-    return resp.get_json()["id"]
+    assert resp.status_code == 200, (  # nosec B101  # noqa: S101 - script d'usage unique
+        resp.get_data(as_text=True)
+    )
+    result: int = resp.get_json()["id"]
+    return result


-def _add_edge(client, slug, screen_id, from_id, to_id, from_port="out"):
+def _add_edge(client: FlaskClient, slug: str, screen_id: int, from_id: int, to_id: int, from_port: str = "out") -> None:
    resp = client.post(
        f"/game/{slug}/screens/{screen_id}/flow/edges/add",
        data=json.dumps({"from_node_id": from_id, "from_port": from_port, "to_node_id": to_id}),
        content_type="application/json",
    )
-    assert resp.status_code == 200, resp.get_data(as_text=True)
-
-
-def _modifier_element(client, slug, screen_id, target_id, prop, value):
-    return _add_node(
-        client, slug, screen_id,
-        node_type="action", action_type="modifier_element",
-        target_element_id=target_id, element_property=prop, element_value=value,
+    assert resp.status_code == 200, (  # nosec B101  # noqa: S101 - script d'usage unique
+        resp.get_data(as_text=True)
    )


-def build():
+def _modifier_element(client: FlaskClient, slug: str, screen_id: int, target_id: int, prop: str, value: str) -> int:
+    return _add_node(
+        client,
+        slug,
+        screen_id,
+        node_type="action",
+        action_type="modifier_element",
+        target_element_id=target_id,
+        element_property=prop,
+        element_value=value,
+    )
+
+
+def build() -> None:
    app.config["TESTING"] = True
    with app.test_client() as client:
        resp = client.post("/games/new", data={"name": "Demo Dialogues Surbrillance"}, follow_redirects=False)
-        assert resp.status_code == 302, resp.get_data(as_text=True)
+        assert resp.status_code == 302, (  # nosec B101  # noqa: S101 - script d'usage unique
+            resp.get_data(as_text=True)
+        )
        slug = resp.headers["Location"].rstrip("/").split("/")[-1]
        print(f"Jeu créé : slug={slug}")

@@ -119,7 +144,16 @@ def build():
        t1 = _add_child(client, slug, overlay_bienvenue, "titre")
        _save(client, slug, t1, content="Bienvenue !", color="#f5f6fa")
        t2 = _add_child(client, slug, overlay_bienvenue, "texte")
-        _save(client, slug, t2, content="Ce petit tutoriel te montre comment fonctionnent les dialogues et la surbrillance. Clique sur OK pour commencer.", color="#f5f6fa")
+        _save(
+            client,
+            slug,
+            t2,
+            content=(
+                "Ce petit tutoriel te montre comment fonctionnent les dialogues et la "
+                "surbrillance. Clique sur OK pour commencer."
+            ),
+            color="#f5f6fa",
+        )
        btn_ok = _add_child(client, slug, overlay_bienvenue, "bouton")
        _save(client, slug, btn_ok, content="OK, c'est parti")

@@ -148,7 +182,9 @@ def build():
        _add_edge(client, slug, screen1, trig_ok, act_highlight_on)

        # Clic sur le bouton cible -> arrête la surbrillance, le désactive, ouvre "Bravo".
-        trig_target = _add_node(client, slug, screen1, node_type="trigger", trigger_element_id=btn_target, trigger_event="clic")
+        trig_target = _add_node(
+            client, slug, screen1, node_type="trigger", trigger_element_id=btn_target, trigger_event="clic"
+        )
        act_highlight_off = _modifier_element(client, slug, screen1, btn_target, "surbrillance", "off")
        act_lock_target = _modifier_element(client, slug, screen1, btn_target, "desactive", "on")
        act_open_bravo = _modifier_element(client, slug, screen1, overlay_bravo, "visibilite", "visible")
@@ -157,7 +193,9 @@ def build():
        _add_edge(client, slug, screen1, trig_target, act_open_bravo)

        # Clic sur "Fermer" (dans "Bravo") -> referme "Bravo".
-        trig_close_bravo = _add_node(client, slug, screen1, node_type="trigger", trigger_element_id=btn_close_bravo, trigger_event="clic")
+        trig_close_bravo = _add_node(
+            client, slug, screen1, node_type="trigger", trigger_element_id=btn_close_bravo, trigger_event="clic"
+        )
        act_close_bravo = _modifier_element(client, slug, screen1, overlay_bravo, "visibilite", "masque")
        _add_edge(client, slug, screen1, trig_close_bravo, act_close_bravo)

@@ -169,7 +207,13 @@ def build():
        t5 = _add_child(client, slug, overlay_mentor, "titre")
        _save(client, slug, t5, content="Message du mentor", color="#f5f6fa")
        t6 = _add_child(client, slug, overlay_mentor, "texte")
-        _save(client, slug, t6, content="Ce message est apparu tout seul, 3 secondes après l'arrivée sur cet écran — sans aucun clic.", color="#f5f6fa")
+        _save(
+            client,
+            slug,
+            t6,
+            content="Ce message est apparu tout seul, 3 secondes après l'arrivée sur cet écran — sans aucun clic.",
+            color="#f5f6fa",
+        )
        btn_close_mentor = _add_child(client, slug, overlay_mentor, "bouton")
        _save(client, slug, btn_close_mentor, content="Fermer")

@@ -182,7 +226,9 @@ def build():
        _add_edge(client, slug, screen2, trig_affichage2, act_wait)
        _add_edge(client, slug, screen2, act_wait, act_open_mentor)

-        trig_close_mentor = _add_node(client, slug, screen2, node_type="trigger", trigger_element_id=btn_close_mentor, trigger_event="clic")
+        trig_close_mentor = _add_node(
+            client, slug, screen2, node_type="trigger", trigger_element_id=btn_close_mentor, trigger_event="clic"
+        )
        act_close_mentor = _modifier_element(client, slug, screen2, overlay_mentor, "visibilite", "masque")
        _add_edge(client, slug, screen2, trig_close_mentor, act_close_mentor)

@@ -10,9 +10,11 @@ par le moteur.
 Accès réservé au rôle admin (voir screens/labels/animal_sprite_library.py,
 routes/screens/screen_edit.py, routes/scenes/scene_edit_view.py) : licence
 CraftPix, ne redistribue pas ces sprites à des comptes "user"."""
+
 import json
 import os
 import shutil
+from typing import Any

 _BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 _SRC_ROOT = os.path.join(_BASE_DIR, "assets", "characters", "animal_sprite")
@@ -39,16 +41,23 @@ _PACKS = {
 # Nom de pose source (dossier Png/CharacterNN/<Pose>) -> nom exposé (clé
 # d'animation). "Stuned" est une coquille du pack source, corrigée ici.
 _POSE_NAMES = {
-    "Idle": "idle", "Walk": "walk", "Jump": "jump", "Fly": "fly",
-    "Roll": "roll", "Hit": "hit", "Stuned": "stunned",
-    "Throwing": "throwing", "Dead": "dead",
+    "Idle": "idle",
+    "Walk": "walk",
+    "Jump": "jump",
+    "Fly": "fly",
+    "Roll": "roll",
+    "Hit": "hit",
+    "Stuned": "stunned",
+    "Throwing": "throwing",
+    "Dead": "dead",
 }

-def _copy_variant(pack_dir, animal, nn):
+
+def _copy_variant(pack_dir: str, animal: str, nn: str) -> dict[str, int] | None:
    char_dir = os.path.join(pack_dir, "Png", f"Character{nn}")
    if not os.path.isdir(char_dir):
        return None
-    poses = {}
+    poses: dict[str, int] = {}
    for pose_folder in sorted(os.listdir(char_dir)):
        exposed = _POSE_NAMES.get(pose_folder)
        if not exposed:
@@ -65,14 +74,14 @@ def _copy_variant(pack_dir, animal, nn):
    return poses or None


-def main():
-    manifest = {}
+def main() -> None:
+    manifest: dict[str, Any] = {}
    for pack_folder, (animal, label) in sorted(_PACKS.items()):
        pack_dir = os.path.join(_SRC_ROOT, pack_folder)
        if not os.path.isdir(pack_dir):
            print(f"SKIP (introuvable) : {pack_folder}")
            continue
-        variants = {}
+        variants: dict[str, Any] = {}
        for n in range(1, 16):
            nn = f"{n:02d}"
            poses = _copy_variant(pack_dir, animal, nn)
@@ -12,10 +12,12 @@ Accès réservé au rôle admin (voir screens/labels/background_library.py,
 routes/scenes/scene_edit_view.py) : licence CraftPix, ne redistribue pas
 ces images à des comptes "user" — même règle que la bibliothèque de
 sprites animaux (screens/labels/animal_sprite_library.py)."""
+
 import json
 import os
 import shutil
 import struct
+from typing import Any

 _BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 _SRC_ROOT = os.path.join(_BASE_DIR, "assets", "background")
@@ -30,7 +32,7 @@ _PACKS = {
 }


-def _png_dimensions(path):
+def _png_dimensions(path: str) -> tuple[int, int]:
    """Largeur/hauteur RÉELLES lues dans l'en-tête PNG (chunk IHDR, 8
    octets de signature + 4 octets de taille + 4 octets de type "IHDR"
    avant les 2 x 4 octets de dimensions, big-endian) — évite une
@@ -44,14 +46,14 @@ def _png_dimensions(path):
    return width, height


-def main():
-    manifest = {}
+def main() -> None:
+    manifest: dict[str, Any] = {}
    for pack_folder, (pack_slug, pack_label) in sorted(_PACKS.items()):
        pack_dir = os.path.join(_SRC_ROOT, pack_folder, "PNG")
        if not os.path.isdir(pack_dir):
            print(f"SKIP (introuvable) : {pack_folder}")
            continue
-        images = {}
+        images: dict[str, Any] = {}
        for name in sorted(os.listdir(pack_dir)):
            src_dir = os.path.join(pack_dir, name)
            src_file = os.path.join(src_dir, f"{name}.png")
@@ -18,25 +18,26 @@ Mode simulation par défaut (n'écrit rien, affiche ce qui serait fait) —
    python scripts/migrate_flat_project_slugs.py           # aperçu
    python scripts/migrate_flat_project_slugs.py --apply    # exécute
 """
+
 import os
 import sys

 _BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 sys.path.insert(0, _BASE_DIR)

-import db  # noqa: E402
 import auth  # noqa: E402
+import db  # noqa: E402
+from auth.connection import connect as connect_auth_db  # noqa: E402
 from db.constants import PROJECTS_DIR  # noqa: E402
 from db.games.project_slug import build_slug  # noqa: E402
-from auth.connection import connect as connect_auth_db  # noqa: E402


-def _flat_project_slugs():
+def _flat_project_slugs() -> list[str]:
    """Slugs plats trouvés directement sous projects/ (un dossier avec
    game.db à la racine, pas dans un sous-dossier propriétaire)."""
    if not os.path.isdir(PROJECTS_DIR):
        return []
-    found = []
+    found: list[str] = []
    for entry in sorted(os.listdir(PROJECTS_DIR)):
        entry_path = os.path.join(PROJECTS_DIR, entry)
        if os.path.isfile(os.path.join(entry_path, "game.db")):
@@ -44,7 +45,7 @@ def _flat_project_slugs():
    return found


-def migrate(apply=False):
+def migrate(apply: bool = False) -> None:
    slugs = _flat_project_slugs()
    if not slugs:
        print("Aucun projet à plat trouvé — rien à migrer.")
@@ -55,11 +56,9 @@ def migrate(apply=False):
        project_part = db.slugify(game_meta["name"]) or "jeu"
        new_slug = build_slug(old_slug, project_part)
        owning_users = [
-            dict(r) for r in
-            conn.execute("SELECT id, email FROM _users WHERE project_slug = ?", (old_slug,)).fetchall()
+            dict(r) for r in conn.execute("SELECT id, email FROM _users WHERE project_slug = ?", (old_slug,)).fetchall()
        ]
-        print(f"{old_slug!r} -> {new_slug!r}"
-              f" (comptes concernés : {[u['email'] for u in owning_users] or 'aucun'})")
+        print(f"{old_slug!r} -> {new_slug!r} (comptes concernés : {[u['email'] for u in owning_users] or 'aucun'})")
        if not apply:
            continue
        old_dir = os.path.join(PROJECTS_DIR, old_slug)
@@ -25,20 +25,22 @@ Mode simulation par défaut (n'écrit rien, affiche ce qui serait fait) —
    python scripts/migrate_owner_folders_to_user_id.py           # aperçu
    python scripts/migrate_owner_folders_to_user_id.py --apply    # exécute
 """
+
 import os
 import sys
+from typing import Any

 _BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 sys.path.insert(0, _BASE_DIR)

-import db  # noqa: E402
 import auth  # noqa: E402
+import db  # noqa: E402
+from auth.connection import connect as connect_auth_db  # noqa: E402
 from db.constants import PROJECTS_DIR  # noqa: E402
 from db.games.project_slug import build_slug, split_slug  # noqa: E402
-from auth.connection import connect as connect_auth_db  # noqa: E402


-def _expected_old_owner_folder(user):
+def _expected_old_owner_folder(user: dict[str, Any]) -> str:
    if user["role"] != "admin" and user["project_slug"]:
        owner_folder, project_part = split_slug(user["project_slug"])
        if project_part is not None:
@@ -52,12 +54,9 @@ def _expected_old_owner_folder(user):
    return db.slugify(user["email"])


-def migrate(apply=False):
+def migrate(apply: bool = False) -> None:
    conn = connect_auth_db()
-    users = [
-        dict(r) for r in
-        conn.execute("SELECT id, email, role, project_slug FROM _users").fetchall()
-    ]
+    users = [dict(r) for r in conn.execute("SELECT id, email, role, project_slug FROM _users").fetchall()]
    conn.close()

    migrated = 0
@@ -71,8 +70,7 @@ def migrate(apply=False):
            continue  # aucun projet pour ce compte — rien à déplacer

        project_parts = sorted(
-            entry for entry in os.listdir(old_dir)
-            if os.path.isfile(os.path.join(old_dir, entry, "game.db"))
+            entry for entry in os.listdir(old_dir) if os.path.isfile(os.path.join(old_dir, entry, "game.db"))
        )
        if not project_parts:
            print(f"{user['email']} ({user['role']}) : dossier {old_owner_folder!r} sans jeu — ignoré.")