BoursePython/app/routes.py

from flask import Blueprint, render_template, request, redirect, url_for, session, flash
from werkzeug.security import check_password_hash, generate_password_hash
from sqlalchemy import text
from app import db
from datetime import datetime

main = Blueprint('main', __name__)


@main.route('/', methods=['GET', 'POST'])
def index():
    if 'user_id' in session:
        return redirect(url_for('main.menu'))

    if 'login_attempts' not in session:
        session['login_attempts'] = 0

    if request.method == 'POST':
        user_login = request.form.get('login')
        user_pass = request.form.get('pass')

        query = text("SELECT id, pass AS user_pass, nom, prenom FROM login WHERE login = :login AND actif = 1")
        result = db.session.execute(query, {"login": user_login}).fetchone()

        if result and check_password_hash(result.user_pass, user_pass):
            session.pop('login_attempts', None)
            session['user_id'] = result.id
            session['user_name'] = f"{result.prenom} {result.nom}"
            return redirect(url_for('main.menu'))
        else:
            session['login_attempts'] += 1
            
            if session['login_attempts'] >= 3:
                session.pop('login_attempts', None)
                return redirect('https://giraud-finance.com')
            
            essais_restants = 3 - session['login_attempts']
            flash(f"Identifiant ou mot de passe incorrect. Il vous reste {essais_restants} essai(s).", "danger")

    return render_template('index.html')

@main.route('/menu')
def menu():
    if 'user_id' not in session:
        return redirect(url_for('main.index'))
    return render_template('menu.html')

@main.route('/logout')
def logout():
    session.clear()
    return redirect(url_for('main.index'))

@main.route('/gestion-utilisateurs', methods=['GET', 'POST'])
def gestion_utilisateurs():
    if 'user_id' not in session:
        return redirect(url_for('main.index'))
    
    if request.method == 'POST':
        action = request.form.get('action')
        user_id = request.form.get('id')
        user_actif = request.form.get('actif', '1')
        user_prenom = request.form.get('prenom')
        user_nom = request.form.get('nom')
        user_login = request.form.get('login')
        user_mail = request.form.get('mail')
        user_pass = request.form.get('pass')
        
        if action == 'creer':
            if user_pass:
                hashed_pass = generate_password_hash(user_pass)
                query = text("""
                    INSERT INTO login (login, nom, prenom, mail, pass, actif) 
                    VALUES (:login, :nom, :prenom, :mail, :pass, :actif)
                """)
                db.session.execute(query, {
                    "login": user_login,
                    "nom": user_nom,
                    "prenom": user_prenom,
                    "mail": user_mail,
                    "pass": hashed_pass,
                    "actif": user_actif
                })
                db.session.commit()
                flash("Utilisateur créé avec succès.", "success")
            else:
                flash("Le mot de passe est obligatoire pour créer un utilisateur.", "danger")
                
        elif action == 'modifier' and user_id:
            if user_pass:
                hashed_pass = generate_password_hash(user_pass)
                query = text("""
                    UPDATE login 
                    SET login = :login, nom = :nom, prenom = :prenom, mail = :mail, pass = :pass, actif = :actif 
                    WHERE id = :id
                """)
                db.session.execute(query, {
                    "id": user_id,
                    "login": user_login,
                    "nom": user_nom,
                    "prenom": user_prenom,
                    "mail": user_mail,
                    "pass": hashed_pass,
                    "actif": user_actif
                })
            else:
                query = text("""
                    UPDATE login 
                    SET login = :login, nom = :nom, prenom = :prenom, mail = :mail, actif = :actif 
                    WHERE id = :id
                """)
                db.session.execute(query, {
                    "id": user_id,
                    "login": user_login,
                    "nom": user_nom,
                    "prenom": user_prenom,
                    "mail": user_mail,
                    "actif": user_actif
                })
            db.session.commit()
            flash("Utilisateur modifié avec succès.", "success")
            
        return redirect(url_for('main.gestion_utilisateurs'))

    # Lecture exacte de la table login de votre base de données
    users_query = text("SELECT id, login, nom, prenom, mail, actif FROM login ORDER BY id ASC")
    result = db.session.execute(users_query)
    
    users = []
    for row in result:
        users.append({
            'id': row.id,
            'login': row.login if row.login else '',
            'nom': row.nom if row.nom else '',
            'prenom': row.prenom if row.prenom else '',
            'mail': row.mail if row.mail else '',
            'actif': row.actif if row.actif is not None else 1
        })

    return render_template('gestion_utilisateurs.html', users=users)