fix(api): Send PKCE code_verifier in token exchange and secure OIDC cookies

The /exchange-token endpoint was not sending the code_verifier to the
token endpoint, rendering PKCE protection ineffective. Add the verifier
to the POST body so the IdP can validate the authorization code exchange.

Also add secure=True and samesite='Lax' to all OIDC cookies on /login
to improve cookie security per the recommended remediation.

Refs vuln-0004

.gitignore

@@ -169,4 +169,3 @@ cython_debug/
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
-strix_runs/*

index.html

@@ -545,49 +545,40 @@
                 filteredEvents.forEach(event => {
                     const eventCard = document.createElement("div");
                     eventCard.className = "bg-white rounded-2xl shadow-lg overflow-hidden transform hover:scale-105 transition-all duration-300 cursor-pointer";
+                    eventCard.innerHTML = `
+                        <div class="p-6 border-l-4" style="border-color: ${event.color || '#818cf8'}">
+                            <div class="flex justify-between items-start">
+                                <div>
+                                    <h3 class="text-xl font-bold text-gray-800">${event.agegroup} - ${event.name}</h3>
+                                    <p class="text-gray-600 mt-1">${event.title}</p>
+                                </div>
+                            </div>
 
-                    const card = document.createElement("div");
+                            <div class="mt-4 space-y-2">
-                    card.className = "p-6 border-l-4";
+                                <p class="flex items-center text-gray-700">
-                    card.style.borderColor = event.color || "#818cf8";
+                                    <svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 mr-2 text-indigo-500" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 20h5v-2a3 3 0 00-5.356-1.857M17 20H7m10 0v-2c0-.656-.126-1.283-.356-1.857M7 20H2v-2a3 3 0 015.356-1.857M7 20v-2c0-.656.126-1.283.356-1.857m0 0a5.002 5.002 0 019.288 0M15 7a3 3 0 11-6 0 3 3 0 016 0zm6 3a2 2 0 11-4 0 2 2 0 014 0zM7 10a2 2 0 11-4 0 2 2 0 014 0z" />
+                                    </svg>
+                                    <strong>Adversaire:</strong> ${event.opponent}
+                                </p>
 
-                    const inner = document.createElement("div");
+                                <p class="flex items-center text-gray-700">
-                    inner.className = "flex justify-between items-start";
+                                    <svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 mr-2 text-indigo-500" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17.657 16.657L13.414 20.9a1.998 1.998 0 01-2.827 0l-4.244-4.243a8 8 0 1111.314 0z" />
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 11a3 3 0 11-6 0 3 3 0 016 0z" />
+                                    </svg>
+                                    <strong>Lieu:</strong> ${event.place}
+                                </p>
 
-                    const innerDiv = document.createElement("div");
+                                <p class="flex items-center text-gray-700">
-                    const h3 = document.createElement("h3");
+                                    <svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 mr-2 text-indigo-500" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                    h3.className = "text-xl font-bold text-gray-800";
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
-                    h3.textContent = event.agegroup + " - " + event.name;
+                                    </svg>
-                    const subtitle = document.createElement("p");
+                                    <strong>Heure:</strong> ${event.start} - ${event.end}
-                    subtitle.className = "text-gray-600 mt-1";
+                                </p>
-                    subtitle.textContent = event.title;
+                            </div>
-                    innerDiv.appendChild(h3);
+                        </div>
-                    innerDiv.appendChild(subtitle);
+                    `;
-                    inner.appendChild(innerDiv);
-                    card.appendChild(inner);
-
-                    const detailsDiv = document.createElement("div");
-                    detailsDiv.className = "mt-4 space-y-2";
-
-                    const p1 = document.createElement("p");
-                    p1.className = "flex items-center text-gray-700";
-                    p1.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 mr-2 text-indigo-500" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 20h5v-2a3 3 0 00-5.356-1.857M17 20H7m10 0v-2c0-.656-.126-1.283-.356-1.857M7 20H2v-2a3 3 0 015.356-1.857M7 20v-2c0-.656.126-1.283.356-1.857m0 0a5.002 5.002 0 019.288 0M15 7a3 3 0 11-6 0 3 3 0 016 0zm6 3a2 2 0 11-4 0 2 2 0 014 0zM7 10a2 2 0 11-4 0 2 2 0 014 0z" /></svg><strong>Adversaire:</strong> ';
-                    p1.appendChild(document.createTextNode(event.opponent));
-                    detailsDiv.appendChild(p1);
-
-                    const p2 = document.createElement("p");
-                    p2.className = "flex items-center text-gray-700";
-                    p2.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 mr-2 text-indigo-500" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17.657 16.657L13.414 20.9a1.998 1.998 0 01-2.827 0l-4.244-4.243a8 8 0 1111.314 0z" /><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 11a3 3 0 11-6 0 3 3 0 016 0z" /></svg><strong>Lieu:</strong> ';
-                    p2.appendChild(document.createTextNode(event.place));
-                    detailsDiv.appendChild(p2);
-
-                    const p3 = document.createElement("p");
-                    p3.className = "flex items-center text-gray-700";
-                    p3.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 mr-2 text-indigo-500" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" /></svg><strong>Heure:</strong> ';
-                    p3.appendChild(document.createTextNode(event.start + " - " + event.end));
-                    detailsDiv.appendChild(p3);
-
-                    card.appendChild(detailsDiv);
-                    eventCard.appendChild(card);
                     eventCard.addEventListener("click", () => fetchEventDetails(event.id_event));
                     eventList.appendChild(eventCard);
                 });
@@ -600,172 +591,129 @@
                 })
                     .then(response => response.json())
                 .then(data => {
+                    // Check if available players data exists
                     const availablePlayers = data.convocation.available || [];
                     const sortedPlayers = availablePlayers
                         .sort((a, b) => (a.number || 0) - (b.number || 0));
 
-                    const totalPlayers = sortedPlayers.length;
+                        // Calculate player statistics
-                    const positionCount = {};
+                        const totalPlayers = sortedPlayers.length;
-                    sortedPlayers.forEach(player => {
+                        const positionCount = {};
-                        const position = player.position || "N/A";
+                        sortedPlayers.forEach(player => {
-                        positionCount[position] = (positionCount[position] || 0) + 1;
+                            const position = player.position || "N/A";
-                    });
+                            positionCount[position] = (positionCount[position] || 0) + 1;
+                        });
 
-                    const positionBreakdown = Object.entries(positionCount)
+                        // Generate position breakdown
-                        .map(([position, count]) => position + ": " + count)
+                        const positionBreakdown = Object.entries(positionCount)
-                        .join(", ");
+                            .map(([position, count]) => `${position}: ${count}`)
+                            .join(', ');
 
-                    const playersByPosition = [...sortedPlayers].sort((a, b) => {
+                        // Sort players by position first, then by number
-                        const positionA = a.position || "ZZZ";
+                        const playersByPosition = [...sortedPlayers].sort((a, b) => {
-                        const positionB = b.position || "ZZZ";
+                            // Sort by position first
-                        if (positionA !== positionB) {
+                            const positionA = a.position || "ZZZ"; // Put undefined positions at the end
-                            return positionA.localeCompare(positionB);
+                            const positionB = b.position || "ZZZ";
-                        }
-                        const numA = parseInt(a.number) || 0;
-                        const numB = parseInt(b.number) || 0;
-                        return numA - numB;
-                    });
 
-                    const staffList = data.convocation.staff || [];
+                            if (positionA !== positionB) {
-                    const totalStaff = staffList.length;
+                                return positionA.localeCompare(positionB);
+                            }
 
-                    eventDetailsContent.innerHTML = "";
+                            // If positions are the same, sort by number
+                            const numA = parseInt(a.number) || 0;
+                            const numB = parseInt(b.number) || 0;
+                            return numA - numB;
+                        });
 
-                    if (totalPlayers === 0 && totalStaff === 0) {
+                        // Process staff data
-                        const wrapper = document.createElement("div");
+                        const staffList = data.convocation.staff || [];
-                        wrapper.className = "rounded-xl border border-amber-300 bg-amber-50 p-6";
+                        const totalStaff = staffList.length;
-                        const centerDiv = document.createElement("div");
-                        centerDiv.className = "text-center";
-                        const h5 = document.createElement("h5");
-                        h5.className = "text-2xl font-bold text-gray-800 mb-4";
-                        h5.textContent = data.title;
-                        centerDiv.appendChild(h5);
 
-                        const infoDiv = document.createElement("div");
+                        // Check if there are no players
-                        infoDiv.className = "space-y-2 text-gray-700 mb-6";
+                        if (totalPlayers === 0 && totalStaff === 0) {
-                        const pType = document.createElement("p");
+                            eventDetailsContent.innerHTML = `
-                        pType.innerHTML = "<strong>Type:</strong> ";
+                                <div class="rounded-xl border border-amber-300 bg-amber-50 p-6">
-                        pType.appendChild(document.createTextNode(data.type));
+                                    <div class="text-center">
-                        infoDiv.appendChild(pType);
+                                        <h5 class="text-2xl font-bold text-gray-800 mb-4">${data.title}</h5>
-                        const pLieu = document.createElement("p");
+                                        <div class="space-y-2 text-gray-700 mb-6">
-                        pLieu.innerHTML = "<strong>Lieu:</strong> ";
+                                            <p><strong>Type:</strong> ${data.type}</p>
-                        pLieu.appendChild(document.createTextNode(data.place));
+                                            <p><strong>Lieu:</strong> ${data.place}</p>
-                        infoDiv.appendChild(pLieu);
+                                            <p><strong>Heure:</strong> ${data.time_start} - ${data.time_end}</p>
-                        const pHeure = document.createElement("p");
+                                        </div>
-                        pHeure.innerHTML = "<strong>Heure:</strong> ";
+                                        <div class="bg-amber-100 border border-amber-300 text-amber-800 px-4 py-3 rounded-lg">
-                        pHeure.appendChild(document.createTextNode(data.time_start + " - " + data.time_end));
+                                            <h6 class="font-bold text-lg mb-1">Aucun joueur ni personnel convoqué</h6>
-                        infoDiv.appendChild(pHeure);
+                                            <p>Il n'y a actuellement aucun joueur ni personnel convoqué pour ce match.</p>
-                        centerDiv.appendChild(infoDiv);
+                                        </div>
-
+                                    </div>
-                        const msgDiv = document.createElement("div");
+                                </div>
-                        msgDiv.className = "bg-amber-100 border border-amber-300 text-amber-800 px-4 py-3 rounded-lg";
+                            `;
-                        const msgH6 = document.createElement("h6");
-                        msgH6.className = "font-bold text-lg mb-1";
-                        msgH6.textContent = "Aucun joueur ni personnel convoqué";
-                        msgDiv.appendChild(msgH6);
-                        const msgP = document.createElement("p");
-                        msgP.textContent = "Il n'y a actuellement aucun joueur ni personnel convoqué pour ce match.";
-                        msgDiv.appendChild(msgP);
-                        centerDiv.appendChild(msgDiv);
-                        wrapper.appendChild(centerDiv);
-                        eventDetailsContent.appendChild(wrapper);
-                    } else {
-                        const container = document.createElement("div");
-                        const h5 = document.createElement("h5");
-                        h5.className = "text-2xl font-bold text-gray-800 mb-4";
-                        h5.textContent = data.title;
-                        container.appendChild(h5);
-
-                        const infoDiv = document.createElement("div");
-                        infoDiv.className = "space-y-2 text-gray-700 mb-6";
-                        const pType = document.createElement("p");
-                        pType.innerHTML = "<strong>Type:</strong> ";
-                        pType.appendChild(document.createTextNode(data.type));
-                        infoDiv.appendChild(pType);
-                        const pLieu = document.createElement("p");
-                        pLieu.innerHTML = "<strong>Lieu:</strong> ";
-                        pLieu.appendChild(document.createTextNode(data.place));
-                        infoDiv.appendChild(pLieu);
-                        const pHeure = document.createElement("p");
-                        pHeure.innerHTML = "<strong>Heure:</strong> ";
-                        pHeure.appendChild(document.createTextNode(data.time_start + " - " + data.time_end));
-                        infoDiv.appendChild(pHeure);
-                        container.appendChild(infoDiv);
-
-                        if (totalPlayers === 0) {
-                            const noPlayersDiv = document.createElement("div");
-                            noPlayersDiv.className = "bg-amber-100 border border-amber-300 text-amber-800 px-4 py-3 rounded-lg";
-                            const noPlayersH6 = document.createElement("h6");
-                            noPlayersH6.className = "font-bold mb-1";
-                            noPlayersH6.textContent = "Aucun joueur convoqué";
-                            noPlayersDiv.appendChild(noPlayersH6);
-                            const noPlayersP = document.createElement("p");
-                            noPlayersP.textContent = "Il n'y a actuellement aucun joueur convoqué pour ce match.";
-                            noPlayersDiv.appendChild(noPlayersP);
-                            container.appendChild(noPlayersDiv);
                         } else {
-                            const playersP = document.createElement("p");
+                            let staffHtml = '';
-                            playersP.innerHTML = "<strong>Joueurs convoqués:</strong> ";
+                            if (totalStaff > 0) {
-                            playersP.appendChild(document.createTextNode(totalPlayers + " joueur" + (totalPlayers > 1 ? "s" : "") + " (" + positionBreakdown + ")"));
+                                staffHtml = `
-                            infoDiv.appendChild(playersP);
+                                    <div class="mt-6">
+                                        <h6 class="text-xl font-semibold text-gray-800 mb-3">Personnel (${totalStaff}):</h6>
+                                        <ul class="space-y-2">
+                                            ${staffList.map(staff => {
+                                                return `<li class="flex items-center"><span class="font-medium w-32">${staff.role}:</span> <span>${staff.fname} ${staff.lname}</span></li>`;
+                                            }).join('')}
+                                        </ul>
+                                    </div>
+                                `;
+                            } else {
+                                staffHtml = `
+                                    <div class="mt-6 bg-blue-50 border border-blue-200 text-blue-800 px-4 py-3 rounded-lg">
+                                        <h6 class="font-bold mb-1">Aucun personnel convoqué</h6>
+                                        <p>Il n'y a actuellement aucun personnel convoqué pour ce match.</p>
+                                    </div>
+                                `;
+                            }
 
-                            const playersDiv = document.createElement("div");
+                            if (totalPlayers === 0) {
-                            const playersH6 = document.createElement("h6");
+                                eventDetailsContent.innerHTML = `
-                            playersH6.className = "text-xl font-semibold text-gray-800 mb-3";
+                                    <div>
-                            playersH6.textContent = "Liste des joueurs:";
+                                        <h5 class="text-2xl font-bold text-gray-800 mb-4">${data.title}</h5>
-                            playersDiv.appendChild(playersH6);
+                                        <div class="space-y-2 text-gray-700 mb-6">
-                            const playersUl = document.createElement("ul");
+                                            <p><strong>Type:</strong> ${data.type}</p>
-                            playersUl.className = "grid grid-cols-1 md:grid-cols-2 gap-3";
+                                            <p><strong>Lieu:</strong> ${data.place}</p>
-                            playersByPosition.forEach(player => {
+                                            <p><strong>Heure:</strong> ${data.time_start} - ${data.time_end}</p>
-                                const li = document.createElement("li");
+                                        </div>
-                                li.className = "bg-indigo-50 rounded-lg p-3";
+                                        <div class="bg-amber-100 border border-amber-300 text-amber-800 px-4 py-3 rounded-lg">
-                                const number = player.number ? player.number : "N/A";
+                                            <h6 class="font-bold mb-1">Aucun joueur convoqué</h6>
-                                const position = player.position ? player.position : "N/A";
+                                            <p>Il n'y a actuellement aucun joueur convoqué pour ce match.</p>
-                                li.textContent = "[" + position + "] " + number + " - " + player.fname + " " + player.lname + " (" + player.dob + ")";
+                                        </div>
-                                playersUl.appendChild(li);
+                                        ${staffHtml}
-                            });
+                                    </div>
-                            playersDiv.appendChild(playersUl);
+                                `;
-                            container.appendChild(playersDiv);
+                            } else {
+                                eventDetailsContent.innerHTML = `
+                                    <div>
+                                        <h5 class="text-2xl font-bold text-gray-800 mb-4">${data.title}</h5>
+                                        <div class="space-y-2 text-gray-700 mb-6">
+                                            <p><strong>Type:</strong> ${data.type}</p>
+                                            <p><strong>Lieu:</strong> ${data.place}</p>
+                                            <p><strong>Heure:</strong> ${data.time_start} - ${data.time_end}</p>
+                                            <p><strong>Joueurs convoqués:</strong> ${totalPlayers} joueur${totalPlayers > 1 ? 's' : ''} (${positionBreakdown})</p>
+                                        </div>
+
+                                        <div>
+                                            <h6 class="text-xl font-semibold text-gray-800 mb-3">Liste des joueurs:</h6>
+                                            <ul class="grid grid-cols-1 md:grid-cols-2 gap-3">
+                                                ${playersByPosition.map(player => {
+                                                    let number = player.number ? player.number : "N/A";
+                                                    let position = player.position ? player.position : "N/A";
+                                                    return `<li class="bg-indigo-50 rounded-lg p-3"><span class="font-medium">[${position}] ${number}</span> - ${player.fname} ${player.lname} <span class="text-gray-500 text-sm">(${player.dob})</span></li>`;
+                                                }).join('')}
+                                            </ul>
+                                        </div>
+
+                                        ${staffHtml}
+                                    </div>
+                                `;
+                            }
                         }
-
+                        eventDetailsModal.classList.remove("hidden");
-                        if (totalStaff > 0) {
+                    })
-                            const staffDiv = document.createElement("div");
-                            staffDiv.className = "mt-6";
-                            const staffH6 = document.createElement("h6");
-                            staffH6.className = "text-xl font-semibold text-gray-800 mb-3";
-                            staffH6.textContent = "Personnel (" + totalStaff + "):";
-                            staffDiv.appendChild(staffH6);
-                            const staffUl = document.createElement("ul");
-                            staffUl.className = "space-y-2";
-                            staffList.forEach(staff => {
-                                const li = document.createElement("li");
-                                li.className = "flex items-center";
-                                const roleSpan = document.createElement("span");
-                                roleSpan.className = "font-medium w-32";
-                                roleSpan.textContent = staff.role + ":";
-                                li.appendChild(roleSpan);
-                                li.appendChild(document.createTextNode(" " + staff.fname + " " + staff.lname));
-                                staffUl.appendChild(li);
-                            });
-                            staffDiv.appendChild(staffUl);
-                            container.appendChild(staffDiv);
-                        } else {
-                            const noStaffDiv = document.createElement("div");
-                            noStaffDiv.className = "mt-6 bg-blue-50 border border-blue-200 text-blue-800 px-4 py-3 rounded-lg";
-                            const noStaffH6 = document.createElement("h6");
-                            noStaffH6.className = "font-bold mb-1";
-                            noStaffH6.textContent = "Aucun personnel convoqué";
-                            noStaffDiv.appendChild(noStaffH6);
-                            const noStaffP = document.createElement("p");
-                            noStaffP.textContent = "Il n'y a actuellement aucun personnel convoqué pour ce match.";
-                            noStaffDiv.appendChild(noStaffP);
-                            container.appendChild(noStaffDiv);
-                        }
-
-                        eventDetailsContent.appendChild(container);
-                    }
-                    eventDetailsModal.classList.remove("hidden");
-                })
                     .catch(error => console.error("Erreur lors du chargement des détails de l'événement:", error));
             }
         });

myice/myice.py

@@ -594,16 +594,16 @@ mobile_headers = {
 }
 
 
-# def curl_for_mobile_login(username: str, password: str) -> str:
+def curl_for_mobile_login(username: str, password: str) -> str:
-#     """Generate curl command to replicate mobile_login request."""
+    """Generate curl command to replicate mobile_login request."""
-#     import base64
+    import base64
 
-#     headers_str = " ".join([f"-H '{k}: {v}'" for k, v in mobile_headers.items()])
+    headers_str = " ".join([f"-H '{k}: {v}'" for k, v in mobile_headers.items()])
-#     encoded_username = base64.b64encode(username.encode()).decode()
+    encoded_username = base64.b64encode(username.encode()).decode()
-#     encoded_password = base64.b64encode(password.encode()).decode()
+    encoded_password = base64.b64encode(password.encode()).decode()
-#     return f"""curl -X POST "https://app.myice.hockey/api/mobilerest/login" \
+    return f"""curl -X POST "https://app.myice.hockey/api/mobilerest/login" \
-# {headers_str} \
+{headers_str} \
-# -d 'login_email={encoded_username}&login_password={encoded_password}&language=FR&v=2'"""
+-d 'login_email={encoded_username}&login_password={encoded_password}&language=FR&v=2'"""
 
 
 def mobile_login(config_section: str | None = None):
@@ -619,7 +619,7 @@ def mobile_login(config_section: str | None = None):
 
     print("Requesting token", file=sys.stderr)
     # Print curl equivalent for debugging
-    # print(curl_for_mobile_login(username, password), file=sys.stderr)
+    print(curl_for_mobile_login(username, password), file=sys.stderr)
     with requests.post(
         "https://app.myice.hockey/api/mobilerest/login",
         headers=mobile_headers,
@@ -643,26 +643,23 @@ userdata = {
 }
 
 
-# def curl_for_refresh_data(token: str, club_id: int) -> str:
+def curl_for_refresh_data(token: str, club_id: int) -> str:
-#     """Generate curl command to replicate refresh_data request."""
+    """Generate curl command to replicate refresh_data request."""
-#     headers_str = " ".join([f"-H '{k}: {v}'" for k, v in mobile_headers.items()])
+    headers_str = " ".join([f"-H '{k}: {v}'" for k, v in mobile_headers.items()])
-#     return f"""curl -X POST "https://app.myice.hockey/api/mobilerest/refreshdata" \
+    return f"""curl -X POST "https://app.myice.hockey/api/mobilerest/refreshdata" \
-# {headers_str} \
+{headers_str} \
-# -d 'token={token}&id_club={club_id}&language=FR'"""
+-d 'token={token}&id_club={club_id}&language=FR'"""
 
 
-def refresh_data(user_data=None):
+def refresh_data():
-    # Use provided user_data or fall back to global userdata for backward compatibility
-    if user_data is None:
-        user_data = userdata
     # Print curl equivalent for debugging
-    # print(
+    print(
-    #     curl_for_refresh_data(user_data["token"], user_data["id_club"]), file=sys.stderr
+        curl_for_refresh_data(userdata["token"], userdata["id_club"]), file=sys.stderr
-    # )
+    )
     with requests.post(
         "https://app.myice.hockey/api/mobilerest/refreshdata",
         headers=mobile_headers,
-        data=f"token={user_data['token']}&id_club={user_data['id_club']}&language=FR",
+        data=f"token={userdata['token']}&id_club={userdata['id_club']}&language=FR",
         # verify=False,
     ) as r:
         r.raise_for_status()

myice/webapi.py

@@ -352,15 +352,15 @@ async def schedule(
 
     try:
         if existing_token:
-            user_data = {
+            myice.userdata = {
                 "id": userid,
                 "id_club": club_id or 186,
                 "token": existing_token,
             }
         else:
-            user_data = myice.mobile_login(config_section=account)
+            myice.userdata = myice.mobile_login(config_section=account)
 
-        data = myice.refresh_data(user_data=user_data)
+        data = myice.refresh_data()
         if "club_games" in data:
             return data["club_games"]
         else:
@@ -433,13 +433,13 @@ async def game(
         config_section=account
     )
     if existing_token:
-        user_data = {
+        myice.userdata = {
             "id": userid,
             "id_club": club_id or 186,
             "token": existing_token,
         }
     else:
-        user_data = myice.mobile_login(config_section=account)
+        myice.userdata = myice.mobile_login(config_section=account)
 
     # data = refresh_data()
     with requests.post(
@@ -447,11 +447,11 @@ async def game(
         headers=myice.mobile_headers,
         data="&".join(
             [
-                f"token={user_data['token']}",
+                f"token={myice.userdata['token']}",
                 f"id_event={game_id}",
                 "type=games",
-                f"id_player={user_data['id']}",
+                f"id_player={myice.userdata['id']}",
-                f"id_club={user_data['id_club']}",
+                f"id_club={myice.userdata['id_club']}",
                 "language=FR",
             ]
         ),