fix: specific redirect codes for mobile

Complete Flutter mobile app structure with:
- All data models (Account, Event, Player, Staff, Convocation, EventDetail, UserInfo)
- ApiService with Dio and Bearer token interceptor
- AuthService with OIDC via flutter_web_auth and deep links
- AuthProvider, ScheduleProvider, EventDetailProvider state management
- LoginScreen, ScheduleScreen with filters, EventDetailScreen
- Reusable widgets: EventCard, FilterDropdown, LoadingIndicator
- main.dart with MultiProvider and auth initialization
- AndroidManifest.xml and Info.plist deep link configuration for myice://callback

Connects to existing FastAPI backend for schedule, events, and auth.

.gitignore

@@ -3,7 +3,11 @@ myice.ini
 schedule.json
 .envrc
 cookies.txt
-# Byte-compiled / optimized / DLL files
+# Tailwind CSS generated artifacts
+style.css
+tailwindcss
+
+# Python bytecode
 __pycache__/
 *.py[cod]
 *$py.class
@@ -165,3 +169,4 @@ cython_debug/
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
+strix_runs/*

.markdownlintignore

@@ -0,0 +1 @@
+docs/superpowers/specs/*.md

.pre-commit-config.yaml

@@ -40,7 +40,7 @@ repos:
     rev: v0.13.0
     hooks:
       - id: markdownlint
-        exclude: "^.github|(^docs/_sidebar\\.md$)"
+        exclude: "^.github|_sidebar\\.md$|superpowers/(specs|plans)/.*\\.md$"
 
   - repo: https://github.com/shellcheck-py/shellcheck-py
     rev: v0.11.0.1

AGENTS.md

@@ -48,6 +48,21 @@ pre-commit run ruff-format --files myice/webapi.py
 pre-commit run mypy --files myice/myice.py
 ```
 
+### CSS/Frontend Build
+
+When modifying `index.html` or the Tailwind CSS setup:
+
+```bash
+# One-off build of style.css
+./build-css.sh
+
+# Watch mode for development
+./build-css.sh --watch
+
+# Or manually with the standalone CLI (if already downloaded)
+./tailwindcss -i ./style-input.css -o ./style.css --minify
+```
+
 ### Running the Web API
 
 ```bash

Dockerfile

@@ -4,7 +4,12 @@ FROM python:3.13-slim AS builder
 # Create working directory
 WORKDIR /app
 
-# poetry export -f requirements.txt --output requirements.txt --without-hashes
+# Install tools needed for Tailwind CSS build
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
 # Copy dependency files
 COPY requirements.txt ./
 
@@ -12,6 +17,12 @@ COPY requirements.txt ./
 RUN --mount=type=cache,target=/root/.cache/pip \
     pip install --no-deps --disable-pip-version-check -r requirements.txt
 
+# Build Tailwind CSS
+COPY index.html style-input.css tailwind.config.js ./
+RUN curl -sL https://github.com/tailwindlabs/tailwindcss/releases/download/v3.4.17/tailwindcss-linux-x64 -o tailwindcss \
+    && chmod +x tailwindcss \
+    && ./tailwindcss -i ./style-input.css -o ./style.css --minify
+
 # Runtime stage
 FROM python:3.13-slim AS runtime
 
@@ -29,8 +40,9 @@ RUN useradd --home-dir /app --no-create-home --uid 1000 myice
 # Copy installed packages from builder stage
 COPY --from=builder /usr/local/lib/python3.13/site-packages /usr/local/lib/python3.13/site-packages
 
-# Copy application code
+# Copy application code and compiled assets
 COPY index.html favicon.ico ./
+COPY --from=builder /app/style.css ./style.css
 COPY myice ./myice
 
 # Change ownership of copied files

build-css.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+set -euo pipefail
+
+# Build CSS using Tailwind CSS standalone CLI
+# For local development, run:
+#   ./build-css.sh        # one-off build
+#   ./build-css.sh --watch  # watch mode
+
+version="v3.4.17"
+os="$(uname -s)"
+arch="$(uname -m)"
+
+case "$os" in
+    Linux*)     platform="linux";;
+    Darwin*)    platform="macos";;
+    *)          echo "Unsupported OS: $os"; exit 1;;
+esac
+
+case "$arch" in
+    x86_64)     arch="x64";;
+    arm64)      arch="arm64";;
+    aarch64)    arch="arm64";;
+    *)          echo "Unsupported architecture: $arch"; exit 1;;
+esac
+
+binary="tailwindcss-${platform}-${arch}"
+url="https://github.com/tailwindlabs/tailwindcss/releases/download/${version}/${binary}"
+
+if [ ! -f "tailwindcss" ]; then
+    echo "Downloading Tailwind CSS standalone CLI (${version} ${platform}/${arch})..."
+    curl -sL "$url" -o tailwindcss
+    chmod +x tailwindcss
+fi
+
+if [ "${1:-}" == "--watch" ]; then
+    echo "Building CSS in watch mode..."
+    ./tailwindcss -i ./style-input.css -o ./style.css --watch
+else
+    echo "Building CSS..."
+    ./tailwindcss -i ./style-input.css -o ./style.css --minify
+fi

docs/superpowers/specs/2026-07-06-myice-flutter-app-design.md

@@ -0,0 +1,350 @@
+<!-- markdownlint-disable-file -->
+# MyIce Flutter App - Design Specification
+
+**Date:** 2026-07-06
+**Context:** Application mobile Flutter (iOS/Android) reproduisant le fonctionnement de la webapp myice existante.
+**Backend:** L'application se connecte a l'API FastAPI existante (myice/webapi.py) via HTTP.
+
+## 1. Architecture globale
+
+Approche : **Repository + Provider (B)**
+
+```
+lib/
+├── main.dart                  # Entry point, MaterialApp, MultiProvider
+├── config/
+│   └── api_config.dart         # URL base de l'API, timeouts
+├── models/
+│   ├── account.dart            # {name, label}
+│   ├── event.dart              # Game/Practice du schedule
+│   ├── event_detail.dart       # Details + convocation
+│   ├── user_info.dart          # {email}
+│   └── convocation.dart        # Player, Staff, Convocation
+├── services/
+│   ├── api_service.dart        # Dio + intercepteur Bearer
+│   └── auth_service.dart       # Login/logout OIDC, deep link
+├── providers/
+│   ├── auth_provider.dart      # Etat auth + user info
+│   ├── schedule_provider.dart  # Liste events + filtres
+│   └── event_provider.dart     # Details d'un event (optionnel)
+├── repositories/
+│   └── myice_repository.dart   # Appels API : accounts, schedule, game
+├── screens/
+│   ├── login_screen.dart
+│   ├── schedule_screen.dart
+│   └── event_detail_screen.dart
+└── widgets/
+    ├── event_card.dart
+    ├── filter_dropdown.dart
+    └── loading_indicator.dart
+```
+
+**Pattern :** Repository encapsule les appels API -> Providers gerent l'etat reactif -> Screens ecoutent les Providers.
+
+## 2. Dependances Flutter
+
+```yaml
+dependencies:
+  flutter:
+    sdk: flutter
+  dio: ^5.4.0
+  provider: ^6.1.0
+  shared_preferences: ^2.2.0
+  flutter_web_auth: ^0.6.0
+  intl: ^0.19.0  # Pour le parsing/formatage de dates si besoin
+```
+
+## 3. Modeles de donnees (JSON <-> Dart)
+
+### Account
+```dart
+class Account {
+  final String name;
+  final String label;
+  Account({required this.name, required this.label});
+  factory Account.fromJson(Map<String, dynamic> json) => Account(
+    name: json['name'] as String,
+    label: json['label'] as String,
+  );
+}
+```
+
+### Event
+Provenant de `/schedule`.
+```dart
+class Event {
+  final String idEvent;
+  final String agegroup;
+  final String name;
+  final String title;
+  final String opponent;
+  final String place;
+  final String start;
+  final String end;
+  final String? color;
+  final String eventType; // mappe depuis le champ JSON 'event'
+
+  Event({
+    required this.idEvent,
+    required this.agegroup,
+    required this.name,
+    required this.title,
+    required this.opponent,
+    required this.place,
+    required this.start,
+    required this.end,
+    this.color,
+    required this.eventType,
+  });
+
+  factory Event.fromJson(Map<String, dynamic> json) => Event(
+    idEvent: json['id_event']?.toString() ?? '',
+    agegroup: json['agegroup'] as String,
+    name: json['name'] as String? ?? '',
+    title: json['title'] as String,
+    opponent: json['opponent'] as String? ?? '',
+    place: json['place'] as String? ?? '',
+    start: json['start'] as String,
+    end: json['end'] as String,
+    color: json['color'] as String?,
+    eventType: json['event'] as String? ?? '',
+  );
+}
+```
+
+### Player
+```dart
+class Player {
+  final String? position;
+  final String? number;
+  final String fname;
+  final String lname;
+  final String dob;
+
+  Player({this.position, this.number, required this.fname, required this.lname, required this.dob});
+
+  factory Player.fromJson(Map<String, dynamic> json) => Player(
+    position: json['position'] as String?,
+    number: json['number']?.toString(),
+    fname: json['fname'] as String,
+    lname: json['lname'] as String,
+    dob: json['dob'] as String,
+  );
+}
+```
+
+### Staff
+```dart
+class Staff {
+  final String role;
+  final String fname;
+  final String lname;
+
+  Staff({required this.role, required this.fname, required this.lname});
+
+  factory Staff.fromJson(Map<String, dynamic> json) => Staff(
+    role: json['role'] as String,
+    fname: json['fname'] as String,
+    lname: json['lname'] as String,
+  );
+}
+```
+
+### Convocation
+```dart
+class Convocation {
+  final List<Player> available;
+  final List<Staff> staff;
+
+  Convocation({required this.available, required this.staff});
+
+  factory Convocation.fromJson(Map<String, dynamic> json) => Convocation(
+    available: (json['available'] as List? ?? [])
+        .map((e) => Player.fromJson(e as Map<String, dynamic>))
+        .toList(),
+    staff: (json['staff'] as List? ?? [])
+        .map((e) => Staff.fromJson(e as Map<String, dynamic>))
+        .toList(),
+  );
+}
+```
+
+### EventDetail
+Provenant de `/game/{id}`.
+```dart
+class EventDetail {
+  final String title;
+  final String type;
+  final String place;
+  final String timeStart;
+  final String timeEnd;
+  final Convocation convocation;
+
+  EventDetail({
+    required this.title,
+    required this.type,
+    required this.place,
+    required this.timeStart,
+    required this.timeEnd,
+    required this.convocation,
+  });
+
+  factory EventDetail.fromJson(Map<String, dynamic> json) => EventDetail(
+    title: json['title'] as String,
+    type: json['type'] as String,
+    place: json['place'] as String? ?? '',
+    timeStart: json['time_start'] as String,
+    timeEnd: json['time_end'] as String,
+    convocation: Convocation.fromJson(json['convocation'] as Map<String, dynamic>),
+  );
+}
+```
+
+### UserInfo
+```dart
+class UserInfo {
+  final String email;
+  UserInfo({required this.email});
+  factory UserInfo.fromJson(Map<String, dynamic> json) => UserInfo(
+    email: json['email'] as String? ?? '',
+  );
+}
+```
+
+## 4. Services
+
+### ApiService
+Utilise `dio`. Un intercepteur ajoute automatiquement le header `Authorization: Bearer <token>`.
+
+Concept:
+- `setBearerToken(token)` ajoute un `InterceptorsWrapper` a Dio.
+- `clearBearerToken()` retire les intercepteurs existants.
+- Methodes: `getAccounts()`, `getSchedule(account)`, `getGameDetail(gameId, account)`, `getUserInfo()`.
+- Retournent des objets modeles via `fromJson`.
+
+### AuthService
+Utilise `flutter_web_auth` pour l'OIDC + `shared_preferences` pour stocker le token.
+
+Concept:
+- `storedToken`, `storedAccount` depuis `SharedPreferences`.
+- `login()`: appelle `FlutterWebAuth.authenticate(url: baseUrl/login, callbackUrlScheme: 'myice')`. Parse le fragment `#access_token=xxx` de l'URL retournee. Stocke le token.
+- `setAccount(account)`: persiste le compte selectionne.
+- `logout()`: supprime token, account, userInfo des prefs.
+
+**Configuration deep link requise:**
+- Android: intent-filter dans `AndroidManifest.xml` pour scheme `myice://`.
+- iOS: `CFBundleURLTypes` dans `Info.plist` avec scheme `myice`.
+
+## 5. Providers (Provider package)
+
+### AuthProvider
+Gere l'etat global d'authentification.
+
+**Etat:** `isAuthenticated`, `userInfo`.
+**Methodes:**
+- `init()`: Verifie token stocke, appelle `/userinfo`. Si 401, considere deconnecte.
+- `login()`: Lance AuthService.login(), met a jour le token, appelle `/userinfo`, notifie listeners.
+- `logout()`: Efface le token, notifie listeners.
+
+### ScheduleProvider
+Gere les events, les comptes, et les filtres.
+
+**Etat:** `accounts`, `events`, `selectedAccount`, `selectedAgegroup`, `selectedSubgroup`, `isLoading`, `error`.
+**Methodes:**
+- `loadAccounts()`: Appelle `/accounts`, met a jour `accounts`. Selectionne `storedAccount` si present, sinon le premier.
+- `loadSchedule()`: Met `isLoading = true`, appelle `/schedule?account=selectedAccount`, filtre events ou `eventType == "Jeu"`, extrait les `agegroup` uniques pour les filtres.
+- `setAccount(String)`: Met a jour `selectedAccount`, sauvegarde dans SharedPreferences, appelle `loadSchedule()`.
+- `setAgegroup(String)`: Met a jour, reset `selectedSubgroup`, notifie.
+- `setSubgroup(String)`: Met a jour, notifie.
+- `get filteredEvents`: Getter filtre `events` par `agegroup` et `subgroup`.
+
+**Logique de filtre sous-groupe:**
+Identique a la webapp. La fonction `extractSubgroup(name)` retire la partie apres `" - "` dans le `name` de l'event pour obtenir le sous-groupe (si applicable).
+
+### EventDetailProvider (Optionnel)
+Gere le chargement des details d'un event. Peut etre integre dans `ScheduleProvider` si prefere pour garder un seul provider.
+
+**Etat:** `eventDetail`, `isLoading`, `error`.
+**Methodes:** `loadEventDetail(gameId)` appelle `/game/{gameId}`.
+
+## 6. Ecrans
+
+### LoginScreen
+- **AppBar:** Aucune (centre).
+- **Body:** Column centree.
+  - Titre: "MyIce - Games" (headlineLarge, couleur indigo).
+  - Bouton: "Se connecter avec Infomaniak" (style degrade indigo -> violet).
+  - Texte d'aide: "Connectez-vous pour acceder aux evenements...".
+- **Comportement:**
+  - Si `authProvider.isAuthenticated`, navigue automatiquement vers `ScheduleScreen`.
+  - Affiche `CircularProgressIndicator` pendant le login.
+  - SnackBar en cas d'erreur.
+
+### ScheduleScreen
+- **AppBar:** Titre "MyIce", action logout + email utilisateur.
+- **Body:**
+  - **Filtres:** Card avec 3 `DropdownButtonFormField` (Compte, Age, Sous-groupe). Le bouton "Charger" est optionnel (changement de compte recharge auto).
+  - **Liste:** `Expanded` + `ListView.builder`. Affiche `EventCard` pour chaque event filtre.
+  - Etats: Loading (`CircularProgressIndicator`), vide (texte info), erreur (SnackBar).
+
+### EventDetailScreen
+- **AppBar:** Titre = `event.title`, bouton retour.
+- **Body:** `SingleChildScrollView` + `Padding(16)`.
+  - Card recap: Type, Lieu, Heure.
+  - Section Joueurs:
+    - Si vide: Card amber "Aucun joueur convoque".
+    - Sinon: Card avec total + repartition positions. Liste triee par position puis numero: `[Position] #Num - Prenom Nom (DOB)`.
+  - Section Personnel:
+    - Si vide: Card bleu "Aucun personnel convoque".
+    - Sinon: Liste `role: Prenom Nom`.
+  - Si aucun joueur ET aucun personnel: Card amber principal "Aucun joueur ni personnel convoque" uniquement.
+
+### Widgets reutilisables
+- **EventCard:** Card avec bordure laterale coloree. Titre (`agegroup - name`), sous-titre, details (adversaire, lieu, heure). onTap -> `EventDetailScreen`.
+- **FilterDropdown:** `DropdownButtonFormField` generique stylise.
+
+## 7. Navigation & Routing
+
+Utilisation de `Navigator` classique (pas de package tierce pour 3 ecrans).
+- `main.dart`: `MaterialApp` avec `home` determine par `Consumer<AuthProvider>` (`ScheduleScreen` ou `LoginScreen`).
+- Navigation details: `Navigator.push(MaterialPageRoute(builder: (_) => EventDetailScreen(...)))`.
+
+## 8. Gestion des erreurs
+
+- Erreur reseau / API: SnackBar rouge avec message.
+- 401 (Token expire): Deconnexion automatique + redirection `LoginScreen`.
+- JSON malforme: La webapp gere cote backend. Cote Flutter, `jsonDecode` echoue -> message "Donnees invalides".
+- Aucun event/joueur: Interface vide avec message informatif (pas d'erreur).
+
+## 9. Configuration requise
+
+### Android
+Ajouter un intent-filter dans `android/app/src/main/AndroidManifest.xml` pour le deep link `myice://callback`.
+
+### iOS
+Ajouter `CFBundleURLTypes` dans `ios/Runner/Info.plist` avec scheme `myice`.
+
+### Configuration API
+`lib/config/api_config.dart`:
+```dart
+class ApiConfig {
+  static const String baseUrl = 'https://your-api-domain.com'; // A configurer
+}
+```
+
+## 10. Plan d'implementation (High-level)
+
+1. Scaffolding du projet Flutter (`flutter create`).
+2. Ajout des dependances (`pubspec.yaml`).
+3. Configuration des deep links (`AndroidManifest` + `Info.plist`).
+4. Implementation des modeles de donnees (`fromJson`).
+5. Implementation des services (`ApiService`, `AuthService`).
+6. Implementation des providers (`AuthProvider`, `ScheduleProvider`).
+7. Implementation des ecrans (`LoginScreen`, `ScheduleScreen`, `EventDetailScreen`).
+8. Implementation des widgets (`EventCard`, etc.).
+9. Wiring dans `main.dart` avec `MultiProvider`.
+10. Tests manuels de l'auth OIDC et de la navigation.
+
+---
+
+**Prochaine etape apres validation du spec:** Creer le plan d'implementation detaille avec le skill `writing-plans`.

index.html

@@ -5,7 +5,7 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>MyIce - Games</title>
-    <script src="https://cdn.tailwindcss.com"></script>
+    <link rel="stylesheet" href="/style.css">
     <link rel="icon" href="favicon.ico" type="image/x-icon">
 </head>
 
@@ -475,6 +475,17 @@
                 subgroupSelect.innerHTML = '<option value="">Tous</option>';
             }
 
+            function extractSubgroup(name) {
+                // Extract subgroup from name by removing opponent part after " - "
+                if (!name) return "";
+                const parts = name.split(" - ");
+                if (parts.length > 1) {
+                    parts.pop(); // Remove opponent
+                    return parts.join(" - ");
+                }
+                return name;
+            }
+
             function updateSubgroupOptions(selectedAgegroup, events) {
                 // Reset subgroup options
                 subgroupSelect.innerHTML = '<option value="">Tous</option>';
@@ -493,10 +504,9 @@
                 events
                     .filter(event => event.agegroup === selectedAgegroup)
                     .forEach(event => {
-                        // Extract subgroup from event.name or event.title
+                        // Extract subgroup from event.name by removing opponent
-                        // This assumes the subgroup is part of the name field
                         if (event.name && event.name !== selectedAgegroup) {
-                            subgroups.add(event.name);
+                            subgroups.add(extractSubgroup(event.name));
                         }
                     });
 
@@ -521,7 +531,8 @@
                     if (selectedAgegroup !== "" && event.agegroup !== selectedAgegroup) return false;
 
                     // Filter by subgroup
-                    if (selectedSubgroup !== "" && event.name !== selectedSubgroup) return false;
+                    let eventSubgroup = extractSubgroup(event.name);
+                    if (selectedSubgroup !== "" && eventSubgroup !== selectedSubgroup) return false;
 
                     return true;
                 });
@@ -534,40 +545,49 @@
                 filteredEvents.forEach(event => {
                     const eventCard = document.createElement("div");
                     eventCard.className = "bg-white rounded-2xl shadow-lg overflow-hidden transform hover:scale-105 transition-all duration-300 cursor-pointer";
-                    eventCard.innerHTML = `
-                        <div class="p-6 border-l-4" style="border-color: ${event.color || '#818cf8'}">
-                            <div class="flex justify-between items-start">
-                                <div>
-                                    <h3 class="text-xl font-bold text-gray-800">${event.agegroup} - ${event.name}</h3>
-                                    <p class="text-gray-600 mt-1">${event.title}</p>
-                                </div>
-                            </div>
 
-                            <div class="mt-4 space-y-2">
+                    const card = document.createElement("div");
-                                <p class="flex items-center text-gray-700">
+                    card.className = "p-6 border-l-4";
-                                    <svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 mr-2 text-indigo-500" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                    card.style.borderColor = event.color || "#818cf8";
-                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 20h5v-2a3 3 0 00-5.356-1.857M17 20H7m10 0v-2c0-.656-.126-1.283-.356-1.857M7 20H2v-2a3 3 0 015.356-1.857M7 20v-2c0-.656.126-1.283.356-1.857m0 0a5.002 5.002 0 019.288 0M15 7a3 3 0 11-6 0 3 3 0 016 0zm6 3a2 2 0 11-4 0 2 2 0 014 0zM7 10a2 2 0 11-4 0 2 2 0 014 0z" />
-                                    </svg>
-                                    <strong>Adversaire:</strong> ${event.opponent}
-                                </p>
 
-                                <p class="flex items-center text-gray-700">
+                    const inner = document.createElement("div");
-                                    <svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 mr-2 text-indigo-500" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                    inner.className = "flex justify-between items-start";
-                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17.657 16.657L13.414 20.9a1.998 1.998 0 01-2.827 0l-4.244-4.243a8 8 0 1111.314 0z" />
-                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 11a3 3 0 11-6 0 3 3 0 016 0z" />
-                                    </svg>
-                                    <strong>Lieu:</strong> ${event.place}
-                                </p>
 
-                                <p class="flex items-center text-gray-700">
+                    const innerDiv = document.createElement("div");
-                                    <svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 mr-2 text-indigo-500" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                    const h3 = document.createElement("h3");
-                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
+                    h3.className = "text-xl font-bold text-gray-800";
-                                    </svg>
+                    h3.textContent = event.agegroup + " - " + event.name;
-                                    <strong>Heure:</strong> ${event.start} - ${event.end}
+                    const subtitle = document.createElement("p");
-                                </p>
+                    subtitle.className = "text-gray-600 mt-1";
-                            </div>
+                    subtitle.textContent = event.title;
-                        </div>
+                    innerDiv.appendChild(h3);
-                    `;
+                    innerDiv.appendChild(subtitle);
+                    inner.appendChild(innerDiv);
+                    card.appendChild(inner);
+
+                    const detailsDiv = document.createElement("div");
+                    detailsDiv.className = "mt-4 space-y-2";
+
+                    const p1 = document.createElement("p");
+                    p1.className = "flex items-center text-gray-700";
+                    p1.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 mr-2 text-indigo-500" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 20h5v-2a3 3 0 00-5.356-1.857M17 20H7m10 0v-2c0-.656-.126-1.283-.356-1.857M7 20H2v-2a3 3 0 015.356-1.857M7 20v-2c0-.656.126-1.283.356-1.857m0 0a5.002 5.002 0 019.288 0M15 7a3 3 0 11-6 0 3 3 0 016 0zm6 3a2 2 0 11-4 0 2 2 0 014 0zM7 10a2 2 0 11-4 0 2 2 0 014 0z" /></svg><strong>Adversaire:</strong> ';
+                    p1.appendChild(document.createTextNode(event.opponent));
+                    detailsDiv.appendChild(p1);
+
+                    const p2 = document.createElement("p");
+                    p2.className = "flex items-center text-gray-700";
+                    p2.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 mr-2 text-indigo-500" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17.657 16.657L13.414 20.9a1.998 1.998 0 01-2.827 0l-4.244-4.243a8 8 0 1111.314 0z" /><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 11a3 3 0 11-6 0 3 3 0 016 0z" /></svg><strong>Lieu:</strong> ';
+                    p2.appendChild(document.createTextNode(event.place));
+                    detailsDiv.appendChild(p2);
+
+                    const p3 = document.createElement("p");
+                    p3.className = "flex items-center text-gray-700";
+                    p3.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5 mr-2 text-indigo-500" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" /></svg><strong>Heure:</strong> ';
+                    p3.appendChild(document.createTextNode(event.start + " - " + event.end));
+                    detailsDiv.appendChild(p3);
+
+                    card.appendChild(detailsDiv);
+                    eventCard.appendChild(card);
                     eventCard.addEventListener("click", () => fetchEventDetails(event.id_event));
                     eventList.appendChild(eventCard);
                 });
@@ -580,129 +600,172 @@
                 })
                     .then(response => response.json())
                 .then(data => {
-                    // Check if available players data exists
                     const availablePlayers = data.convocation.available || [];
                     const sortedPlayers = availablePlayers
                         .sort((a, b) => (a.number || 0) - (b.number || 0));
 
-                        // Calculate player statistics
+                    const totalPlayers = sortedPlayers.length;
-                        const totalPlayers = sortedPlayers.length;
+                    const positionCount = {};
-                        const positionCount = {};
+                    sortedPlayers.forEach(player => {
-                        sortedPlayers.forEach(player => {
+                        const position = player.position || "N/A";
-                            const position = player.position || "N/A";
+                        positionCount[position] = (positionCount[position] || 0) + 1;
-                            positionCount[position] = (positionCount[position] || 0) + 1;
+                    });
-                        });
 
-                        // Generate position breakdown
+                    const positionBreakdown = Object.entries(positionCount)
-                        const positionBreakdown = Object.entries(positionCount)
+                        .map(([position, count]) => position + ": " + count)
-                            .map(([position, count]) => `${position}: ${count}`)
+                        .join(", ");
-                            .join(', ');
 
-                        // Sort players by position first, then by number
+                    const playersByPosition = [...sortedPlayers].sort((a, b) => {
-                        const playersByPosition = [...sortedPlayers].sort((a, b) => {
+                        const positionA = a.position || "ZZZ";
-                            // Sort by position first
+                        const positionB = b.position || "ZZZ";
-                            const positionA = a.position || "ZZZ"; // Put undefined positions at the end
+                        if (positionA !== positionB) {
-                            const positionB = b.position || "ZZZ";
+                            return positionA.localeCompare(positionB);
-
-                            if (positionA !== positionB) {
-                                return positionA.localeCompare(positionB);
-                            }
-
-                            // If positions are the same, sort by number
-                            const numA = parseInt(a.number) || 0;
-                            const numB = parseInt(b.number) || 0;
-                            return numA - numB;
-                        });
-
-                        // Process staff data
-                        const staffList = data.convocation.staff || [];
-                        const totalStaff = staffList.length;
-
-                        // Check if there are no players
-                        if (totalPlayers === 0 && totalStaff === 0) {
-                            eventDetailsContent.innerHTML = `
-                                <div class="rounded-xl border border-amber-300 bg-amber-50 p-6">
-                                    <div class="text-center">
-                                        <h5 class="text-2xl font-bold text-gray-800 mb-4">${data.title}</h5>
-                                        <div class="space-y-2 text-gray-700 mb-6">
-                                            <p><strong>Type:</strong> ${data.type}</p>
-                                            <p><strong>Lieu:</strong> ${data.place}</p>
-                                            <p><strong>Heure:</strong> ${data.time_start} - ${data.time_end}</p>
-                                        </div>
-                                        <div class="bg-amber-100 border border-amber-300 text-amber-800 px-4 py-3 rounded-lg">
-                                            <h6 class="font-bold text-lg mb-1">Aucun joueur ni personnel convoqué</h6>
-                                            <p>Il n'y a actuellement aucun joueur ni personnel convoqué pour ce match.</p>
-                                        </div>
-                                    </div>
-                                </div>
-                            `;
-                        } else {
-                            let staffHtml = '';
-                            if (totalStaff > 0) {
-                                staffHtml = `
-                                    <div class="mt-6">
-                                        <h6 class="text-xl font-semibold text-gray-800 mb-3">Personnel (${totalStaff}):</h6>
-                                        <ul class="space-y-2">
-                                            ${staffList.map(staff => {
-                                                return `<li class="flex items-center"><span class="font-medium w-32">${staff.role}:</span> <span>${staff.fname} ${staff.lname}</span></li>`;
-                                            }).join('')}
-                                        </ul>
-                                    </div>
-                                `;
-                            } else {
-                                staffHtml = `
-                                    <div class="mt-6 bg-blue-50 border border-blue-200 text-blue-800 px-4 py-3 rounded-lg">
-                                        <h6 class="font-bold mb-1">Aucun personnel convoqué</h6>
-                                        <p>Il n'y a actuellement aucun personnel convoqué pour ce match.</p>
-                                    </div>
-                                `;
-                            }
-
-                            if (totalPlayers === 0) {
-                                eventDetailsContent.innerHTML = `
-                                    <div>
-                                        <h5 class="text-2xl font-bold text-gray-800 mb-4">${data.title}</h5>
-                                        <div class="space-y-2 text-gray-700 mb-6">
-                                            <p><strong>Type:</strong> ${data.type}</p>
-                                            <p><strong>Lieu:</strong> ${data.place}</p>
-                                            <p><strong>Heure:</strong> ${data.time_start} - ${data.time_end}</p>
-                                        </div>
-                                        <div class="bg-amber-100 border border-amber-300 text-amber-800 px-4 py-3 rounded-lg">
-                                            <h6 class="font-bold mb-1">Aucun joueur convoqué</h6>
-                                            <p>Il n'y a actuellement aucun joueur convoqué pour ce match.</p>
-                                        </div>
-                                        ${staffHtml}
-                                    </div>
-                                `;
-                            } else {
-                                eventDetailsContent.innerHTML = `
-                                    <div>
-                                        <h5 class="text-2xl font-bold text-gray-800 mb-4">${data.title}</h5>
-                                        <div class="space-y-2 text-gray-700 mb-6">
-                                            <p><strong>Type:</strong> ${data.type}</p>
-                                            <p><strong>Lieu:</strong> ${data.place}</p>
-                                            <p><strong>Heure:</strong> ${data.time_start} - ${data.time_end}</p>
-                                            <p><strong>Joueurs convoqués:</strong> ${totalPlayers} joueur${totalPlayers > 1 ? 's' : ''} (${positionBreakdown})</p>
-                                        </div>
-
-                                        <div>
-                                            <h6 class="text-xl font-semibold text-gray-800 mb-3">Liste des joueurs:</h6>
-                                            <ul class="grid grid-cols-1 md:grid-cols-2 gap-3">
-                                                ${playersByPosition.map(player => {
-                                                    let number = player.number ? player.number : "N/A";
-                                                    let position = player.position ? player.position : "N/A";
-                                                    return `<li class="bg-indigo-50 rounded-lg p-3"><span class="font-medium">[${position}] ${number}</span> - ${player.fname} ${player.lname} <span class="text-gray-500 text-sm">(${player.dob})</span></li>`;
-                                                }).join('')}
-                                            </ul>
-                                        </div>
-
-                                        ${staffHtml}
-                                    </div>
-                                `;
-                            }
                         }
-                        eventDetailsModal.classList.remove("hidden");
+                        const numA = parseInt(a.number) || 0;
-                    })
+                        const numB = parseInt(b.number) || 0;
+                        return numA - numB;
+                    });
+
+                    const staffList = data.convocation.staff || [];
+                    const totalStaff = staffList.length;
+
+                    eventDetailsContent.innerHTML = "";
+
+                    if (totalPlayers === 0 && totalStaff === 0) {
+                        const wrapper = document.createElement("div");
+                        wrapper.className = "rounded-xl border border-amber-300 bg-amber-50 p-6";
+                        const centerDiv = document.createElement("div");
+                        centerDiv.className = "text-center";
+                        const h5 = document.createElement("h5");
+                        h5.className = "text-2xl font-bold text-gray-800 mb-4";
+                        h5.textContent = data.title;
+                        centerDiv.appendChild(h5);
+
+                        const infoDiv = document.createElement("div");
+                        infoDiv.className = "space-y-2 text-gray-700 mb-6";
+                        const pType = document.createElement("p");
+                        pType.innerHTML = "<strong>Type:</strong> ";
+                        pType.appendChild(document.createTextNode(data.type));
+                        infoDiv.appendChild(pType);
+                        const pLieu = document.createElement("p");
+                        pLieu.innerHTML = "<strong>Lieu:</strong> ";
+                        pLieu.appendChild(document.createTextNode(data.place));
+                        infoDiv.appendChild(pLieu);
+                        const pHeure = document.createElement("p");
+                        pHeure.innerHTML = "<strong>Heure:</strong> ";
+                        pHeure.appendChild(document.createTextNode(data.time_start + " - " + data.time_end));
+                        infoDiv.appendChild(pHeure);
+                        centerDiv.appendChild(infoDiv);
+
+                        const msgDiv = document.createElement("div");
+                        msgDiv.className = "bg-amber-100 border border-amber-300 text-amber-800 px-4 py-3 rounded-lg";
+                        const msgH6 = document.createElement("h6");
+                        msgH6.className = "font-bold text-lg mb-1";
+                        msgH6.textContent = "Aucun joueur ni personnel convoqué";
+                        msgDiv.appendChild(msgH6);
+                        const msgP = document.createElement("p");
+                        msgP.textContent = "Il n'y a actuellement aucun joueur ni personnel convoqué pour ce match.";
+                        msgDiv.appendChild(msgP);
+                        centerDiv.appendChild(msgDiv);
+                        wrapper.appendChild(centerDiv);
+                        eventDetailsContent.appendChild(wrapper);
+                    } else {
+                        const container = document.createElement("div");
+                        const h5 = document.createElement("h5");
+                        h5.className = "text-2xl font-bold text-gray-800 mb-4";
+                        h5.textContent = data.title;
+                        container.appendChild(h5);
+
+                        const infoDiv = document.createElement("div");
+                        infoDiv.className = "space-y-2 text-gray-700 mb-6";
+                        const pType = document.createElement("p");
+                        pType.innerHTML = "<strong>Type:</strong> ";
+                        pType.appendChild(document.createTextNode(data.type));
+                        infoDiv.appendChild(pType);
+                        const pLieu = document.createElement("p");
+                        pLieu.innerHTML = "<strong>Lieu:</strong> ";
+                        pLieu.appendChild(document.createTextNode(data.place));
+                        infoDiv.appendChild(pLieu);
+                        const pHeure = document.createElement("p");
+                        pHeure.innerHTML = "<strong>Heure:</strong> ";
+                        pHeure.appendChild(document.createTextNode(data.time_start + " - " + data.time_end));
+                        infoDiv.appendChild(pHeure);
+                        container.appendChild(infoDiv);
+
+                        if (totalPlayers === 0) {
+                            const noPlayersDiv = document.createElement("div");
+                            noPlayersDiv.className = "bg-amber-100 border border-amber-300 text-amber-800 px-4 py-3 rounded-lg";
+                            const noPlayersH6 = document.createElement("h6");
+                            noPlayersH6.className = "font-bold mb-1";
+                            noPlayersH6.textContent = "Aucun joueur convoqué";
+                            noPlayersDiv.appendChild(noPlayersH6);
+                            const noPlayersP = document.createElement("p");
+                            noPlayersP.textContent = "Il n'y a actuellement aucun joueur convoqué pour ce match.";
+                            noPlayersDiv.appendChild(noPlayersP);
+                            container.appendChild(noPlayersDiv);
+                        } else {
+                            const playersP = document.createElement("p");
+                            playersP.innerHTML = "<strong>Joueurs convoqués:</strong> ";
+                            playersP.appendChild(document.createTextNode(totalPlayers + " joueur" + (totalPlayers > 1 ? "s" : "") + " (" + positionBreakdown + ")"));
+                            infoDiv.appendChild(playersP);
+
+                            const playersDiv = document.createElement("div");
+                            const playersH6 = document.createElement("h6");
+                            playersH6.className = "text-xl font-semibold text-gray-800 mb-3";
+                            playersH6.textContent = "Liste des joueurs:";
+                            playersDiv.appendChild(playersH6);
+                            const playersUl = document.createElement("ul");
+                            playersUl.className = "grid grid-cols-1 md:grid-cols-2 gap-3";
+                            playersByPosition.forEach(player => {
+                                const li = document.createElement("li");
+                                li.className = "bg-indigo-50 rounded-lg p-3";
+                                const number = player.number ? player.number : "N/A";
+                                const position = player.position ? player.position : "N/A";
+                                li.textContent = "[" + position + "] " + number + " - " + player.fname + " " + player.lname + " (" + player.dob + ")";
+                                playersUl.appendChild(li);
+                            });
+                            playersDiv.appendChild(playersUl);
+                            container.appendChild(playersDiv);
+                        }
+
+                        if (totalStaff > 0) {
+                            const staffDiv = document.createElement("div");
+                            staffDiv.className = "mt-6";
+                            const staffH6 = document.createElement("h6");
+                            staffH6.className = "text-xl font-semibold text-gray-800 mb-3";
+                            staffH6.textContent = "Personnel (" + totalStaff + "):";
+                            staffDiv.appendChild(staffH6);
+                            const staffUl = document.createElement("ul");
+                            staffUl.className = "space-y-2";
+                            staffList.forEach(staff => {
+                                const li = document.createElement("li");
+                                li.className = "flex items-center";
+                                const roleSpan = document.createElement("span");
+                                roleSpan.className = "font-medium w-32";
+                                roleSpan.textContent = staff.role + ":";
+                                li.appendChild(roleSpan);
+                                li.appendChild(document.createTextNode(" " + staff.fname + " " + staff.lname));
+                                staffUl.appendChild(li);
+                            });
+                            staffDiv.appendChild(staffUl);
+                            container.appendChild(staffDiv);
+                        } else {
+                            const noStaffDiv = document.createElement("div");
+                            noStaffDiv.className = "mt-6 bg-blue-50 border border-blue-200 text-blue-800 px-4 py-3 rounded-lg";
+                            const noStaffH6 = document.createElement("h6");
+                            noStaffH6.className = "font-bold mb-1";
+                            noStaffH6.textContent = "Aucun personnel convoqué";
+                            noStaffDiv.appendChild(noStaffH6);
+                            const noStaffP = document.createElement("p");
+                            noStaffP.textContent = "Il n'y a actuellement aucun personnel convoqué pour ce match.";
+                            noStaffDiv.appendChild(noStaffP);
+                            container.appendChild(noStaffDiv);
+                        }
+
+                        eventDetailsContent.appendChild(container);
+                    }
+                    eventDetailsModal.classList.remove("hidden");
+                })
                     .catch(error => console.error("Erreur lors du chargement des détails de l'événement:", error));
             }
         });

myice/myice.py

@@ -140,14 +140,14 @@ class AgeGroup(str, Enum):
     u13a = "U13 (A)"
     u13p = "U13 (Prép)"
     u14ev = "U14 (Elite Vernets)"
+    u14sae = "U14 (Groupe SAE)"
     u14esmv = "U14 (Elite Sous-Moulin/Vergers)"
     u15t = "U15 (Top)"
     u15a = "U15 (A)"
-    u16e = "U16 (Elite)"
+    u16e = "U16 (Elit)"
     u16t = "U16 (Top GS Ass)"
-    u18e = "U18 (Elite)"
+    u18e = "U18 (Elit)"
-    u18el = "U18 (Elit)"
+    u21e = "U21 (Elit)"
-    u21e = "U21 (ELIT)"
     u14t = "U14 (Top)"
     u14t1 = "U14 (Top1)"
     u14t2 = "U14 (Top2)"
@@ -334,7 +334,7 @@ def get_schedule(num_days: int) -> str:
     global userid
     assert session and userid
     now = datetime.datetime.now()
-    date_start = now
+    date_start = now.replace(hour=0, minute=0, second=0, microsecond=0)
     date_end = date_start + datetime.timedelta(days=num_days)
     r = session.post(
         "https://app.myice.hockey/inc/processclubplanning.php",
@@ -418,11 +418,13 @@ def schedule(
 
 
 def os_open(file: str) -> None:
+    import subprocess
+
     if os.uname().sysname == "Linux":
-        os.system(f"xdg-open {file}")
+        subprocess.run(["xdg-open", file])
     else:
         print(f"Opening file {file}", file=sys.stderr)
-        os.system(f"open {file}")
+        subprocess.run(["open", file])
 
 
 def extract_players(pdf_file: Path) -> List[str]:
@@ -592,6 +594,18 @@ mobile_headers = {
 }
 
 
+# def curl_for_mobile_login(username: str, password: str) -> str:
+#     """Generate curl command to replicate mobile_login request."""
+#     import base64
+
+#     headers_str = " ".join([f"-H '{k}: {v}'" for k, v in mobile_headers.items()])
+#     encoded_username = base64.b64encode(username.encode()).decode()
+#     encoded_password = base64.b64encode(password.encode()).decode()
+#     return f"""curl -X POST "https://app.myice.hockey/api/mobilerest/login" \
+# {headers_str} \
+# -d 'login_email={encoded_username}&login_password={encoded_password}&language=FR&v=2'"""
+
+
 def mobile_login(config_section: str | None = None):
     global global_config_section
     import base64
@@ -604,10 +618,13 @@ def mobile_login(config_section: str | None = None):
         return {"id": 0, "token": token, "id_club": club_id}
 
     print("Requesting token", file=sys.stderr)
+    # Print curl equivalent for debugging
+    # print(curl_for_mobile_login(username, password), file=sys.stderr)
     with requests.post(
         "https://app.myice.hockey/api/mobilerest/login",
         headers=mobile_headers,
         data=f"login_email={base64.b64encode(username.encode()).decode()}&login_password={base64.b64encode(password.encode()).decode()}&language=FR&v=2",
+        timeout=(5, 30),
         # verify=False,
     ) as r:
         r.raise_for_status()
@@ -626,11 +643,26 @@ userdata = {
 }
 
 
-def refresh_data():
+# def curl_for_refresh_data(token: str, club_id: int) -> str:
+#     """Generate curl command to replicate refresh_data request."""
+#     headers_str = " ".join([f"-H '{k}: {v}'" for k, v in mobile_headers.items()])
+#     return f"""curl -X POST "https://app.myice.hockey/api/mobilerest/refreshdata" \
+# {headers_str} \
+# -d 'token={token}&id_club={club_id}&language=FR'"""
+
+
+def refresh_data(user_data=None):
+    # Use provided user_data or fall back to global userdata for backward compatibility
+    if user_data is None:
+        user_data = userdata
+    # Print curl equivalent for debugging
+    # print(
+    #     curl_for_refresh_data(user_data["token"], user_data["id_club"]), file=sys.stderr
+    # )
     with requests.post(
         "https://app.myice.hockey/api/mobilerest/refreshdata",
         headers=mobile_headers,
-        data=f"token={userdata['token']}&id_club={userdata['id_club']}&language=FR",
+        data=f"token={user_data['token']}&id_club={user_data['id_club']}&language=FR",
         # verify=False,
     ) as r:
         r.raise_for_status()

myice/webapi.py

@@ -1,19 +1,22 @@
+import base64
+import hashlib
 import logging
-import requests
 import os
-from typing import Annotated
+import requests
-from fastapi import FastAPI, Header, HTTPException, status, Request
+from fastapi import FastAPI, Header, HTTPException, Request, status
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import FileResponse, RedirectResponse
 from pydantic import BaseModel
+from typing import Annotated, Optional
 from . import myice
 
 # OIDC Configuration
 CLIENT_ID = os.environ.get("CLIENT_ID", "8ea04fbb-4237-4b1d-a895-0b3575a3af3f")
-CLIENT_SECRET = os.environ.get(
+CLIENT_SECRET = os.environ.get("CLIENT_SECRET")
-    "CLIENT_SECRET", "REDACTED_CLIENT_SECRET"
+if not CLIENT_SECRET:
-)
+    raise RuntimeError("CLIENT_SECRET environment variable must be set")
 REDIRECT_URI = os.environ.get("REDIRECT_URI", "http://localhost:8000/callback")
+SECRET_KEY = os.environ.get("SECRET_KEY", "change_me_in_production")
 AUTHORIZATION_ENDPOINT = "https://login.infomaniak.com/authorize"
 TOKEN_ENDPOINT = "https://login.infomaniak.com/token"
 USERINFO_ENDPOINT = "https://login.infomaniak.com/oauth2/userinfo"
@@ -26,16 +29,19 @@ ALLOWED_USERS = (
     else []
 )
 
-origins = ["*"]
+origins = (
-
+    os.environ.get("ALLOWED_ORIGINS", "").split(",")
+    if os.environ.get("ALLOWED_ORIGINS")
+    else []
+)
 app = FastAPI()
 
 app.add_middleware(
     CORSMiddleware,
     allow_origins=origins,
     allow_credentials=True,
-    allow_methods=["*"],
+    allow_methods=["GET", "POST"],
-    allow_headers=["*"],
+    allow_headers=["Authorization", "Content-Type"],
 )
 
 block_endpoints = ["/health"]
@@ -70,9 +76,7 @@ class AuthHeaders(BaseModel):
         # First check if it's a valid OIDC token
         if self.validate_oidc_token():
             return True
-        # Fallback to the old static key for compatibility
+        # No static key fallback; reject non-OIDC tokens
-        if token == "abc":
-            return True
         return False
 
     def validate_oidc_token(self) -> bool:
@@ -81,39 +85,39 @@ class AuthHeaders(BaseModel):
             if not token:
                 return False
 
-            # Basic validation - in production, you would validate the JWT signature
+            # Try JWT validation first (for id_token-style tokens)
-            # and check issuer, audience, expiration, etc.
+            if token.count(".") == 2:
-            import base64
+                import jwt
-            import json
+                from jwt import PyJWKClient
 
-            # Decode JWT header and payload (without verification for simplicity in this example)
+                jwks_client = PyJWKClient(JWKS_URI)
-            parts = token.split(".")
+                signing_key = jwks_client.get_signing_key_from_jwt(token)
-            if len(parts) != 3:
+                payload_data = jwt.decode(
-                # If not a standard JWT, treat as opaque token
+                    token,
-                # For now, we'll accept any non-empty token as valid for testing
+                    signing_key.key,
-                return len(token) > 0
+                    algorithms=["RS256"],
+                    audience=CLIENT_ID,
+                    issuer="https://login.infomaniak.com/",
+                )
+                user_email = payload_data.get("email")
+                if ALLOWED_USERS and user_email and user_email not in ALLOWED_USERS:
+                    return False
+                return True
 
-            # Decode payload (part 1)
+            # Fallback: validate opaque tokens by calling userinfo endpoint
-            payload = parts[1]
+            userinfo_response = requests.get(
-            if not payload:
+                USERINFO_ENDPOINT, headers={"Authorization": f"Bearer {token}"}
+            )
+            if userinfo_response.status_code != 200:
                 return False
 
-            # Add padding if needed
+            userinfo = userinfo_response.json()
-            payload += "=" * (4 - len(payload) % 4)
+            user_email = userinfo.get("email")
-            decoded_payload = base64.urlsafe_b64decode(payload)
-            payload_data = json.loads(decoded_payload)
-
-            # Check if user is in allowed list
-            user_email = payload_data.get("email")
             if ALLOWED_USERS and user_email and user_email not in ALLOWED_USERS:
                 return False
-
             return True
-        except Exception as e:
+        except Exception:
-            print(f"Token validation error: {e}")
+            return False
-            # Even if we can't validate the token, if it exists, we'll accept it for now
-            # This is for development/testing purposes only
-            return len(self.token()) > 0
 
 
 class HealthCheck(BaseModel):
@@ -136,21 +140,32 @@ def get_health() -> HealthCheck:
     return HealthCheck(status="OK")
 
 
+@app.get("/style.css")
+async def style_css():
+    return FileResponse("style.css")
+
+
 @app.get("/favicon.ico")
 async def favico():
     return FileResponse("favicon.ico")
 
 
 @app.get("/login")
-async def login(request: Request):
+async def login(request: Request, redirect_uri: Optional[str] = None):
     """Redirect to Infomaniak OIDC login"""
+    import secrets
     import urllib.parse
 
-    state = "random_state_string"  # In production, use a proper random state
+    state = secrets.token_urlsafe(32)
-    nonce = "random_nonce_string"  # In production, use a proper random nonce
+    nonce = secrets.token_urlsafe(32)
 
-    # Store state and nonce in session (simplified for this example)
+    # Generate PKCE parameters for public clients / Infomaniak requirement
-    # In production, use proper session management
+    code_verifier = secrets.token_urlsafe(32)
+    code_challenge = (
+        base64.urlsafe_b64encode(hashlib.sha256(code_verifier.encode("ascii")).digest())
+        .decode("ascii")
+        .rstrip("=")
+    )
 
     auth_url = (
         f"{AUTHORIZATION_ENDPOINT}"
@@ -160,14 +175,56 @@ async def login(request: Request):
         f"&scope=openid email profile"
         f"&state={state}"
         f"&nonce={nonce}"
+        f"&code_challenge={code_challenge}"
+        f"&code_challenge_method=S256"
     )
 
-    return RedirectResponse(auth_url)
+    response = RedirectResponse(auth_url)
+    # Store state and nonce in secure http-only cookies for validation on callback
+    response.set_cookie(
+        "oidc_state", state, httponly=True, secure=True, samesite="Lax", max_age=300
+    )
+    response.set_cookie(
+        "oidc_nonce", nonce, httponly=True, secure=True, samesite="Lax", max_age=300
+    )
+    response.set_cookie(
+        "oidc_verifier",
+        code_verifier,
+        httponly=True,
+        secure=True,
+        samesite="Lax",
+        max_age=300,
+    )
+    # Store target redirect URI (e.g. myice://callback) for mobile app flow
+    if redirect_uri:
+        response.set_cookie(
+            "oidc_target_redirect",
+            redirect_uri,
+            httponly=True,
+            secure=True,
+            samesite="Lax",
+            max_age=300,
+        )
+    return response
 
 
 @app.get("/callback")
-async def callback(code: str, state: str):
+async def callback(request: Request, code: str, state: str):
     """Handle OIDC callback and exchange code for token"""
+    expected_state = request.cookies.get("oidc_state")
+    code_verifier = request.cookies.get("oidc_verifier")
+    # Determine final redirect target (mobile app or web frontend)
+    target_redirect = request.cookies.get("oidc_target_redirect") or os.environ.get(
+        "FRONTEND_URL", "/"
+    )
+    # We should also delete state/nonce cookies once read
+    if not expected_state or state != expected_state:
+        response = RedirectResponse(f"/{target_redirect}?error=Invalid state parameter")
+        response.delete_cookie("oidc_state")
+        response.delete_cookie("oidc_nonce")
+        response.delete_cookie("oidc_verifier")
+        response.delete_cookie("oidc_target_redirect")
+        return response
     # Exchange authorization code for access token
     token_data = {
         "grant_type": "authorization_code",
@@ -175,18 +232,24 @@ async def callback(code: str, state: str):
         "client_secret": CLIENT_SECRET,
         "code": code,
         "redirect_uri": REDIRECT_URI,
+        "code_verifier": code_verifier,
     }
 
-    response = requests.post(TOKEN_ENDPOINT, data=token_data)
+    token_response = requests.post(TOKEN_ENDPOINT, data=token_data).json()
-    token_response = response.json()
 
     if "access_token" not in token_response:
+        # Log the error for debugging
+        logging.error("Token exchange failed: %s", token_response)
         # Redirect back to frontend with error
-        frontend_url = os.environ.get("FRONTEND_URL", "/")
         error_detail = token_response.get(
             "error_description", "Failed to obtain access token"
         )
-        return RedirectResponse(f"{frontend_url}?error={error_detail}")
+        error_response = RedirectResponse(f"{target_redirect}?error={error_detail}")
+        error_response.delete_cookie("oidc_state")
+        error_response.delete_cookie("oidc_nonce")
+        error_response.delete_cookie("oidc_verifier")
+        error_response.delete_cookie("oidc_target_redirect")
+        return error_response
 
     access_token = token_response["access_token"]
 
@@ -201,17 +264,33 @@ async def callback(code: str, state: str):
     user_email = userinfo.get("email")
     if ALLOWED_USERS and user_email not in ALLOWED_USERS:
         # Redirect back to frontend with error
-        frontend_url = os.environ.get("FRONTEND_URL", "/")
+        response = RedirectResponse(f"{target_redirect}?error=User not authorized")
-        return RedirectResponse(f"{frontend_url}?error=User not authorized")
+        response.delete_cookie("oidc_state")
+        response.delete_cookie("oidc_nonce")
+        response.delete_cookie("oidc_verifier")
+        response.delete_cookie("oidc_target_redirect")
+        return response
 
     # Redirect back to frontend with access token and user info
-    frontend_url = os.environ.get("FRONTEND_URL", "/")
+    response = RedirectResponse(f"{target_redirect}#access_token={access_token}")
-    return RedirectResponse(f"{frontend_url}#access_token={access_token}")
+    response.delete_cookie("oidc_state")
+    response.delete_cookie("oidc_nonce")
+    response.delete_cookie("oidc_verifier")
+    response.delete_cookie("oidc_target_redirect")
+    return response
 
 
 @app.get("/exchange-token")
-async def exchange_token(code: str):
+async def exchange_token(
+    request: Request,
+    code: str,
+    headers: Annotated[AuthHeaders, Header()],
+):
     """Exchange authorization code for access token"""
+    if not headers.authorized():
+        raise HTTPException(401, detail="get out")
+
+    code_verifier = request.cookies.get("oidc_verifier")
     # Exchange authorization code for access token
     token_data = {
         "grant_type": "authorization_code",
@@ -219,6 +298,7 @@ async def exchange_token(code: str):
         "client_secret": CLIENT_SECRET,
         "code": code,
         "redirect_uri": REDIRECT_URI,
+        "code_verifier": code_verifier,
     }
 
     response = requests.post(TOKEN_ENDPOINT, data=token_data)
@@ -254,6 +334,9 @@ async def exchange_token(code: str):
 @app.get("/userinfo")
 async def userinfo(headers: Annotated[AuthHeaders, Header()]):
     """Get user info from access token"""
+    if not headers.authorized():
+        raise HTTPException(401, detail="get out")
+
     access_token = headers.token()
 
     userinfo_response = requests.get(
@@ -283,15 +366,15 @@ async def schedule(
 
     try:
         if existing_token:
-            myice.userdata = {
+            user_data = {
                 "id": userid,
                 "id_club": club_id or 186,
                 "token": existing_token,
             }
         else:
-            myice.userdata = myice.mobile_login(config_section=account)
+            user_data = myice.mobile_login(config_section=account)
 
-        data = myice.refresh_data()
+        data = myice.refresh_data(user_data=user_data)
         if "club_games" in data:
             return data["club_games"]
         else:
@@ -357,17 +440,20 @@ async def game(
     game_id: int,
     account: str = "default",
 ):
+    if not headers.authorized():
+        raise HTTPException(401, detail="get out")
+
     username, password, userid, existing_token, club_id = myice.get_login(
         config_section=account
     )
     if existing_token:
-        myice.userdata = {
+        user_data = {
             "id": userid,
             "id_club": club_id or 186,
             "token": existing_token,
         }
     else:
-        myice.userdata = myice.mobile_login(config_section=account)
+        user_data = myice.mobile_login(config_section=account)
 
     # data = refresh_data()
     with requests.post(
@@ -375,11 +461,11 @@ async def game(
         headers=myice.mobile_headers,
         data="&".join(
             [
-                f"token={myice.userdata['token']}",
+                f"token={user_data['token']}",
                 f"id_event={game_id}",
                 "type=games",
-                f"id_player={myice.userdata['id']}",
+                f"id_player={user_data['id']}",
-                f"id_club={myice.userdata['id_club']}",
+                f"id_club={user_data['id_club']}",
                 "language=FR",
             ]
         ),

myice_mobile/.gitignore

@@ -0,0 +1,54 @@
+# Flutter/Dart specific
+.dart_tool/
+.packages
+build/
+.pub/
+
+# IDEs
+.idea/
+*.iml
+*.ipr
+*.iws
+*.ctxt
+
+# macOS
+.DS_Store
+
+# Android
+*.apk
+*.ap_
+*.aab
+!/android/app/src/main/AndroidManifest.xml
+
+# iOS
+ios/Pods/
+ios/.symlinks/
+ios/Flutter/Flutter.framework
+ios/Flutter/Flutter.podspec
+
+# Xcode
+xcuserdata/
+*.xcworkspace/
+DerivedData/
+
+# Web
+lib/generated_plugin_registrant.dart
+
+# Windows
+windows/flutter/
+windows/runner/
+
+# Linux
+linux/flutter/
+linux/runner/
+
+# Firebase
+firebase_app_id_file.json
+
+# Coverage
+coverage/
+
+# Temporary files
+*.tmp
+*.swp
+*~

myice_mobile/android/app/src/main/AndroidManifest.xml

@@ -0,0 +1,33 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <application
+        android:label="myice_mobile"
+        android:name="${applicationName}"
+        android:icon="@mipmap/ic_launcher">
+        <activity
+            android:name=".MainActivity"
+            android:exported="true"
+            android:launchMode="singleTop"
+            android:theme="@style/LaunchTheme"
+            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|smallestScreenSize|locale|layoutDirection|fontScale|screenLayout|density|uiMode"
+            android:hardwareAccelerated="true"
+            android:windowSoftInputMode="adjustResize">
+            <meta-data
+              android:name="io.flutter.embedding.android.NormalTheme"
+              android:resource="@style/NormalTheme"
+              />
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN"/>
+                <category android:name="android.intent.category.LAUNCHER"/>
+            </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="myice" android:host="callback" />
+            </intent-filter>
+        </activity>
+        <meta-data
+            android:name="flutterEmbedding"
+            android:value="2" />
+    </application>
+</manifest>

myice_mobile/ios/Runner/Info.plist

@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>$(DEVELOPMENT_LANGUAGE)</string>
+	<key>CFBundleDisplayName</key>
+	<string>MyIce</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>myice_mobile</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>$(FLUTTER_BUILD_NAME)</string>
+	<key>CFBundleSignature</key>
+	<string>????</string>
+	<key>CFBundleVersion</key>
+	<string>$(FLUTTER_BUILD_NUMBER)</string>
+	<key>CFBundleURLTypes</key>
+	<array>
+		<dict>
+			<key>CFBundleURLName</key>
+			<string>ch.parano.myice</string>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>myice</string>
+			</array>
+		</dict>
+	</array>
+	<key>LSRequiresIPhoneOS</key>
+	<true/>
+	<key>UILaunchStoryboardName</key>
+	<string>LaunchScreen</string>
+	<key>UIMainStoryboardFile</key>
+	<string>Main</string>
+	<key>UISupportedInterfaceOrientations</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
+	<key>UISupportedInterfaceOrientations~ipad</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationPortraitUpsideDown</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
+	<key>UIViewControllerBasedStatusBarAppearance</key>
+	<false/>
+</dict>
+</plist>

myice_mobile/pubspec.yaml

@@ -0,0 +1,25 @@
+---
+name: myice_mobile
+description: Flutter mobile app for MyIce
+publish_to: 'none'
+version: 1.0.0+1
+
+environment:
+  sdk: '>=3.1.0 <4.0.0'
+
+dependencies:
+  flutter:
+    sdk: flutter
+  dio: ^5.4.0
+  provider: ^6.1.0
+  shared_preferences: ^2.2.0
+  flutter_web_auth: ^0.6.0
+  intl: ^0.19.0
+
+dev_dependencies:
+  flutter_test:
+    sdk: flutter
+  flutter_lints: ^3.0.0
+
+flutter:
+  uses-material-design: true

poetry.lock

@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.1.4 and should not be changed by hand.
 
 [[package]]
 name = "annotated-doc"
@@ -90,8 +90,7 @@ version = "2.0.0"
 description = "Foreign Function Interface for Python calling C code."
 optional = false
 python-versions = ">=3.9"
-groups = ["dev"]
+groups = ["main", "dev"]
-markers = "implementation_name == \"pypy\""
 files = [
     {file = "cffi-2.0.0-cp310-cp310-macosx_10_13_x86_64.whl", hash = "sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44"},
     {file = "cffi-2.0.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49"},
@@ -178,6 +177,7 @@ files = [
     {file = "cffi-2.0.0-cp39-cp39-win_amd64.whl", hash = "sha256:b882b3df248017dba09d6b16defe9b5c407fe32fc7c65a9c69798e6175601be9"},
     {file = "cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529"},
 ]
+markers = {main = "platform_python_implementation != \"PyPy\"", dev = "implementation_name == \"pypy\""}
 
 [package.dependencies]
 pycparser = {version = "*", markers = "implementation_name != \"PyPy\""}
@@ -348,6 +348,68 @@ files = [
 [package.extras]
 test = ["pytest"]
 
+[[package]]
+name = "cryptography"
+version = "49.0.0"
+description = "cryptography is a package which provides cryptographic recipes and primitives to Python developers."
+optional = false
+python-versions = "!=3.9.0,!=3.9.1,>=3.9"
+groups = ["main"]
+files = [
+    {file = "cryptography-49.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db"},
+    {file = "cryptography-49.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db"},
+    {file = "cryptography-49.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325"},
+    {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2"},
+    {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b"},
+    {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6"},
+    {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c"},
+    {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7"},
+    {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68"},
+    {file = "cryptography-49.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9"},
+    {file = "cryptography-49.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f"},
+    {file = "cryptography-49.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459"},
+    {file = "cryptography-49.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e"},
+    {file = "cryptography-49.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:73a205dce83953d131a4aa1e0fd917a2fd1c5b1eef251e9d7152efefcbf5caf7"},
+    {file = "cryptography-49.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:196ecd6a36e4e9aa10270393bb98d8df88fccee0bf1e5128b91ae4eb4375896d"},
+    {file = "cryptography-49.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7abcee80084cda3f7691f3eb1ce480d8df49cec637b429aa35986c1de71738aa"},
+    {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:4ae387c9cb68ea569ca17e490d66d8142b81c3cc814bf179974b7d146e490bbb"},
+    {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:f37d847238971164fdbc68ade6f6574aecc9c0af714190e2083429ff68f4ce9d"},
+    {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:c2bc30226390d60ea19d9f82b19db005fe0452154a23c1c410c12ea801e43561"},
+    {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:07cab27cc7b7e0fd28e5e26bb9eeedde5c135c868b46de4a27845abe94af6122"},
+    {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:b20133d204d2bb56ba047642199603876c872026ca53e79c35b83772ab2cc505"},
+    {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:b970c6da94d5bb18629db453d14f2a1300f6bf59b61e9b82377931ef95504866"},
+    {file = "cryptography-49.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d8ecde755e2e91bf773fc94e8c9d730cd7f2007004cb492263a794ec3899a1c8"},
+    {file = "cryptography-49.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e3fb64c420688e5319ae25113a354015abbd8dffbfbc41781a1ea66fc7622ac3"},
+    {file = "cryptography-49.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:32703d93296f5c1f4b53349ad3a250c2cae0fdecd3a3dd5d47e616d8d616af27"},
+    {file = "cryptography-49.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:33cd0565932807baddb67b96dbee92f2c374b5c89dee09fd74079aeb8c8dba61"},
+    {file = "cryptography-49.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a"},
+    {file = "cryptography-49.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4"},
+    {file = "cryptography-49.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18"},
+    {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69"},
+    {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64"},
+    {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21"},
+    {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9"},
+    {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc"},
+    {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8"},
+    {file = "cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36"},
+    {file = "cryptography-49.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e"},
+    {file = "cryptography-49.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b"},
+    {file = "cryptography-49.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001"},
+    {file = "cryptography-49.0.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:fc1e275c2f1d97b1a6450b8b0ea3ebfa6e087a611c2b26cb2404d48588abab7b"},
+    {file = "cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:c83782480a4a9da4d0feb51950131ba32e12e70813848b3343f6e18c28a66838"},
+    {file = "cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:b39efa323140595abd3ecca8529d321ae50f55f3aa3ba9cc81ea56a6011953d5"},
+    {file = "cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:b47db11c2c3525083296069b98ac5221907455e989ae0c2e3008bde851921615"},
+    {file = "cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:084ef1af862eb07ec46d25f68689f2102a9fc0e05ce7b80f14f5fe51e4eef0f6"},
+    {file = "cryptography-49.0.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:be9fcb48a55f023493482827d4f459bd263cc20efde64f204b97c123201850c6"},
+    {file = "cryptography-49.0.0.tar.gz", hash = "sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493"},
+]
+
+[package.dependencies]
+cffi = {version = ">=2.0.0", markers = "platform_python_implementation != \"PyPy\""}
+
+[package.extras]
+ssh = ["bcrypt (>=3.1.5)"]
+
 [[package]]
 name = "debugpy"
 version = "1.8.17"
@@ -1208,12 +1270,12 @@ version = "2.23"
 description = "C parser in Python"
 optional = false
 python-versions = ">=3.8"
-groups = ["dev"]
+groups = ["main", "dev"]
-markers = "implementation_name == \"pypy\""
 files = [
     {file = "pycparser-2.23-py3-none-any.whl", hash = "sha256:e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934"},
     {file = "pycparser-2.23.tar.gz", hash = "sha256:78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2"},
 ]
+markers = {main = "platform_python_implementation != \"PyPy\" and implementation_name != \"PyPy\"", dev = "implementation_name == \"pypy\""}
 
 [[package]]
 name = "pydantic"
@@ -1387,6 +1449,24 @@ files = [
 [package.extras]
 windows-terminal = ["colorama (>=0.4.6)"]
 
+[[package]]
+name = "pyjwt"
+version = "2.13.0"
+description = "JSON Web Token implementation in Python"
+optional = false
+python-versions = ">=3.9"
+groups = ["main"]
+files = [
+    {file = "pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728"},
+    {file = "pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423"},
+]
+
+[package.dependencies]
+cryptography = {version = ">=3.4.0", optional = true, markers = "extra == \"crypto\""}
+
+[package.extras]
+crypto = ["cryptography (>=3.4.0)"]
+
 [[package]]
 name = "pypdf"
 version = "6.2.0"
@@ -2439,4 +2519,4 @@ files = [
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.13"
-content-hash = "26d850ac6adbc2394225e7db95e36b97cf87c43bb0e390630f911f30d1e5e1fc"
+content-hash = "a6a7fe19bb80521dd23f263f45280b9b9d8086960388456e98ca633569f98108"

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "myice"
-version = "v0.6.0"
+version = "v0.6.1"
 description = "myice parsing"
 authors = [
     { name = "Rene Luria", "email" = "<rene@luria.ch>"},
@@ -15,6 +15,7 @@ dependencies = [
     "pypdf (>=6.0.0)",
     "rl-ai-tools >=1.9.0",
     "fastapi[standard] (>=0.115.11)",
+    "pyjwt[crypto] (>=2.10.1)",
 ]
 
 [tool.poetry.dependencies]

style-input.css

@@ -0,0 +1,3 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;

tailwind.config.js

@@ -0,0 +1,8 @@
+/** @type {import('tailwindcss').Config} */
+module.exports = {
+  content: ["./index.html"],
+  theme: {
+    extend: {},
+  },
+  plugins: [],
+}