Fix challenger volunteer (#863)

## Description

### Summary

<!--Brief description of what this PR does.-->

### Related Issues

<!-- If applicable -->
Closes #<!--0-->

## Changes Made

<!--Please describe the changes made in this pull request-->

- fix volunteer shift return schema
- fix competition user payments endpoint access for school BDS

## Type of Change

- [x] 🐛 Bug fix (non-breaking change which fixes an issue)
- [ ] ✨ New feature (non-breaking change which adds functionality)
- [ ] 🔨 Refactor (non-breaking change that neither fixes a bug nor adds
a feature)
- [ ] 🔧 Infra CI/CD (changes to configs of workflows)
- [ ] 💥 BREAKING CHANGE (fix or feature that require a new minimal
version of the front-end)

## Impact & Scope

- [ ] Core functionality changes
- [x] Single module changes
- [ ] Multiple modules changes
- [ ] Database migrations required
- [ ] Other

## Testing

- [x] Added/modified tests that pass the CI
- [ ] Tested in a pre-prod
- [ ] Tested this locally

## Documentation

- [ ] Updated docs accordingly (docs.myecl.fr) : <!--[Docs#0 -
Title](https://github.com/aeecleclair/myecl-documentation/pull/0)-->
- [ ] Code includes docstrings
- [x] No documentation needed

## Checklist

- [x] My code follows the style guidelines of this project
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] Any dependent changes have been merged and published (_Indicate
the linked PR for the dependent changes_)

## Additional Notes

Add any other context, screenshots, or information about the pull
request here.

Author: Rotheem

app/modules/sport_competition/endpoints_sport_competition.py

@@ -3283,9 +3283,28 @@ async def get_payments_by_user_id(
 
     **User must get his own payments or be competition admin to use this endpoint**
     """
+    competition_groups = (
+        await cruds_sport_competition.load_user_competition_groups_memberships(
+            user.id,
+            edition.id,
+            db,
+        )
+    )
+    user_db = await cruds_users.get_user_by_id(db, user_id)
+    if not user_db:
+        raise HTTPException(
+            status_code=404,
+            detail="The user does not exist.",
+        )
+
     if not (
         user_id == user.id
         or is_user_member_of_any_group(user, [GroupType.competition_admin])
+        or (
+            CompetitionGroupType.schools_bds
+            in [competition_group.group for competition_group in competition_groups]
+            and user.school_id == user_db.school_id
+        )
     ):
         raise HTTPException(
             status_code=403,
@@ -3525,7 +3544,7 @@ async def get_payment_url(
 
 @module.router.get(
     "/competition/volunteers/shifts",
-    response_model=list[schemas_sport_competition.VolunteerShift],
+    response_model=list[schemas_sport_competition.VolunteerShiftComplete],
     status_code=200,
 )
 async def get_all_volunteer_shifts(

pyproject.toml

@@ -6,7 +6,7 @@ authors = [{ name = "AEECL ECLAIR" }]
 
 # Hyperion follows Semantic Versioning
 # https://semver.org/
-version = "4.9.5"
+version = "4.9.6"
 minimal-titan-version-code = 139
 requires-python = ">= 3.11, < 3.13"