Fix matches permissions (#880)

## Description

### Summary

<!--Brief description of what this PR does.-->

### Related Issues

<!-- If applicable -->
Closes #<!--0-->

## Changes Made

<!--Please describe the changes made in this pull request-->

- ...

## Type of Change

- [ ] 🐛 Bug fix (non-breaking change which fixes an issue)
- [ ] ✨ New feature (non-breaking change which adds functionality)
- [ ] 🔨 Refactor (non-breaking change that neither fixes a bug nor adds
a feature)
- [ ] 🔧 Infra CI/CD (changes to configs of workflows)
- [ ] 💥 BREAKING CHANGE (fix or feature that require a new minimal
version of the front-end)

## Impact & Scope

- [ ] Core functionality changes
- [ ] Single module changes
- [ ] Multiple modules changes
- [ ] Database migrations required
- [ ] Other

## Testing

- [ ] Added/modified tests that pass the CI
- [ ] Tested in a pre-prod
- [ ] Tested this locally

## Documentation

- [ ] Updated docs accordingly (docs.myecl.fr) : <!--[Docs#0 -
Title](https://github.com/aeecleclair/myecl-documentation/pull/0)-->
- [ ] Code includes docstrings
- [ ] No documentation needed

## Checklist

- [ ] My code follows the style guidelines of this project
- [ ] I have commented my code, particularly in hard-to-understand areas
- [ ] Any dependent changes have been merged and published (_Indicate
the linked PR for the dependent changes_)

## Additional Notes

Add any other context, screenshots, or information about the pull
request here.

Author: Rotheem

app/modules/sport_competition/cruds_sport_competition.py

@@ -1404,6 +1404,20 @@ async def delete_team_by_id(
     await db.flush()
 
 
+async def load_all_teams(
+    edition_id: UUID,
+    db: AsyncSession,
+) -> list[schemas_sport_competition.TeamComplete]:
+    teams = await db.execute(
+        select(models_sport_competition.CompetitionTeam)
+        .where(models_sport_competition.CompetitionTeam.edition_id == edition_id)
+        .options(
+            selectinload(models_sport_competition.CompetitionTeam.participants),
+        ),
+    )
+    return [team_model_to_schema(team) for team in teams.scalars().all()]
+
+
 async def load_team_by_id(
     team_id,
     db: AsyncSession,
@@ -1711,6 +1725,22 @@ async def delete_match_by_id(
     await db.flush()
 
 
+async def load_all_matches_by_edition_id(
+    edition_id: UUID,
+    db: AsyncSession,
+) -> list[schemas_sport_competition.MatchComplete]:
+    matches = await db.execute(
+        select(models_sport_competition.Match)
+        .where(models_sport_competition.Match.edition_id == edition_id)
+        .options(
+            selectinload(models_sport_competition.Match.team1),
+            selectinload(models_sport_competition.Match.team2),
+        ),
+    )
+
+    return [match_model_to_schema(match) for match in matches.scalars().all()]
+
+
 async def load_match_by_id(
     match_id,
     db: AsyncSession,

app/modules/sport_competition/dependencies_sport_competition.py

@@ -7,7 +7,12 @@
 
 from app.core.groups import groups_type
 from app.core.groups.groups_type import GroupType
-from app.dependencies import get_db, get_user_id_from_token_with_scopes
+from app.core.users import models_users
+from app.dependencies import (
+    get_db,
+    get_user_from_token_with_scopes,
+    get_user_id_from_token_with_scopes,
+)
 from app.modules.sport_competition import (
     cruds_sport_competition,
     schemas_sport_competition,
@@ -119,6 +124,65 @@ async def is_user_a_member_of(
     return is_user_a_member_of
 
 
+def has_user_competition_access(
+    group_id: GroupType | None = None,
+    competition_group: CompetitionGroupType | None = None,
+    exclude_external: bool = False,
+) -> Callable[
+    [models_users.CoreUser],
+    Coroutine[Any, Any, models_users.CoreUser],
+]:
+    """
+    Generate a dependency which will:
+        * check if the request header contains a valid API JWT token (a token that can be used to call endpoints from the API)
+        * make sure the user making the request exists and is a member of the group with the given id (if provided)
+        * make sure the user is a member of the competition group with the given id for the current edition (if provided)
+    """
+
+    async def is_user_a_member_of(
+        user: models_users.CoreUser = Depends(
+            get_user_from_token_with_scopes([[ScopeType.API]]),
+        ),
+        edition: schemas_sport_competition.CompetitionEdition = Depends(
+            get_current_edition,
+        ),
+        db: AsyncSession = Depends(get_db),
+    ) -> models_users.CoreUser:
+        """
+        A dependency that checks that user is a member of the group with the given id then returns the corresponding user.
+        """
+        if exclude_external and user.account_type == groups_type.AccountType.external:
+            raise HTTPException(
+                status_code=403,
+                detail="User is external",
+            )
+        if group_id is not None and not any(
+            group.id == group_id for group in user.groups
+        ):
+            raise HTTPException(
+                status_code=403,
+                detail="User is not a member of the group",
+            )
+        if competition_group is not None and not any(
+            group.id == GroupType.competition_admin.value for group in user.groups
+        ):
+            user_groups = (
+                await cruds_sport_competition.load_user_competition_groups_memberships(
+                    db=db,
+                    user_id=user.id,
+                    edition_id=edition.id,
+                )
+            )
+            if not any(group.group == competition_group for group in user_groups):
+                raise HTTPException(
+                    status_code=403,
+                    detail="User is not a member of the competition group",
+                )
+        return user
+
+    return is_user_a_member_of
+
+
 async def get_current_edition(
     db: AsyncSession = Depends(get_db),
 ) -> schemas_sport_competition.CompetitionEdition:

app/modules/sport_competition/endpoints_sport_competition.py

@@ -20,6 +20,7 @@
 )
 from app.modules.sport_competition.dependencies_sport_competition import (
     get_current_edition,
+    has_user_competition_access,
     is_competition_user,
 )
 from app.modules.sport_competition.types_sport_competition import (
@@ -1554,6 +1555,20 @@ async def delete_product_quota(
 # region: Teams
 
 
+@module.router.get(
+    "/competition/teams",
+    response_model=list[schemas_sport_competition.TeamComplete],
+)
+async def get_teams(
+    db: AsyncSession = Depends(get_db),
+    user: models_users.CoreUser = Depends(is_user()),
+    edition: schemas_sport_competition.CompetitionEdition = Depends(
+        get_current_edition,
+    ),
+) -> list[schemas_sport_competition.TeamComplete]:
+    return await cruds_sport_competition.load_all_teams(edition.id, db)
+
+
 @module.router.get(
     "/competition/teams/me",
     response_model=schemas_sport_competition.TeamComplete,
@@ -2543,6 +2558,23 @@ async def delete_location(
 # region: Matches
 
 
+@module.router.get(
+    "/competition/matches",
+    response_model=list[schemas_sport_competition.MatchComplete],
+)
+async def get_all_matches_for_edition(
+    edition: schemas_sport_competition.CompetitionEdition = Depends(
+        get_current_edition,
+    ),
+    db: AsyncSession = Depends(get_db),
+    user: models_users.CoreUser = Depends(is_user()),
+) -> list[schemas_sport_competition.MatchComplete]:
+    return await cruds_sport_competition.load_all_matches_by_edition_id(
+        edition.id,
+        db,
+    )
+
+
 @module.router.get(
     "/competition/matches/sports/{sport_id}",
     response_model=list[schemas_sport_competition.MatchComplete],
@@ -2638,7 +2670,9 @@ async def create_match(
     match_info: schemas_sport_competition.MatchBase,
     db: AsyncSession = Depends(get_db),
     user: schemas_sport_competition.CompetitionUser = Depends(
-        is_competition_user(competition_group=CompetitionGroupType.sport_manager),
+        has_user_competition_access(
+            competition_group=CompetitionGroupType.sport_manager,
+        ),
     ),
     edition: schemas_sport_competition.CompetitionEdition = Depends(
         get_current_edition,
@@ -2699,8 +2733,10 @@ async def edit_match(
     match_id: UUID,
     match_info: schemas_sport_competition.MatchEdit,
     db: AsyncSession = Depends(get_db),
-    user: schemas_sport_competition.CompetitionUser = Depends(
-        is_competition_user(competition_group=CompetitionGroupType.sport_manager),
+    user: models_users.CoreUser = Depends(
+        has_user_competition_access(
+            competition_group=CompetitionGroupType.sport_manager,
+        ),
     ),
     edition: schemas_sport_competition.CompetitionEdition = Depends(
         get_current_edition,
@@ -2736,7 +2772,7 @@ async def delete_match(
     match_id: UUID,
     db: AsyncSession = Depends(get_db),
     user: schemas_users.CoreUser = Depends(
-        is_competition_user(
+        has_user_competition_access(
             competition_group=CompetitionGroupType.sport_manager,
         ),
     ),
@@ -2773,7 +2809,7 @@ async def get_global_podiums(
 
 
 @module.router.get(
-    "/competition/podiums/sport/{sport_id}",
+    "/competition/podiums/sports/{sport_id}",
     response_model=list[schemas_sport_competition.TeamSportResultComplete],
     status_code=200,
 )
@@ -2798,7 +2834,7 @@ async def get_sport_podiums(
 
 
 @module.router.get(
-    "/competition/podiums/school/{school_id}",
+    "/competition/podiums/schools/{school_id}",
     response_model=list[schemas_sport_competition.TeamSportResultComplete],
     status_code=200,
 )
@@ -2823,7 +2859,7 @@ async def get_school_podiums(
 
 
 @module.router.post(
-    "/competition/podiums/sport/{sport_id}",
+    "/competition/podiums/sports/{sport_id}",
     response_model=list[schemas_sport_competition.TeamSportResult],
     status_code=201,
 )
@@ -2832,7 +2868,7 @@ async def create_sport_podium(
     rankings: schemas_sport_competition.SportPodiumRankings,
     db: AsyncSession = Depends(get_db),
     user: models_users.CoreUser = Depends(
-        is_competition_user(
+        has_user_competition_access(
             competition_group=CompetitionGroupType.sport_manager,
         ),
     ),
@@ -2873,14 +2909,14 @@ async def create_sport_podium(
 
 
 @module.router.delete(
-    "/competition/podiums/sport/{sport_id}",
+    "/competition/podiums/sports/{sport_id}",
     status_code=204,
 )
 async def delete_sport_podium(
     sport_id: UUID,
     db: AsyncSession = Depends(get_db),
     user: models_users.CoreUser = Depends(
-        is_competition_user(
+        has_user_competition_access(
             competition_group=CompetitionGroupType.sport_manager,
         ),
     ),

app/modules/sport_competition/models_sport_competition.py

@@ -297,9 +297,12 @@ class SportPodium(Base):
         ForeignKey("competition_school_extension.school_id"),
         primary_key=True,
     )
+    team_id: Mapped[UUID] = mapped_column(
+        ForeignKey("competition_team.id"),
+        primary_key=True,
+    )
     points: Mapped[int]
     rank: Mapped[int]
-    team_id: Mapped[UUID] = mapped_column(ForeignKey("competition_team.id"))
 
     team: Mapped[CompetitionTeam] = relationship(
         "CompetitionTeam",

migrations/versions/43-Update_podium_foreign_key.py

@@ -0,0 +1,59 @@
+"""Update_podium_foreign_key
+
+Create Date: 2025-10-18 11:26:25.491895
+"""
+
+from collections.abc import Sequence
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from pytest_alembic import MigrationContext
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "d1079d6b8e6b"
+down_revision: str | None = "c4812e1ab108"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.drop_constraint(
+        type_="primary",
+        table_name="competition_sport_podium",
+        constraint_name="competition_sport_podium_pkey",
+    )
+    op.create_primary_key(
+        constraint_name="competition_sport_podium_pkey",
+        table_name="competition_sport_podium",
+        columns=["team_id", "sport_id", "edition_id", "school_id"],
+    )
+
+
+def downgrade() -> None:
+    op.drop_constraint(
+        type_="primary",
+        table_name="competition_sport_podium",
+        constraint_name="competition_sport_podium_pkey",
+    )
+    op.create_primary_key(
+        constraint_name="competition_sport_podium_pkey",
+        table_name="competition_sport_podium",
+        columns=["sport_id", "edition_id", "school_id"],
+    )
+
+
+def pre_test_upgrade(
+    alembic_runner: "MigrationContext",
+    alembic_connection: sa.Connection,
+) -> None:
+    pass
+
+
+def test_upgrade(
+    alembic_runner: "MigrationContext",
+    alembic_connection: sa.Connection,
+) -> None:
+    pass

pyproject.toml

@@ -6,7 +6,7 @@ authors = [{ name = "AEECL ECLAIR" }]
 
 # Hyperion follows Semantic Versioning
 # https://semver.org/
-version = "4.9.8"
+version = "4.9.9"
 requires-python = ">= 3.11, < 3.13"
 
 license = "MIT"