feat: add events app + "multi-tenants" aka multi-events

polylan_submitter/submissions/api.py

@@ -12,17 +12,23 @@ from .tasks import process_submission_file, process_crop
 
 router = Router()
 
+PREFIX = "/events/{event_path}/submissions"
 
-@router.post("/submission/create", response=SubmissionOut)
+
+@router.post(f"{PREFIX}/submission/create", response=SubmissionOut)
 def create_submission(
     request: HttpRequest,
+    event_path: str,
     game_path: str,
     files: List[UploadedFile] = File(...),
     notes: Optional[str] = Form(None),
 ):
-    game = get_object_or_404(Game, path=game_path, enabled=True)
+    game = get_object_or_404(
+        Game.objects.enabled_for_event(request.event), path=game_path
+    )
 
     submission = Submission.objects.create(
+        event=request.event,
         game=game,
         user=request.user if request.user.is_authenticated else None,
         notes=notes or None,
@@ -39,32 +45,32 @@ def create_submission(
     return submission
 
 
-@router.get("/submission/by/user", response=list[SubmissionOut])
-def list_user_submissions(request: HttpRequest, game_path: str):
+@router.get(f"{PREFIX}/submission/by/user", response=list[SubmissionOut])
+def list_user_submissions(request: HttpRequest, event_path: str, game_path: str):
     game = get_object_or_404(Game, path=game_path)
 
     if not request.user.is_authenticated:
         return 403, {"detail": "Authentication required"}
 
-    submissions = Submission.objects.filter(game=game, user=request.user).order_by(
+    submissions = Submission.for_event.filter(game=game, user=request.user).order_by(
         "-created_at"
     )
     return submissions
 
 
-@router.get("/submission/by/game", response=list[SubmissionOut])
-def list_submissions_by_game(request: HttpRequest, game_path: str):
+@router.get(f"{PREFIX}/submission/by/game", response=list[SubmissionOut])
+def list_submissions_by_game(request: HttpRequest, event_path: str, game_path: str):
     game = get_object_or_404(Game, path=game_path)
 
     if not request.user.is_staff:
         return 403, {"detail": "Admin access required"}
 
-    return Submission.objects.filter(game=game)
+    return Submission.for_event.filter(game=game)
 
 
-@router.get("/submission/{submission_id}", response=SubmissionOut)
-def get_submission(request: HttpRequest, submission_id: UUID):
-    submission = get_object_or_404(Submission, id=submission_id)
+@router.get(f"{PREFIX}/submission/{{submission_id}}", response=SubmissionOut)
+def get_submission(request: HttpRequest, event_path: str, submission_id: UUID):
+    submission = get_object_or_404(Submission.for_event, id=submission_id)
 
     if submission.user != request.user and not request.user.is_staff:
         return 403, {"detail": "Not authorized"}
@@ -72,16 +78,19 @@ def get_submission(request: HttpRequest, submission_id: UUID):
     return submission
 
 
-@router.post("/crops/s/{submission_file_id}", response=ImageCropOut)
+@router.post(f"{PREFIX}/crops/s/{{submission_file_id}}", response=ImageCropOut)
 def create_image_crop(
     request: HttpRequest,
+    event_path: str,
     submission_file_id: UUID,
     data: ImageCropIn,
 ):
     if not request.user.is_staff:
         return 403, {"detail": "Admin access required"}
 
-    submission_file = get_object_or_404(SubmissionFile, id=submission_file_id)
+    submission_file = get_object_or_404(
+        SubmissionFile, id=submission_file_id, submission__event=request.event
+    )
 
     crop = ImageCrop.objects.create(
         submission_file=submission_file,
@@ -96,23 +105,27 @@ def create_image_crop(
     return crop
 
 
-@router.delete("/crops/{crop_id}", response=dict)
-def delete_image_crop(request: HttpRequest, crop_id: UUID):
+@router.delete(f"{PREFIX}/crops/{{crop_id}}", response=dict)
+def delete_image_crop(request: HttpRequest, event_path: str, crop_id: UUID):
     if not request.user.is_staff:
         return 403, {"detail": "Admin access required"}
 
-    crop = get_object_or_404(ImageCrop, id=crop_id)
+    crop = get_object_or_404(
+        ImageCrop, id=crop_id, submission_file__submission__event=request.event
+    )
     crop.delete()
 
     return {"status": "deleted"}
 
 
-@router.post("/files/{file_id}/process-ocr", response=dict)
-def process_file_ocr(request: HttpRequest, file_id: UUID):
+@router.post(f"{PREFIX}/files/{{file_id}}/process-ocr", response=dict)
+def process_file_ocr(request: HttpRequest, event_path: str, file_id: UUID):
     if not request.user.is_staff:
         return 403, {"detail": "Admin access required"}
 
-    submission_file = get_object_or_404(SubmissionFile, id=file_id)
+    submission_file = get_object_or_404(
+        SubmissionFile, id=file_id, submission__event=request.event
+    )
     submission_file.ocr_status = OCRStatus.TO_PROCESS
     submission_file.save()
 
@@ -122,12 +135,14 @@ def process_file_ocr(request: HttpRequest, file_id: UUID):
     return {"status": "queued"}
 
 
-@router.post("/crops/{crop_id}/process-ocr", response=dict)
-def process_crop_ocr(request: HttpRequest, crop_id: UUID):
+@router.post(f"{PREFIX}/crops/{{crop_id}}/process-ocr", response=dict)
+def process_crop_ocr(request: HttpRequest, event_path: str, crop_id: UUID):
     if not request.user.is_staff:
         return 403, {"detail": "Admin access required"}
 
-    crop = get_object_or_404(ImageCrop, id=crop_id)
+    crop = get_object_or_404(
+        ImageCrop, id=crop_id, submission_file__submission__event=request.event
+    )
     crop.ocr_status = OCRStatus.TO_PROCESS
     crop.save()