feat(submissions): base submissions frontend + api

polylan_submitter/submissions/api.py

@@ -0,0 +1,58 @@
+from typing import List, Optional
+from django.http import HttpRequest
+from ninja import Router, File, Form
+from ninja.files import UploadedFile
+from django.shortcuts import get_object_or_404
+
+from games.models import Game
+from .models import Submission, SubmissionFile
+from .schemas import SubmissionOut
+
+router = Router()
+
+
+@router.post("/create", response=SubmissionOut)
+def create_submission(
+    request: HttpRequest,
+    game_path: str,
+    files: List[UploadedFile] = File(...),
+    notes: Optional[str] = Form(None),
+):
+    game = get_object_or_404(Game, path=game_path, enabled=True)
+
+    submission = Submission.objects.create(
+        game=game,
+        user=request.user if request.user.is_authenticated else None,
+        notes=notes or None,
+    )
+
+    for file in files:
+        SubmissionFile.objects.create(
+            submission=submission,
+            file=file,
+            original_filename=file.name,
+            content_type=file.content_type or "application/octet-stream",
+        )
+
+    return submission
+
+
+@router.get("/{submission_id}", response=SubmissionOut)
+def get_submission(request: HttpRequest, submission_id: str):
+    submission = get_object_or_404(Submission, id=submission_id)
+
+    if submission.user != request.user and not request.user.is_staff:
+        return 403, {"detail": "Not authorized"}
+
+    return submission
+
+
+@router.get("/game/{game_path}")
+def list_submissions_by_game(request: HttpRequest, game_path: str):
+    game = get_object_or_404(Game, path=game_path)
+
+    if not request.user.is_staff:
+        return 403, {"detail": "Admin access required"}
+
+    submissions = Submission.objects.filter(game=game)
+    return [SubmissionOut.from_orm(s) for s in submissions]