feat(submissions): show all submissions for admin

polylan_submitter/submissions/tests.py

@@ -11,7 +11,7 @@ from events.models import Event
 from games.models import EventGame, Game
 
 from . import tasks
-from .models import Scope
+from .models import Scope, Submission
 from .services.aandt_client.models import (
     AandtApiInfosResponse200,
     AandtApiMatchesResponse200,
@@ -388,3 +388,49 @@ class SubmissionHomeViewTests(TestCase):
         response = self.client.get("/nope/submissions/unknown-game")
 
         self.assertEqual(response.status_code, 404)
+
+
+class ListUserSubmissionsApiTests(TestCase):
+    def setUp(self):
+        self.event = Event.objects.create(name="Event", path="event")
+        game = Game.objects.create(name="Game", path="game")
+        event_game = EventGame.objects.create(event=self.event, game=game)
+        self.scope = Scope.objects.create(event_game=event_game, name="M1")
+        other_scope = Scope.objects.create(event_game=event_game, name="M2")
+
+        self.player = CustomUser.objects.create_user(username="player", password="x")
+        other = CustomUser.objects.create_user(username="other", password="x")
+        self.mine = Submission.objects.create(
+            event=self.event, scope=self.scope, user=self.player
+        )
+        self.theirs = Submission.objects.create(
+            event=self.event, scope=self.scope, user=other
+        )
+        Submission.objects.create(event=self.event, scope=other_scope, user=other)
+
+        self.url = f"/api/events/{self.event.path}/submissions/submission/by/user"
+
+    def _list(self):
+        response = self.client.get(self.url, {"scope_id": self.scope.id})
+        self.assertEqual(response.status_code, 200)
+        return response.json()
+
+    def test_player_sees_only_own_submissions(self):
+        self.client.force_login(self.player)
+
+        data = self._list()
+
+        self.assertEqual([s["id"] for s in data], [str(self.mine.id)])
+        self.assertEqual(data[0]["username"], "player")
+
+    def test_staff_sees_all_submissions_of_scope(self):
+        staff = CustomUser.objects.create_user(
+            username="staff", password="x", is_staff=True
+        )
+        self.client.force_login(staff)
+
+        data = self._list()
+
+        self.assertEqual(
+            {s["id"] for s in data}, {str(self.mine.id), str(self.theirs.id)}
+        )