feat: switch to spa

polylan_submitter/submissions/api.py

@@ -31,6 +31,38 @@ def list_my_scopes(request: HttpRequest, event_path: str, game_path: str):
     )
 
 
+@router.get(f"{PREFIX}/{{game_path}}/available-scopes", response={200: list[ScopeOut], 403: dict})
+def list_available_scopes(request: HttpRequest, event_path: str, game_path: str):
+    """Scopes the current user may submit to for this game - superusers see
+    every active scope, everyone else only the ones assigned to them. Used
+    by the submissions-select and submissions-detail pages, both to list
+    scopes and (for the detail page) to confirm the requested scope_id is
+    one the current user is actually allowed to see."""
+    if not request.user.is_authenticated:
+        return 403, {"detail": "Authentication required"}
+
+    game = get_object_or_404(
+        Game.objects.enabled_for_event(request.event), path=game_path
+    )
+
+    scopes = (
+        Scope.objects.filter(
+            event_game__event=request.event,
+            event_game__game=game,
+            is_active=True,
+        )
+        if request.user.is_superuser
+        else Scope.objects.filter(
+            event_game__event=request.event,
+            event_game__game=game,
+            assigned_users=request.user,
+            is_active=True,
+        )
+    )
+
+    return list(scopes.order_by("name"))
+
+
 @router.post(f"{PREFIX}/submission/create", response={200: SubmissionOut, 403: dict})
 def create_submission(
     request: HttpRequest,