feat(submissions): sync scopes admin from token

polylan_submitter/submissions/api.py

@@ -5,10 +5,17 @@ from ninja import Router, File, Form
 from ninja.files import UploadedFile
 from django.shortcuts import get_object_or_404
 
-from games.models import Game
+from games.models import EventGame, Game
 from .models import Submission, SubmissionFile, ImageCrop, OCRStatus, Scope
-from .schemas import SubmissionOut, ImageCropIn, ImageCropOut, ScopeOut
-from .tasks import process_submission_file, process_crop
+from .schemas import (
+    SubmissionOut,
+    ImageCropIn,
+    ImageCropOut,
+    ScopeOut,
+    SyncScopesIn,
+    SyncScopesOut,
+)
+from .tasks import process_submission_file, process_crop, schedule_scope_sync
 
 router = Router()
 
@@ -66,6 +73,41 @@ def list_available_scopes(request: HttpRequest, event_path: str, game_path: str)
     return list(scopes.order_by("name"))
 
 
+@router.post(
+    f"{PREFIX}/{{game_path}}/sync-scopes",
+    response={200: SyncScopesOut, 400: dict, 403: dict},
+)
+def sync_scopes(
+    request: HttpRequest, event_path: str, game_path: str, payload: SyncScopesIn
+):
+    """Start the AAndT scope sync loop for a (non custom path) game, superusers
+    only. Stores `apibot_token` first when given; without one and none stored
+    yet, answers 400 with `token_required` so the frontend asks for it."""
+    if not request.user.is_superuser:
+        return 403, {"detail": "Superuser required"}
+
+    event_game = get_object_or_404(
+        EventGame,
+        event=request.event,
+        game__path=game_path,
+        game__custom_path=False,
+        enabled=True,
+    )
+
+    token = (payload.apibot_token or "").strip()
+    if token:
+        event_game.apibot_token = token
+        event_game.save(update_fields=["apibot_token"])
+
+    if not event_game.apibot_token:
+        return 400, {
+            "detail": "No AAndT apibot token configured",
+            "token_required": True,
+        }
+
+    return {"started": schedule_scope_sync(event_game.id)}
+
+
 @router.post(f"{PREFIX}/submission/create", response={200: SubmissionOut, 403: dict})
 def create_submission(
     request: HttpRequest,