feat: add player to team

cutt/player.py

@@ -1,5 +1,6 @@
 from typing import Annotated
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, Security
+from fastapi.responses import PlainTextResponse
 from sqlmodel import Session, select
 
 from cutt.db import Player, Team, engine
@@ -7,6 +8,8 @@ from cutt.security import change_password, get_current_active_user, read_player_
 
 P = Player
 
+player_router = APIRouter(prefix="/player", tags=["player"])
+
 
 def add_player(player: P):
     with Session(engine) as session:
@@ -14,6 +17,19 @@ def add_player(player: P):
         session.commit()
 
 
+def add_player_to_team(player_id: int, team_id: int):
+    with Session(engine) as session:
+        player = session.exec(select(P).where(P.id == player_id)).one()
+        team = session.exec(select(Team).where(Team.id == team_id)).one()
+        if player and team:
+            team.players.append(player)
+            session.add(team)
+            session.commit()
+            return PlainTextResponse(
+                f"added {player.display_name} ({player.username}) to {team.name}"
+            )
+
+
 def add_players(players: list[P]):
     with Session(engine) as session:
         for player in players:
@@ -21,6 +37,11 @@ def add_players(players: list[P]):
         session.commit()
 
 
+async def list_all_players():
+    with Session(engine) as session:
+        return session.exec(select(P)).all()
+
+
 async def list_players(team_id: int):
     with Session(engine) as session:
         statement = select(Team).where(Team.id == team_id)
@@ -32,14 +53,35 @@ async def list_players(team_id: int):
             ]
 
 
-async def read_teams_me(user: Annotated[P, Depends(get_current_active_user)]):
+def read_teams_me(user: Annotated[P, Depends(get_current_active_user)]):
     with Session(engine) as session:
         return [p.teams for p in session.exec(select(P).where(P.id == user.id))][0]
 
 
-player_router = APIRouter(prefix="/player", tags=["player"])
+player_router.add_api_route(
-player_router.add_api_route("/list/{team_id}", endpoint=list_players, methods=["GET"])
+    "/add",
-player_router.add_api_route("/add", endpoint=add_player, methods=["POST"])
+    endpoint=add_player,
+    methods=["POST"],
+    dependencies=[Security(get_current_active_user, scopes=["admin"])],
+)
+player_router.add_api_route(
+    "/list/{team_id}",
+    endpoint=list_players,
+    methods=["GET"],
+    dependencies=[Depends(get_current_active_user)],
+)
+player_router.add_api_route(
+    "/list",
+    endpoint=list_all_players,
+    methods=["GET"],
+    dependencies=[Security(get_current_active_user, scopes=["admin"])],
+)
+player_router.add_api_route(
+    "/add/{player_id}/{team_id}",
+    endpoint=add_player_to_team,
+    methods=["GET"],
+    dependencies=[Security(get_current_active_user, scopes=["admin"])],
+)
 player_router.add_api_route("/me", endpoint=read_player_me, methods=["GET"])
 player_router.add_api_route("/me/teams", endpoint=read_teams_me, methods=["GET"])
 player_router.add_api_route(