feat: demo MVP list

revamp entire `SetPassword` page

analysis.py

@@ -1,237 +0,0 @@
-import io
-import base64
-from fastapi import APIRouter
-from fastapi.responses import JSONResponse
-from pydantic import BaseModel, Field
-from sqlmodel import Session, func, select
-from sqlmodel.sql.expression import SelectOfScalar
-from db import Chemistry, MVPRanking, Player, engine
-import networkx as nx
-import numpy as np
-import matplotlib
-
-matplotlib.use("agg")
-import matplotlib.pyplot as plt
-
-
-analysis_router = APIRouter(prefix="/analysis")
-
-
-C = Chemistry
-R = MVPRanking
-P = Player
-
-
-def sociogram_json():
-    nodes = []
-    necessary_nodes = set()
-    edges = []
-    players = {}
-    with Session(engine) as session:
-        for p in session.exec(select(P)).fetchall():
-            nodes.append({"id": p.display_name, "label": p.display_name})
-            players[p.id] = p.display_name
-        subquery = (
-            select(C.user, func.max(C.time).label("latest")).group_by(C.user).subquery()
-        )
-        statement2 = select(C).join(
-            subquery, (C.user == subquery.c.user) & (C.time == subquery.c.latest)
-        )
-        for c in session.exec(statement2):
-            # G.add_node(c.user)
-            necessary_nodes.add(c.user)
-            for p in [players[p_id] for p_id in c.love]:
-                # G.add_edge(c.user, p)
-                # p_id = session.exec(select(P.id).where(P.name == p)).one()
-                necessary_nodes.add(p)
-                edges.append({"from": players[c.user], "to": p, "relation": "likes"})
-            for p in [players[p_id] for p_id in c.hate]:
-                edges.append({"from": players[c.user], "to": p, "relation": "dislikes"})
-    # nodes = [n for n in nodes if n["name"] in necessary_nodes]
-    return JSONResponse({"nodes": nodes, "edges": edges})
-
-
-def graph_json():
-    nodes = []
-    edges = []
-    players = {}
-    with Session(engine) as session:
-        for p in session.exec(select(P)).fetchall():
-            players[p.id] = p.display_name
-            nodes.append({"id": p.display_name, "label": p.display_name})
-        subquery = (
-            select(C.user, func.max(C.time).label("latest")).group_by(C.user).subquery()
-        )
-        statement2 = select(C).join(
-            subquery, (C.user == subquery.c.user) & (C.time == subquery.c.latest)
-        )
-        for c in session.exec(statement2):
-            user = players[c.user]
-            for i, p_id in enumerate(c.love):
-                p = players[p_id]
-                edges.append(
-                    {
-                        "id": f"{user}->{p}",
-                        "source": user,
-                        "target": p,
-                        "size": max(1.0 - 0.1 * i, 0.3),
-                        "data": {
-                            "relation": 2,
-                            "origSize": max(1.0 - 0.1 * i, 0.3),
-                            "origFill": "#bed4ff",
-                        },
-                    }
-                )
-            for p_id in c.hate:
-                p = players[p_id]
-                edges.append(
-                    {
-                        "id": f"{user}-x>{p}",
-                        "source": user,
-                        "target": p,
-                        "size": 0.3,
-                        "data": {"relation": 0, "origSize": 0.3, "origFill": "#ff7c7c"},
-                        "fill": "#ff7c7c",
-                    }
-                )
-
-    G = nx.DiGraph()
-    G.add_weighted_edges_from([(e["source"], e["target"], e["size"]) for e in edges])
-    in_degrees = G.in_degree(weight="weight")
-    nodes = [
-        dict(node, **{"data": {"inDegree": in_degrees[node["id"]]}}) for node in nodes
-    ]
-    return JSONResponse({"nodes": nodes, "edges": edges})
-
-
-def sociogram_data(show: int | None = 2):
-    G = nx.DiGraph()
-    with Session(engine) as session:
-        players = {}
-        for p in session.exec(select(P)).fetchall():
-            G.add_node(p.display_name)
-            players[p.id] = p.display_name
-        subquery = (
-            select(C.user, func.max(C.time).label("latest")).group_by(C.user).subquery()
-        )
-        statement2 = (
-            select(C)
-            # .where(C.user.in_(["Kruse", "Franz", "ck"]))
-            .join(subquery, (C.user == subquery.c.user) & (C.time == subquery.c.latest))
-        )
-        for c in session.exec(statement2):
-            if show >= 1:
-                for i, p_id in enumerate(c.love):
-                    p = players[p_id]
-                    G.add_edge(c.user, p, group="love", rank=i, popularity=1 - 0.08 * i)
-            if show <= 1:
-                for i, p_id in enumerate(c.hate):
-                    p = players[p_id]
-                    G.add_edge(c.user, p, group="hate", rank=8, popularity=-0.16)
-    return G
-
-
-class Params(BaseModel):
-    node_size: int | None = Field(default=2400, alias="nodeSize")
-    font_size: int | None = Field(default=10, alias="fontSize")
-    arrow_size: int | None = Field(default=20, alias="arrowSize")
-    edge_width: float | None = Field(default=1, alias="edgeWidth")
-    distance: float | None = 0.2
-    weighting: bool | None = True
-    popularity: bool | None = True
-    show: int | None = 2
-
-
-ARROWSTYLE = {"love": "-|>", "hate": "-|>"}
-EDGESTYLE = {"love": "-", "hate": ":"}
-EDGECOLOR = {"love": "#404040", "hate": "#cc0000"}
-
-
-async def render_sociogram(params: Params):
-    plt.figure(figsize=(16, 10), facecolor="none")
-    ax = plt.gca()
-    ax.set_facecolor("none")  # Set the axis face color to none (transparent)
-    ax.axis("off")  # Turn off axis ticks and frames
-
-    G = sociogram_data(show=params.show)
-    pos = nx.spring_layout(G, scale=2, k=params.distance, iterations=50, seed=None)
-    nodes = nx.draw_networkx_nodes(
-        G,
-        pos,
-        node_color=[
-            v for k, v in G.in_degree(weight="popularity" if params.weighting else None)
-        ]
-        if params.popularity
-        else "#99ccff",
-        edgecolors="#404040",
-        linewidths=0,
-        # node_shape="8",
-        node_size=params.node_size,
-        cmap="coolwarm",
-        alpha=0.86,
-    )
-    if params.popularity:
-        cbar = plt.colorbar(nodes)
-        cbar.ax.set_xlabel("popularity")
-    nx.draw_networkx_labels(G, pos, font_size=params.font_size)
-    nx.draw_networkx_edges(
-        G,
-        pos,
-        arrows=True,
-        edge_color=[EDGECOLOR[G.edges()[*edge]["group"]] for edge in G.edges()],
-        arrowsize=params.arrow_size,
-        node_size=params.node_size,
-        width=params.edge_width,
-        style=[EDGESTYLE[G.edges()[*edge]["group"]] for edge in G.edges()],
-        arrowstyle=[ARROWSTYLE[G.edges()[*edge]["group"]] for edge in G.edges()],
-        connectionstyle="arc3,rad=0.12",
-        alpha=[1 - 0.08 * G.edges()[*edge]["rank"] for edge in G.edges()]
-        if params.weighting
-        else 1,
-    )
-
-    buf = io.BytesIO()
-    plt.savefig(buf, format="png", bbox_inches="tight", dpi=300, transparent=True)
-    buf.seek(0)
-    encoded_image = base64.b64encode(buf.read()).decode("UTF-8")
-    plt.close()
-
-    return {"image": encoded_image}
-
-
-def mvp():
-    ranks = dict()
-    with Session(engine) as session:
-        players = {p.id: p.display_name for p in session.exec(select(P)).fetchall()}
-        subquery = (
-            select(R.user, func.max(R.time).label("latest")).group_by(R.user).subquery()
-        )
-        statement2 = select(R).join(
-            subquery, (R.user == subquery.c.user) & (R.time == subquery.c.latest)
-        )
-        for r in session.exec(statement2):
-            for i, p_id in enumerate(r.mvps):
-                p = players[p_id]
-                ranks[p] = ranks.get(p, []) + [i + 1]
-    return [
-        {
-            "name": p,
-            "rank": f"{np.mean(v):.02f}",
-            "std": f"{np.std(v):.02f}",
-            "n": len(v),
-        }
-        for p, v in ranks.items()
-    ]
-
-
-analysis_router.add_api_route("/json", endpoint=sociogram_json, methods=["GET"])
-analysis_router.add_api_route("/graph_json", endpoint=graph_json, methods=["GET"])
-analysis_router.add_api_route("/image", endpoint=render_sociogram, methods=["POST"])
-analysis_router.add_api_route("/mvp", endpoint=mvp, methods=["GET"])
-
-if __name__ == "__main__":
-    with Session(engine) as session:
-        statement: SelectOfScalar[P] = select(func.count(P.id))
-        print("players in DB: ", session.exec(statement).first())
-    G = sociogram_data()
-    pos = nx.spring_layout(G, scale=1, k=2, iterations=50, seed=42)

cutt/analysis.py

@@ -0,0 +1,433 @@
+import io
+import itertools
+import random
+import base64
+from typing import Annotated
+from fastapi import APIRouter, HTTPException, Security, status
+from fastapi.responses import JSONResponse
+from pydantic import BaseModel, Field
+from sqlmodel import Session, func, select
+from sqlmodel.sql.expression import SelectOfScalar
+from cutt.db import Chemistry, MVPRanking, Player, PlayerTeamLink, Team, engine
+import networkx as nx
+import numpy as np
+import matplotlib
+
+from cutt.security import TeamScopedRequest, verify_team_scope
+from cutt.demo import demo_players
+
+matplotlib.use("agg")
+import matplotlib.pyplot as plt
+
+
+analysis_router = APIRouter(prefix="/analysis", tags=["analysis"])
+
+
+C = Chemistry
+R = MVPRanking
+P = Player
+
+
+def sociogram_json():
+    nodes = []
+    necessary_nodes = set()
+    edges = []
+    players = {}
+    with Session(engine) as session:
+        for p in session.exec(select(P)).fetchall():
+            nodes.append({"id": p.display_name, "label": p.display_name})
+            players[p.id] = p.display_name
+        subquery = (
+            select(C.user, func.max(C.time).label("latest")).group_by(C.user).subquery()
+        )
+        statement2 = select(C).join(
+            subquery, (C.user == subquery.c.user) & (C.time == subquery.c.latest)
+        )
+        for c in session.exec(statement2):
+            # G.add_node(c.user)
+            necessary_nodes.add(c.user)
+            for p in [players[p_id] for p_id in c.love]:
+                # G.add_edge(c.user, p)
+                # p_id = session.exec(select(P.id).where(P.name == p)).one()
+                necessary_nodes.add(p)
+                edges.append({"from": players[c.user], "to": p, "relation": "likes"})
+            for p in [players[p_id] for p_id in c.hate]:
+                edges.append({"from": players[c.user], "to": p, "relation": "dislikes"})
+    # nodes = [n for n in nodes if n["name"] in necessary_nodes]
+    return JSONResponse({"nodes": nodes, "edges": edges})
+
+
+def graph_json(
+    request: Annotated[TeamScopedRequest, Security(verify_team_scope)],
+    networkx_graph: bool = False,
+):
+    nodes = []
+    edges = []
+    player_map = {}
+    if request.team_id == 42:
+        players = [request.user] + demo_players
+        random.seed(42)
+        for p in players:
+            nodes.append({"id": p.display_name, "label": p.display_name})
+        for p, other in itertools.permutations(players, 2):
+            value = random.random()
+            if value > 0.5:
+                edges.append(
+                    {
+                        "id": f"{p.display_name}->{other.display_name}",
+                        "source": p.display_name,
+                        "target": other.display_name,
+                        "size": max(value, 0.3),
+                        "data": {
+                            "relation": 2,
+                            "origSize": max(value, 0.3),
+                            "origFill": "#bed4ff",
+                        },
+                    }
+                )
+            elif value < 0.1:
+                edges.append(
+                    {
+                        "id": f"{p.display_name}-x>{other.display_name}",
+                        "source": p.display_name,
+                        "target": other.display_name,
+                        "size": 0.3,
+                        "data": {"relation": 0, "origSize": 0.3, "origFill": "#ff7c7c"},
+                        "fill": "#ff7c7c",
+                    }
+                )
+        G = nx.DiGraph()
+        G.add_nodes_from([n["id"] for n in nodes])
+        G.add_weighted_edges_from(
+            [
+                (
+                    e["source"],
+                    e["target"],
+                    e["size"] if e["data"]["relation"] == 2 else -e["size"],
+                )
+                for e in edges
+            ]
+        )
+        in_degrees = G.in_degree(weight="weight")
+        nodes = [
+            dict(node, **{"data": {"inDegree": in_degrees[node["id"]]}})
+            for node in nodes
+        ]
+        if networkx_graph:
+            return G
+        return JSONResponse({"nodes": nodes, "edges": edges})
+
+    with Session(engine) as session:
+        players = session.exec(
+            select(P)
+            .join(PlayerTeamLink)
+            .join(Team)
+            .where(Team.id == request.team_id, P.disabled == False)
+        ).all()
+        if not players:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="no players found in your team",
+            )
+        for p in players:
+            player_map[p.id] = p.display_name
+            nodes.append({"id": p.display_name, "label": p.display_name})
+
+        subquery = (
+            select(C.user, func.max(C.time).label("latest"))
+            .where(C.team == request.team_id)
+            .group_by(C.user)
+            .subquery()
+        )
+        statement2 = select(C).join(
+            subquery, (C.user == subquery.c.user) & (C.time == subquery.c.latest)
+        )
+
+        for c in session.exec(statement2):
+            user = player_map[c.user]
+            for i, p_id in enumerate(c.love):
+                p = player_map[p_id]
+                edges.append(
+                    {
+                        "id": f"{user}->{p}",
+                        "source": user,
+                        "target": p,
+                        "size": max(1.0 - 0.1 * i, 0.3),
+                        "data": {
+                            "relation": 2,
+                            "origSize": max(1.0 - 0.1 * i, 0.3),
+                            "origFill": "#bed4ff",
+                        },
+                    }
+                )
+            for p_id in c.hate:
+                p = player_map[p_id]
+                edges.append(
+                    {
+                        "id": f"{user}-x>{p}",
+                        "source": user,
+                        "target": p,
+                        "size": 0.3,
+                        "data": {"relation": 0, "origSize": 0.3, "origFill": "#ff7c7c"},
+                        "fill": "#ff7c7c",
+                    }
+                )
+
+    if not edges:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="no entries found"
+        )
+    G = nx.DiGraph()
+    G.add_nodes_from([n["id"] for n in nodes])
+    G.add_weighted_edges_from(
+        [
+            (
+                e["source"],
+                e["target"],
+                e["size"] if e["data"]["relation"] == 2 else -e["size"],
+            )
+            for e in edges
+        ]
+    )
+    in_degrees = G.in_degree(weight="weight")
+    nodes = [
+        dict(node, **{"data": {"inDegree": in_degrees[node["id"]]}}) for node in nodes
+    ]
+    if networkx_graph:
+        return G
+    return JSONResponse({"nodes": nodes, "edges": edges})
+
+
+def sociogram_data(show: int | None = 2):
+    G = nx.DiGraph()
+    with Session(engine) as session:
+        players = {}
+        for p in session.exec(select(P)).fetchall():
+            G.add_node(p.display_name)
+            players[p.id] = p.display_name
+        subquery = (
+            select(C.user, func.max(C.time).label("latest")).group_by(C.user).subquery()
+        )
+        statement2 = (
+            select(C)
+            # .where(C.user.in_(["Kruse", "Franz", "ck"]))
+            .join(subquery, (C.user == subquery.c.user) & (C.time == subquery.c.latest))
+        )
+        for c in session.exec(statement2):
+            if show >= 1:
+                for i, p_id in enumerate(c.love):
+                    p = players[p_id]
+                    G.add_edge(c.user, p, group="love", rank=i, popularity=1 - 0.08 * i)
+            if show <= 1:
+                for i, p_id in enumerate(c.hate):
+                    p = players[p_id]
+                    G.add_edge(c.user, p, group="hate", rank=8, popularity=-0.16)
+    return G
+
+
+class Params(BaseModel):
+    node_size: int | None = Field(default=2400, alias="nodeSize")
+    font_size: int | None = Field(default=10, alias="fontSize")
+    arrow_size: int | None = Field(default=20, alias="arrowSize")
+    edge_width: float | None = Field(default=1, alias="edgeWidth")
+    distance: float | None = 0.2
+    weighting: bool | None = True
+    popularity: bool | None = True
+    show: int | None = 2
+
+
+ARROWSTYLE = {"love": "-|>", "hate": "-|>"}
+EDGESTYLE = {"love": "-", "hate": ":"}
+EDGECOLOR = {"love": "#404040", "hate": "#cc0000"}
+
+
+async def render_sociogram(params: Params):
+    plt.figure(figsize=(16, 10), facecolor="none")
+    ax = plt.gca()
+    ax.set_facecolor("none")  # Set the axis face color to none (transparent)
+    ax.axis("off")  # Turn off axis ticks and frames
+
+    G = sociogram_data(show=params.show)
+    pos = nx.spring_layout(G, scale=2, k=params.distance, iterations=50, seed=None)
+    nodes = nx.draw_networkx_nodes(
+        G,
+        pos,
+        node_color=[
+            v for k, v in G.in_degree(weight="popularity" if params.weighting else None)
+        ]
+        if params.popularity
+        else "#99ccff",
+        edgecolors="#404040",
+        linewidths=0,
+        # node_shape="8",
+        node_size=params.node_size,
+        cmap="coolwarm",
+        alpha=0.86,
+    )
+    if params.popularity:
+        cbar = plt.colorbar(nodes)
+        cbar.ax.set_xlabel("popularity")
+    nx.draw_networkx_labels(G, pos, font_size=params.font_size)
+    nx.draw_networkx_edges(
+        G,
+        pos,
+        arrows=True,
+        edge_color=[EDGECOLOR[G.edges()[*edge]["group"]] for edge in G.edges()],
+        arrowsize=params.arrow_size,
+        node_size=params.node_size,
+        width=params.edge_width,
+        style=[EDGESTYLE[G.edges()[*edge]["group"]] for edge in G.edges()],
+        arrowstyle=[ARROWSTYLE[G.edges()[*edge]["group"]] for edge in G.edges()],
+        connectionstyle="arc3,rad=0.12",
+        alpha=[1 - 0.08 * G.edges()[*edge]["rank"] for edge in G.edges()]
+        if params.weighting
+        else 1,
+    )
+
+    buf = io.BytesIO()
+    plt.savefig(buf, format="png", bbox_inches="tight", dpi=300, transparent=True)
+    buf.seek(0)
+    encoded_image = base64.b64encode(buf.read()).decode("UTF-8")
+    plt.close()
+
+    return {"image": encoded_image}
+
+
+def mvp(
+    request: Annotated[TeamScopedRequest, Security(verify_team_scope)],
+):
+    ranks = dict()
+    if request.team_id == 42:
+        random.seed(42)
+        players = [request.user] + demo_players
+        for p in players:
+            random.shuffle(players)
+            for i, p in enumerate(players):
+                ranks[p.display_name] = ranks.get(p.display_name, []) + [i + 1]
+        return [
+            {
+                "name": p,
+                "rank": f"{np.mean(v):.02f}",
+                "std": f"{np.std(v):.02f}",
+                "n": len(v),
+            }
+            for p, v in ranks.items()
+        ]
+
+    with Session(engine) as session:
+        players = session.exec(
+            select(P)
+            .join(PlayerTeamLink)
+            .join(Team)
+            .where(Team.id == request.team_id, P.disabled == False)
+        ).all()
+        if not players:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND)
+        player_map = {p.id: p.display_name for p in players}
+        subquery = (
+            select(R.user, func.max(R.time).label("latest"))
+            .where(R.team == request.team_id)
+            .group_by(R.user)
+            .subquery()
+        )
+        statement2 = select(R).join(
+            subquery, (R.user == subquery.c.user) & (R.time == subquery.c.latest)
+        )
+        for r in session.exec(statement2):
+            for i, p_id in enumerate(r.mvps):
+                p = player_map[p_id]
+                ranks[p] = ranks.get(p, []) + [i + 1]
+
+    if not ranks:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="no entries found"
+        )
+    return [
+        {
+            "name": p,
+            "rank": f"{np.mean(v):.02f}",
+            "std": f"{np.std(v):.02f}",
+            "n": len(v),
+        }
+        for p, v in ranks.items()
+    ]
+
+
+async def turnout(
+    request: Annotated[
+        TeamScopedRequest, Security(verify_team_scope, scopes=["analysis"])
+    ],
+):
+    player_map = {}
+    with Session(engine) as session:
+        players = session.exec(
+            select(P)
+            .join(PlayerTeamLink)
+            .join(Team)
+            .where(Team.id == request.team_id, P.disabled == False)
+        ).all()
+        if not players:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND)
+        for p in players:
+            player_map[p.id] = p.display_name
+
+        subquery = (
+            select(C.user, func.max(C.time).label("latest"))
+            .where(C.team == request.team_id)
+            .group_by(C.user)
+            .subquery()
+        )
+        statement2 = select(C.user).join(
+            subquery, (C.user == subquery.c.user) & (C.time == subquery.c.latest)
+        )
+        chemistry_turnout = session.exec(statement2).all()
+        chemistry_missing = set(player_map) - set(chemistry_turnout)
+        chemistry_missing = [player_map[i] for i in chemistry_missing]
+
+        subquery = (
+            select(R.user, func.max(R.time).label("latest"))
+            .where(R.team == request.team_id)
+            .group_by(R.user)
+            .subquery()
+        )
+        statement2 = select(R.user).join(
+            subquery, (R.user == subquery.c.user) & (R.time == subquery.c.latest)
+        )
+        mvp_turnout = session.exec(statement2).all()
+        mvp_missing = set(player_map) - set(mvp_turnout)
+        mvp_missing = [player_map[i] for i in mvp_missing]
+        return JSONResponse(
+            {
+                "players": len(player_map),
+                "chemistry": {
+                    "turnout": len(chemistry_turnout),
+                    "missing": sorted(list(chemistry_missing)),
+                },
+                "MVP": {
+                    "turnout": len(mvp_turnout),
+                    "missing": sorted(list(mvp_missing)),
+                },
+            }
+        )
+
+
+# analysis_router.add_api_route("/json", endpoint=sociogram_json, methods=["GET"])
+analysis_router.add_api_route(
+    "/graph_json/{team_id}", endpoint=graph_json, methods=["GET"]
+)
+# analysis_router.add_api_route("/image", endpoint=render_sociogram, methods=["POST"])
+analysis_router.add_api_route(
+    "/mvp/{team_id}",
+    endpoint=mvp,
+    methods=["GET"],
+    name="MVPs",
+    description="Request Most Valuable Players stats",
+)
+analysis_router.add_api_route("/turnout/{team_id}", endpoint=turnout, methods=["GET"])
+
+if __name__ == "__main__":
+    with Session(engine) as session:
+        statement: SelectOfScalar[P] = select(func.count(P.id))
+        print("players in DB: ", session.exec(statement).first())
+    G = sociogram_data()
+    pos = nx.spring_layout(G, scale=1, k=2, iterations=50, seed=42)

cutt/db.py

@@ -51,7 +51,7 @@ class Player(SQLModel, table=True):
     disabled: bool | None = None
     hashed_password: str | None = None
     number: str | None = None
-    teams: list[Team] | None = Relationship(
+    teams: list[Team] = Relationship(
         back_populates="players", link_model=PlayerTeamLink
     )
     scopes: str = ""
@@ -60,17 +60,19 @@ class Player(SQLModel, table=True):
 class Chemistry(SQLModel, table=True):
     id: int | None = Field(default=None, primary_key=True)
     time: datetime | None = Field(default_factory=utctime)
-    user: int | None = Field(default=None, foreign_key="player.id")
+    user: int = Field(default=None, foreign_key="player.id")
     hate: list[int] = Field(sa_column=Column(ARRAY(Integer)))
     undecided: list[int] = Field(sa_column=Column(ARRAY(Integer)))
     love: list[int] = Field(sa_column=Column(ARRAY(Integer)))
+    team: int = Field(default=None, foreign_key="team.id")
 
 
 class MVPRanking(SQLModel, table=True):
     id: int | None = Field(default=None, primary_key=True)
     time: datetime | None = Field(default_factory=utctime)
-    user: int | None = Field(default=None, foreign_key="player.id")
+    user: int = Field(default=None, foreign_key="player.id")
     mvps: list[int] = Field(sa_column=Column(ARRAY(Integer)))
+    team: int = Field(default=None, foreign_key="team.id")
 
 
 class TokenDB(SQLModel, table=True):

cutt/demo.py

@@ -0,0 +1,27 @@
+import random
+from cutt.db import Player
+
+names = [
+    "August",
+    "Beate",
+    "Ceasar",
+    "Daedalus",
+    "Elli",
+    "Ford P.",
+    "Gabriel",
+    "Hugo",
+    "Ivar Johansson",
+    "Jürgen Gordon Malinauskas",
+]
+demo_players = [
+    Player.model_validate(
+        {
+            "id": i,
+            "display_name": name,
+            "username": name.lower().replace(" ", "").replace(".", ""),
+            "number": str(random.randint(0, 100)),
+            "email": name.lower().replace(" ", "").replace(".", "") + "@example.org",
+        }
+    )
+    for i, name in enumerate(names)
+]

cutt/main.py

@@ -1,30 +1,31 @@
 from typing import Annotated
 from fastapi import APIRouter, Depends, FastAPI, HTTPException, Security, status
-from fastapi.responses import JSONResponse
+from fastapi.responses import FileResponse, JSONResponse
 from fastapi.staticfiles import StaticFiles
-from db import Player, Team, Chemistry, MVPRanking, engine
+from cutt.db import Player, Team, Chemistry, MVPRanking, engine
 from sqlmodel import (
     Session,
     func,
     select,
 )
 from fastapi.middleware.cors import CORSMiddleware
-from analysis import analysis_router
-from security import (
-    change_password,
+from cutt.analysis import analysis_router
+from cutt.security import (
     get_current_active_user,
     login_for_access_token,
     logout,
-    read_player_me,
-    read_own_items,
+    register,
     set_first_password,
 )
+from cutt.player import player_router
 
 C = Chemistry
 R = MVPRanking
 P = Player
 
-app = FastAPI(title="cutt")
+app = FastAPI(
+    title="cutt", swagger_ui_parameters={"syntaxHighlight": {"theme": "monokai"}}
+)
 api_router = APIRouter(prefix="/api")
 origins = [
     "https://cutt.0124816.xyz",
@@ -46,53 +47,16 @@ def add_team(team: Team):
         session.commit()
 
 
-def add_player(player: Player):
-    with Session(engine) as session:
-        session.add(player)
-        session.commit()
-
-
-def add_players(players: list[Player]):
-    with Session(engine) as session:
-        for player in players:
-            session.add(player)
-        session.commit()
-
-
-async def list_players():
-    with Session(engine) as session:
-        statement = select(Player).order_by(Player.display_name)
-        players = session.exec(statement).fetchall()
-        return [
-            player.model_dump(include={"id", "display_name", "number"})
-            for player in players
-        ]
-
-
-async def read_teams_me(user: Annotated[Player, Depends(get_current_active_user)]):
-    with Session(engine) as session:
-        return [p.teams for p in session.exec(select(P).where(P.id == user.id))][0]
-
-
 def list_teams():
     with Session(engine) as session:
         statement = select(Team)
         return session.exec(statement).fetchall()
 
 
-player_router = APIRouter(prefix="/player")
-player_router.add_api_route("/list", endpoint=list_players, methods=["GET"])
-player_router.add_api_route("/add", endpoint=add_player, methods=["POST"])
-player_router.add_api_route("/me", endpoint=read_player_me, methods=["GET"])
-player_router.add_api_route("/me/teams", endpoint=read_teams_me, methods=["GET"])
-player_router.add_api_route("/me/items", endpoint=read_own_items, methods=["GET"])
-player_router.add_api_route(
-    "/change_password", endpoint=change_password, methods=["POST"]
-)
-
 team_router = APIRouter(
-    prefix="/team",
+    prefix="/teams",
     dependencies=[Security(get_current_active_user, scopes=["admin"])],
+    tags=["team"],
 )
 team_router.add_api_route("/list", endpoint=list_teams, methods=["GET"])
 team_router.add_api_route("/add", endpoint=add_team, methods=["POST"])
@@ -102,30 +66,43 @@ wrong_user_id_exception = HTTPException(
     status_code=status.HTTP_401_UNAUTHORIZED,
     detail="you're not who you think you are...",
 )
+somethings_fishy = HTTPException(
+    status_code=status.HTTP_400_BAD_REQUEST, detail="something up..."
+)
 
 
-@api_router.put("/mvps")
+@api_router.put("/mvps", tags=["analysis"])
 def submit_mvps(
     mvps: MVPRanking,
     user: Annotated[Player, Depends(get_current_active_user)],
 ):
+    if mvps.team == 42:
+        return JSONResponse("DEMO team, nothing happens")
     if user.id == mvps.user:
         with Session(engine) as session:
-            session.add(mvps)
-            session.commit()
-            return JSONResponse("success!")
+            statement = select(Team).where(Team.id == mvps.team)
+            players = [t.players for t in session.exec(statement)][0]
+            if players:
+                player_ids = {p.id for p in players}
+                if player_ids >= set(mvps.mvps):
+                    session.add(mvps)
+                    session.commit()
+                    return JSONResponse("success!")
+        raise somethings_fishy
     else:
         raise wrong_user_id_exception
 
 
-@api_router.get("/mvps")
+@api_router.get("/mvps/{team_id}", tags=["analysis"])
 def get_mvps(
+    team_id: int,
     user: Annotated[Player, Depends(get_current_active_user)],
 ):
     with Session(engine) as session:
         subquery = (
             select(R.user, func.max(R.time).label("latest"))
             .where(R.user == user.id)
+            .where(R.team == team_id)
             .group_by(R.user)
             .subquery()
         )
@@ -142,25 +119,38 @@ def get_mvps(
             )
 
 
-@api_router.put("/chemistry")
+@api_router.put("/chemistry", tags=["analysis"])
 def submit_chemistry(
     chemistry: Chemistry, user: Annotated[Player, Depends(get_current_active_user)]
 ):
+    if chemistry.team == 42:
+        return JSONResponse("DEMO team, nothing happens")
     if user.id == chemistry.user:
         with Session(engine) as session:
-            session.add(chemistry)
-            session.commit()
-            return JSONResponse("success!")
+            statement = select(Team).where(Team.id == chemistry.team)
+            players = [t.players for t in session.exec(statement)][0]
+            if players:
+                player_ids = {p.id for p in players}
+                if player_ids >= (
+                    set(chemistry.love) | set(chemistry.hate) | set(chemistry.undecided)
+                ):
+                    session.add(chemistry)
+                    session.commit()
+                    return JSONResponse("success!")
+        raise somethings_fishy
     else:
         raise wrong_user_id_exception
 
 
-@api_router.get("/chemistry")
-def get_chemistry(user: Annotated[Player, Depends(get_current_active_user)]):
+@api_router.get("/chemistry/{team_id}", tags=["analysis"])
+def get_chemistry(
+    team_id: int, user: Annotated[Player, Depends(get_current_active_user)]
+):
     with Session(engine) as session:
         subquery = (
             select(C.user, func.max(C.time).label("latest"))
             .where(C.user == user.id)
+            .where(C.team == team_id)
             .group_by(C.user)
             .subquery()
         )
@@ -189,12 +179,23 @@ api_router.include_router(
     player_router, dependencies=[Depends(get_current_active_user)]
 )
 api_router.include_router(team_router, dependencies=[Depends(get_current_active_user)])
-api_router.include_router(
-    analysis_router,
-    dependencies=[Security(get_current_active_user, scopes=["analysis"])],
-)
+api_router.include_router(analysis_router)
 api_router.add_api_route("/token", endpoint=login_for_access_token, methods=["POST"])
 api_router.add_api_route("/set_password", endpoint=set_first_password, methods=["POST"])
+api_router.add_api_route("/register", endpoint=register, methods=["POST"])
 api_router.add_api_route("/logout", endpoint=logout, methods=["POST"])
 app.include_router(api_router)
-app.mount("/", SPAStaticFiles(directory="dist", html=True), name="site")
+
+
+# app.mount("/", SPAStaticFiles(directory="dist", html=True), name="site")
+@app.get("/")
+async def root():
+    return FileResponse("dist/index.html")
+
+
+@app.exception_handler(404)
+async def exception_404_handler(request, exc):
+    return FileResponse("dist/index.html")
+
+
+app.mount("/", StaticFiles(directory="dist"), name="ui")

cutt/player.py

@@ -0,0 +1,241 @@
+from typing import Annotated
+from fastapi import APIRouter, Depends, HTTPException, Security, status
+from fastapi.responses import PlainTextResponse
+from pydantic import BaseModel
+from sqlmodel import Session, select
+
+from cutt.db import Player, PlayerTeamLink, Team, engine
+from cutt.security import (
+    TeamScopedRequest,
+    change_password,
+    get_current_active_user,
+    read_player_me,
+    verify_team_scope,
+)
+from cutt.demo import demo_players
+
+P = Player
+
+player_router = APIRouter(prefix="/player", tags=["player"])
+
+
+class PlayerRequest(BaseModel):
+    display_name: str
+    username: str
+    number: str
+    email: str
+
+
+class AddPlayerRequest(PlayerRequest): ...
+
+
+DEMO_TEAM_REQUEST = HTTPException(
+    status_code=status.HTTP_400_BAD_REQUEST,
+    detail="DEMO Team, nothing happens",
+)
+
+
+def add_player(
+    r: AddPlayerRequest,
+    request: Annotated[TeamScopedRequest, Depends(verify_team_scope)],
+):
+    with Session(engine) as session:
+        if session.exec(select(P).where(P.username == r.username)).one_or_none():
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST, detail="username not available"
+            )
+
+        stmt = (
+            select(P)
+            .join(PlayerTeamLink)
+            .join(Team)
+            .where(Team.id == request.team_id, P.display_name == r.display_name)
+        )
+        if session.exec(stmt).one_or_none():
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="the name is already taken on this team",
+            )
+
+        team = session.exec(select(Team).where(Team.id == request.team_id)).one()
+        new_player = Player(
+            username=r.username,
+            display_name=r.display_name,
+            email=r.email if r.email else None,
+            number=r.number,
+            disabled=False,
+            teams=[team],
+        )
+        session.add(new_player)
+        session.commit()
+        return PlainTextResponse(f"added {new_player.display_name}")
+
+
+class ModifyPlayerRequest(PlayerRequest):
+    id: int
+
+
+def modify_player(
+    r: ModifyPlayerRequest,
+    request: Annotated[TeamScopedRequest, Depends(verify_team_scope)],
+):
+    if request.team_id == 42:
+        raise DEMO_TEAM_REQUEST
+    with Session(engine) as session:
+        player = session.exec(
+            select(P)
+            .join(PlayerTeamLink)
+            .join(Team)
+            .where(Team.id == request.team_id, P.id == r.id, P.username == r.username)
+        ).one_or_none()
+        if player:
+            player.display_name = r.display_name.strip()
+            player.number = r.number.strip()
+            player.email = r.email.strip()
+            session.add(player)
+            session.commit()
+            return PlainTextResponse("modification successful")
+        else:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="no such player found in your team",
+            )
+
+
+class DisablePlayerRequest(BaseModel):
+    player_id: int
+
+
+def disable_player(
+    r: DisablePlayerRequest,
+    request: Annotated[TeamScopedRequest, Depends(verify_team_scope)],
+):
+    if request.team_id == 42:
+        raise DEMO_TEAM_REQUEST
+    with Session(engine) as session:
+        player = session.exec(
+            select(P)
+            .join(PlayerTeamLink)
+            .join(Team)
+            .where(Team.id == request.team_id, P.id == r.player_id)
+        ).one_or_none()
+        if player:
+            player.disabled = True
+            session.add(player)
+            session.commit()
+            return PlainTextResponse(f"disabled {player.display_name}")
+        else:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="no such player found in your team",
+            )
+
+
+def add_player_to_team(player_id: int, team_id: int):
+    with Session(engine) as session:
+        player = session.exec(select(P).where(P.id == player_id)).one()
+        team = session.exec(select(Team).where(Team.id == team_id)).one()
+        if player and team:
+            team.players.append(player)
+            session.add(team)
+            session.commit()
+            return PlainTextResponse(
+                f"added {player.display_name} ({player.username}) to {team.name}"
+            )
+
+
+def add_players(players: list[P]):
+    with Session(engine) as session:
+        for player in players:
+            session.add(player)
+        session.commit()
+
+
+async def list_all_players():
+    with Session(engine) as session:
+        return session.exec(select(P)).all()
+
+
+async def list_players(
+    team_id: int, user: Annotated[Player, Depends(get_current_active_user)]
+):
+    if team_id == 42:
+        return [
+            user.model_dump(
+                include={"id", "display_name", "username", "number", "email"}
+            )
+        ] + demo_players
+
+    with Session(engine) as session:
+        current_user = session.exec(
+            select(P)
+            .join(PlayerTeamLink)
+            .join(Team)
+            .where(Team.id == team_id, P.disabled == False, P.id == user.id)
+        ).one_or_none()
+        if not current_user:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="you're not in this team",
+            )
+
+        players = session.exec(
+            select(P)
+            .join(PlayerTeamLink)
+            .join(Team)
+            .where(Team.id == team_id, P.disabled == False)
+        ).all()
+        if players:
+            return [
+                player.model_dump(
+                    include={"id", "display_name", "username", "number", "email"}
+                )
+                for player in players
+                if not player.disabled
+            ]
+
+
+def read_teams_me(user: Annotated[P, Depends(get_current_active_user)]):
+    with Session(engine) as session:
+        return [p.teams for p in session.exec(select(P).where(P.id == user.id))][0] + [
+            {"country": "nowhere", "id": 42, "location": "everywhere", "name": "DEMO"}
+        ]
+
+
+player_router.add_api_route(
+    "/{team_id}",
+    endpoint=add_player,
+    methods=["POST"],
+)
+player_router.add_api_route(
+    "/{team_id}",
+    endpoint=modify_player,
+    methods=["PUT"],
+)
+player_router.add_api_route(
+    "/{team_id}",
+    endpoint=disable_player,
+    methods=["DELETE"],
+)
+player_router.add_api_route(
+    "/{team_id}/list",
+    endpoint=list_players,
+    methods=["GET"],
+)
+player_router.add_api_route(
+    "/list",
+    endpoint=list_all_players,
+    methods=["GET"],
+    dependencies=[Security(get_current_active_user, scopes=["admin"])],
+)
+player_router.add_api_route(
+    "/add/{team_id}/{player_id}",
+    endpoint=add_player_to_team,
+    methods=["GET"],
+    dependencies=[Security(get_current_active_user, scopes=["admin"])],
+)
+player_router.add_api_route("/me", endpoint=read_player_me, methods=["GET"])
+player_router.add_api_route("/me/teams", endpoint=read_teams_me, methods=["GET"])
+player_router.add_api_route(
+    "/change_password", endpoint=change_password, methods=["POST"]
+)

cutt/security.py

@@ -6,7 +6,7 @@ from pydantic import BaseModel, ValidationError
 import jwt
 from jwt.exceptions import ExpiredSignatureError, InvalidTokenError
 from sqlmodel import Session, select
-from db import TokenDB, engine, Player
+from cutt.db import PlayerTeamLink, Team, TokenDB, engine, Player
 from fastapi.security import (
     OAuth2PasswordBearer,
     OAuth2PasswordRequestForm,
@@ -16,6 +16,8 @@ from pydantic_settings import BaseSettings, SettingsConfigDict
 from passlib.context import CryptContext
 from sqlalchemy.exc import OperationalError
 
+P = Player
+
 
 class Config(BaseSettings):
     secret_key: str = ""
@@ -141,8 +143,9 @@ async def get_current_user(
     user = get_user(username=token_data.username)
     if user is None:
         raise credentials_exception
+    allowed_scopes = set(user.scopes.split())
     for scope in security_scopes.scopes:
-        if scope not in token_data.scopes:
+        if scope not in allowed_scopes or scope not in token_data.scopes:
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,
                 detail="Not enough permissions",
@@ -159,6 +162,26 @@ async def get_current_active_user(
     return current_user
 
 
+class TeamScopedRequest(BaseModel):
+    user: Player
+    team_id: int
+
+
+async def verify_team_scope(
+    team_id: int, user: Annotated[Player, Depends(get_current_active_user)]
+):
+    if team_id == 42:
+        return TeamScopedRequest(user=user, team_id=team_id)
+    allowed_scopes = set(user.scopes.split())
+    if f"team:{team_id}" not in allowed_scopes:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Not enough permissions",
+        )
+    else:
+        return TeamScopedRequest(user=user, team_id=team_id)
+
+
 async def login_for_access_token(
     form_data: Annotated[OAuth2PasswordRequestForm, Depends()], response: Response
 ) -> Token:
@@ -189,72 +212,94 @@ async def logout(response: Response):
     return {"message": "Successfully logged out"}
 
 
-def generate_one_time_token(username):
+def set_password_token(username: str):
     user = get_user(username)
     if user:
-        expire = timedelta(days=7)
+        expire = timedelta(days=30)
         token = create_access_token(
-            data={"sub": username, "name": user.display_name},
+            data={
+                "sub": "set password",
+                "username": username,
+                "name": user.display_name,
+            },
             expires_delta=expire,
         )
         return token
 
 
+def register_token(team_id: int):
+    with Session(engine) as session:
+        team = session.exec(select(Team).where(Team.id == team_id)).one()
+        if team:
+            expire = timedelta(days=30)
+            token = create_access_token(
+                data={"sub": "register", "team_id": team_id, "name": team.name},
+                expires_delta=expire,
+            )
+            return token
+
+
+def verify_one_time_token(token: str):
+    credentials_exception = HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="could not validate token",
+    )
+    with Session(engine) as session:
+        token_in_db = session.exec(
+            select(TokenDB).where(TokenDB.token == token).where(TokenDB.used == False)
+        ).one_or_none()
+        if token_in_db:
+            try:
+                payload = jwt.decode(token, config.secret_key, algorithms=["HS256"])
+                return payload
+            except ExpiredSignatureError:
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail="access token expired",
+                )
+            except (InvalidTokenError, ValidationError):
+                raise credentials_exception
+        elif session.exec(
+            select(TokenDB).where(TokenDB.token == token).where(TokenDB.used == True)
+        ).one_or_none():
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="token already used",
+            )
+        else:
+            raise credentials_exception
+
+
+def invalidate_one_time_token(token: str):
+    with Session(engine) as session:
+        token_in_db = session.exec(select(TokenDB).where(TokenDB.token == token)).one()
+        token_in_db.used = True
+        session.add(token_in_db)
+        session.commit()
+
+
 class FirstPassword(BaseModel):
     token: str
     password: str
 
 
 async def set_first_password(req: FirstPassword):
-    credentials_exception = HTTPException(
-        status_code=status.HTTP_401_UNAUTHORIZED,
-        detail="Could not validate token",
-    )
+    payload = verify_one_time_token(req.token)
+    action: str = payload.get("sub")
+    if action != "set password":
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="wrong type of token.",
+        )
+    username: str = payload.get("username")
     with Session(engine) as session:
-        token_in_db = session.exec(
-            select(TokenDB)
-            .where(TokenDB.token == req.token)
-            .where(TokenDB.used == False)
-        ).one_or_none()
-        if token_in_db:
-            credentials_exception = HTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                detail="Could not validate token",
-            )
-            try:
-                payload = jwt.decode(req.token, config.secret_key, algorithms=["HS256"])
-                username: str = payload.get("sub")
-                if username is None:
-                    raise credentials_exception
-            except ExpiredSignatureError:
-                raise HTTPException(
-                    status_code=status.HTTP_401_UNAUTHORIZED,
-                    detail="Access token expired",
-                )
-            except (InvalidTokenError, ValidationError):
-                raise credentials_exception
-
-            user = get_user(username)
-            if user:
-                user.hashed_password = get_password_hash(req.password)
-                session.add(user)
-                token_in_db.used = True
-                session.add(token_in_db)
-                session.commit()
-                return Response(
-                    "Password set successfully", status_code=status.HTTP_200_OK
-                )
-        elif session.exec(
-            select(TokenDB)
-            .where(TokenDB.token == req.token)
-            .where(TokenDB.used == True)
-        ).one_or_none():
-            raise HTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                detail="Token already used",
-            )
-        else:
-            raise credentials_exception
+        user = get_user(username)
+        if user:
+            user.hashed_password = get_password_hash(req.password)
+            session.add(user)
+            session.commit()
+            invalidate_one_time_token(req.token)
+            return Response("password set successfully", status_code=status.HTTP_200_OK)
 
 
 class ChangedPassword(BaseModel):
@@ -276,17 +321,74 @@ async def change_password(
             session.add(user)
             session.commit()
             return PlainTextResponse(
-                "Password changed successfully",
+                "password changed successfully",
                 status_code=status.HTTP_200_OK,
                 media_type="text/plain",
             )
     else:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail="Wrong password",
+            detail="wrong password",
         )
 
 
+class RegisterRequest(BaseModel):
+    token: str
+    team_id: int
+    display_name: str
+    username: str
+    password: str
+    email: str | None
+    number: str | None
+
+
+async def register(req: RegisterRequest):
+    payload = verify_one_time_token(req.token)
+    action: str = payload.get("sub")
+    if action != "register":
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="wrong type of token.",
+        )
+    team_id: int = payload.get("team_id")
+    if team_id != req.team_id:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="wrong team",
+        )
+    with Session(engine) as session:
+        if session.exec(select(P).where(P.username == req.username)).one_or_none():
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="username exists",
+            )
+        stmt = (
+            select(P)
+            .join(PlayerTeamLink)
+            .join(Team)
+            .where(Team.id == team_id, P.display_name == req.display_name)
+        )
+        if session.exec(stmt).one_or_none():
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="the name is already taken on this team",
+            )
+        team = session.exec(select(Team).where(Team.id == team_id)).one()
+        new_player = Player(
+            username=req.username,
+            hashed_password=get_password_hash(req.password),
+            display_name=req.display_name,
+            email=req.email if req.email else None,
+            number=req.number,
+            disabled=False,
+            teams=[team],
+        )
+        session.add(new_player)
+        session.commit()
+        # invalidate_one_time_token(req.token)
+        return PlainTextResponse(f"added {new_player.display_name}")
+
+
 async def read_player_me(
     current_user: Annotated[Player, Depends(get_current_active_user)],
 ):

src/App.css

@@ -408,15 +408,31 @@ button {
   }
 }
 
+.avatars {
+  margin: 16px auto;
+}
+
 .avatar {
+  background-color: #f0f8ff88;
   font-weight: bold;
   font-size: 110%;
   padding: 3px 1em;
   width: fit-content;
   border: 3px solid;
   border-radius: 1em;
-  margin: 0 auto 16px auto;
+  margin: 4px auto;
+}
 
+.group-avatar {
+  background-color: #f0f8ff88;
+  color: inherit;
+  font-weight: bold;
+  font-size: 90%;
+  padding: 3px 1em;
+  width: fit-content;
+  border: 3px solid;
+  border-radius: 1em;
+  margin: 4px auto;
 }
 
 .user-info {
@@ -455,7 +471,6 @@ button {
   }
 }
 
-
 .networkroute {
   z-index: 3;
   position: absolute;
@@ -463,6 +478,69 @@ button {
   left: 48px;
 }
 
+/*========TEAM PANEL========*/
+.team-panel {
+  max-width: 800px;
+  padding: 1em;
+  border: 3px solid black;
+  box-shadow: 8px 8px black;
+  margin: 1em;
+
+  input {
+    max-width: 300px;
+    margin: 0.2em auto;
+  }
+}
+
+.team-player {
+  color: black;
+  background-color: #36c4;
+  border: 1px solid black;
+  border-radius: 1.4em;
+  margin: 4px;
+  padding: 0.2em 0.5em;
+
+  &:hover {
+    background-color: #36c8;
+  }
+
+  &.new-player {
+    background-color: #3838;
+  }
+
+  &.disable-player {
+    background-color: #e338;
+  }
+}
+
+.new-player-inputs {
+  display: flex;
+  flex-direction: column;
+  margin: auto;
+
+  div {
+    display: grid;
+    grid-template-columns: 20ch auto;
+
+    @media only screen and (max-width: 768px) {
+      grid-template-columns: auto;
+      place-items: center;
+    }
+
+    label {
+      text-align: left;
+      width: 20ch;
+      margin: auto 1em;
+    }
+
+    input {
+      width: 90%;
+      margin: 4px 0;
+    }
+  }
+}
+
+
 @keyframes blink {
 
   0% {
@@ -532,6 +610,7 @@ button {
   position: relative;
   height: 12px;
   width: 96%;
+  margin: auto;
   border: 4px solid black;
   overflow: hidden;
 }

src/App.tsx

@@ -9,6 +9,7 @@ import { GraphComponent } from "./Network";
 import MVPChart from "./MVPChart";
 import { SetPassword } from "./SetPassword";
 import { ThemeProvider } from "./ThemeProvider";
+import TeamPanel from "./TeamPanel";
 
 const Maintenance = () => {
   return (
@@ -33,10 +34,11 @@ function App() {
                 <Header />
                 <Routes>
                   <Route index element={<Rankings />} />
-                  <Route path="/network" element={<GraphComponent />} />
-                  <Route path="/analysis" element={<Analysis />} />
-                  <Route path="/mvp" element={<MVPChart />} />
-                  <Route path="/changepassword" element={<SetPassword />} />
+                  <Route path="network" element={<GraphComponent />} />
+                  <Route path="analysis" element={<Analysis />} />
+                  <Route path="mvp" element={<MVPChart />} />
+                  <Route path="changepassword" element={<SetPassword />} />
+                  <Route path="team" element={<TeamPanel />} />
                 </Routes>
                 <Footer />
               </SessionProvider>

src/Avatar.tsx

@@ -1,5 +1,5 @@
 import { createRef, MouseEventHandler, useEffect, useState } from "react";
-import { useSession } from "./Session";
+import { TeamState, useSession } from "./Session";
 import { User } from "./api";
 import { useTheme } from "./ThemeProvider";
 import { colourTheme, darkTheme, normalTheme, rainbowTheme } from "./themes";
@@ -11,7 +11,7 @@ interface ContextMenuItem {
   onClick: () => void;
 }
 
-const UserInfo = (user: User, teams: Team[] | undefined) => {
+const UserInfo = (user: User, teams: TeamState | undefined) => {
   return (
     <div className="user-info">
       <div>
@@ -42,9 +42,9 @@ const UserInfo = (user: User, teams: Team[] | undefined) => {
               textAlign: "left",
             }}
           >
-            {teams.map((team) => (
+            {teams.teams.map((team, index) => (
               <li>
-                {team.name} (
+                {<b>{team.name}</b>} (
                 {team.location || team.country || "location unknown"})
               </li>
             ))}
@@ -56,7 +56,7 @@ const UserInfo = (user: User, teams: Team[] | undefined) => {
 };
 
 export default function Avatar() {
-  const { user, teams, onLogout } = useSession();
+  const { user, teams, setTeams, onLogout } = useSession();
   const { theme, setTheme } = useTheme();
   const navigate = useNavigate();
   const [contextMenu, setContextMenu] = useState<{
@@ -147,20 +147,39 @@ export default function Avatar() {
   }
 
   return (
-    <div
-      className="avatar"
-      onContextMenu={handleMenuClick}
-      style={{ display: user ? "block" : "none" }}
-      onClick={(event) => {
-        if (contextMenu.open && event.target === avatarRef.current) {
-          handleMenuClose();
-        } else {
-          handleMenuClick(event);
-        }
-      }}
-      ref={avatarRef}
-    >
-      👤 {user?.username}
+    <>
+      <div className="avatars" style={{ display: user ? "block" : "none" }}>
+        <div
+          className="avatar"
+          onContextMenu={handleMenuClick}
+          onClick={(event) => {
+            if (contextMenu.open && event.target === avatarRef.current) {
+              handleMenuClose();
+            } else {
+              handleMenuClick(event);
+            }
+          }}
+          ref={avatarRef}
+        >
+          👤 {user?.username}
+        </div>
+        {teams && teams?.teams.length > 1 && (
+          <select
+            className="group-avatar"
+            value={teams.activeTeam}
+            onChange={(e) =>
+              setTeams({ ...teams, activeTeam: Number(e.target.value) })
+            }
+          >
+            {teams.teams.map((team) => (
+              <option key={team.id} value={team.id}>
+                👥 {team.name}
+              </option>
+            ))}
+          </select>
+        )}
+      </div>
+
       {contextMenu.open && (
         <ul
           className="context-menu"
@@ -193,6 +212,6 @@ export default function Avatar() {
       >
         {dialog}
       </dialog>
-    </div>
+    </>
   );
 }

src/Footer.tsx

@@ -4,10 +4,11 @@ import { useSession } from "./Session";
 
 export default function Footer() {
   const location = useLocation();
-  const { user } = useSession();
+  const { user, teams } = useSession();
   return (
     <footer className={location.pathname === "/network" ? "fixed-footer" : ""}>
-      {user?.scopes.split(" ").includes("analysis") && (
+      {(user?.scopes.split(" ").includes("analysis") ||
+        teams?.activeTeam === 42) && (
         <div className="navbar">
           <Link to="/">
             <span>Form</span>
@@ -20,6 +21,10 @@ export default function Footer() {
           <Link to="/mvp">
             <span>MVP</span>
           </Link>
+          <span>|</span>
+          <Link to="/team">
+            <span>Team</span>
+          </Link>
         </div>
       )}
       <p className="grey extra-margin">

src/Login.tsx

@@ -114,7 +114,7 @@ export const Login = ({ onLogin }: LoginProps) => {
             {visible ? <Eye /> : <EyeSlash />}
           </div>
         </div>
-        <div>{error && <span style={{ color: "red" }}>{error}</span>}</div>
+        {error && <span style={{ color: "red" }}>{error}</span>}
         <button type="submit" value="login" style={{ fontSize: "small" }}>
           login
         </button>

src/MVPChart.tsx

@@ -2,35 +2,51 @@ import { useEffect, useState } from "react";
 import { apiAuth } from "./api";
 import { PlayerRanking } from "./types";
 import RaceChart from "./RaceChart";
+import { useSession } from "./Session";
+import { useNavigate } from "react-router";
 
 const MVPChart = () => {
-  const [data, setData] = useState({} as PlayerRanking[]);
+  let initialData = {} as PlayerRanking[];
+  const [data, setData] = useState(initialData);
   const [loading, setLoading] = useState(true);
+  const [error, setError] = useState("");
   const [showStd, setShowStd] = useState(false);
+  const { user, teams } = useSession();
+  const navigate = useNavigate();
+  useEffect(() => {
+    user?.scopes.includes(`team:${teams?.activeTeam}`) ||
+      teams?.activeTeam === 42 ||
+      navigate("/", { replace: true });
+  }, [user]);
 
   async function loadData() {
     setLoading(true);
-    await apiAuth("analysis/mvp", null)
-      .then((json) => json as Promise<PlayerRanking[]>)
-      .then((json) => {
-        setData(json.sort((a, b) => a.rank - b.rank));
-      });
-    setLoading(false);
+    if (teams) {
+      await apiAuth(`analysis/mvp/${teams?.activeTeam}`, null)
+        .then((data) => {
+          if (data.detail) {
+            setError(data.detail);
+            return initialData;
+          } else {
+            setError("");
+            return data as Promise<PlayerRanking[]>;
+          }
+        })
+        .then((data) => {
+          setData(data.sort((a, b) => a.rank - b.rank));
+        })
+        .catch(() => setError("no access"));
+      setLoading(false);
+    } else setError("team unknown");
   }
 
   useEffect(() => {
     loadData();
-  }, []);
+  }, [teams]);
 
-  return (
-    <>
-      {loading ? (
-        <span className="loader" />
-      ) : (
-        <RaceChart std={showStd} players={data} />
-      )}
-    </>
-  );
+  if (loading) return <span className="loader" />;
+  else if (error) return <span>{error}</span>;
+  else return <RaceChart std={showStd} players={data} />;
 };
 
 export default MVPChart;

src/Network.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useRef, useState } from "react";
+import { ReactNode, useEffect, useRef, useState } from "react";
 import { apiAuth } from "./api";
 import {
   GraphCanvas,
@@ -10,6 +10,8 @@ import {
   useSelection,
 } from "reagraph";
 import { customTheme } from "./NetworkTheme";
+import { useSession } from "./Session";
+import { useNavigate } from "react-router";
 
 interface NetworkData {
   nodes: GraphNode[];
@@ -36,26 +38,44 @@ const useCustomSelection = (props: CustomSelectionProps): SelectionResult => {
 };
 
 export const GraphComponent = () => {
-  const [data, setData] = useState({ nodes: [], edges: [] } as NetworkData);
+  let initialData = { nodes: [], edges: [] } as NetworkData;
+  const [data, setData] = useState(initialData);
   const [loading, setLoading] = useState(true);
+  const [error, setError] = useState("");
   const [threed, setThreed] = useState(false);
   const [likes, setLikes] = useState(2);
   const [popularity, setPopularity] = useState(false);
   const [mutuality, setMutuality] = useState(false);
+  const { user, teams } = useSession();
+  const navigate = useNavigate();
+  useEffect(() => {
+    user?.scopes.includes(`team:${teams?.activeTeam}`) ||
+      teams?.activeTeam === 42 ||
+      navigate("/", { replace: true });
+  }, [user]);
 
   async function loadData() {
     setLoading(true);
-    await apiAuth("analysis/graph_json", null)
-      .then((json) => json as Promise<NetworkData>)
-      .then((json) => {
-        setData(json);
-      });
-    setLoading(false);
+    if (teams) {
+      await apiAuth(`analysis/graph_json/${teams?.activeTeam}`, null)
+        .then((data) => {
+          if (data.detail) {
+            setError(data.detail);
+            return initialData;
+          } else {
+            setError("");
+            return data as Promise<NetworkData>;
+          }
+        })
+        .then((data) => setData(data))
+        .catch(() => setError("no access"));
+      setLoading(false);
+    } else setError("team unknown");
   }
 
   useEffect(() => {
     loadData();
-  }, []);
+  }, [teams]);
 
   const graphRef = useRef<GraphCanvasRef | null>(null);
 
@@ -161,6 +181,74 @@ export const GraphComponent = () => {
     type: "multiModifier",
   });
 
+  let content: ReactNode;
+  if (loading) {
+    content = <span className="loader" />;
+  } else if (error) {
+    content = <span>{error}</span>;
+  } else {
+    content = (
+      <>
+        <GraphCanvas
+          draggable
+          cameraMode={threed ? "rotate" : "pan"}
+          layoutType={threed ? "forceDirected3d" : "forceDirected2d"}
+          layoutOverrides={{
+            nodeStrength: -200,
+            linkDistance: 100,
+          }}
+          labelType="nodes"
+          sizingType="attribute"
+          sizingAttribute={popularity ? "inDegree" : undefined}
+          ref={graphRef}
+          theme={customTheme}
+          nodes={data.nodes}
+          edges={data.edges.filter(
+            (edge) => edge.data.relation === likes || likes === 1
+          )}
+          selections={selections}
+          actives={actives}
+          onCanvasClick={onCanvasClick}
+          onNodeClick={onNodeClick}
+          onNodePointerOut={onNodePointerOut}
+          onNodePointerOver={onNodePointerOver}
+        />
+        <button
+          className="infobutton"
+          onClick={() => {
+            const dialog = document.querySelector("dialog[id='InfoDialog']");
+            (dialog as HTMLDialogElement).showModal();
+          }}
+        >
+          info
+        </button>
+
+        <dialog
+          id="InfoDialog"
+          style={{ textAlign: "left" }}
+          onClick={(event) => {
+            event.currentTarget.close();
+          }}
+        >
+          scroll to zoom
+          <br />
+          <br />
+          <b>hover</b>: show inbound links
+          <br />
+          <b>click</b>: show outward links
+          <br />
+          <br />
+          multi-selection possible
+          <br />
+          with <i>Ctrl</i> or <i>Shift</i>
+          <br />
+          <br />
+          drag to pan/rotate
+        </dialog>
+      </>
+    );
+  }
+
   return (
     <div style={{ position: "absolute", top: 0, bottom: 0, left: 0, right: 0 }}>
       <div className="controls">
@@ -225,67 +313,7 @@ export const GraphComponent = () => {
           </span>
         </div>
       )}
-
-      {loading ? (
-        <span className="loader" />
-      ) : (
-        <GraphCanvas
-          draggable
-          cameraMode={threed ? "rotate" : "pan"}
-          layoutType={threed ? "forceDirected3d" : "forceDirected2d"}
-          layoutOverrides={{
-            nodeStrength: -200,
-            linkDistance: 100,
-          }}
-          labelType="nodes"
-          sizingType="attribute"
-          sizingAttribute={popularity ? "inDegree" : undefined}
-          ref={graphRef}
-          theme={customTheme}
-          nodes={data.nodes}
-          edges={data.edges.filter(
-            (edge) => edge.data.relation === likes || likes === 1
-          )}
-          selections={selections}
-          actives={actives}
-          onCanvasClick={onCanvasClick}
-          onNodeClick={onNodeClick}
-          onNodePointerOut={onNodePointerOut}
-          onNodePointerOver={onNodePointerOver}
-        />
-      )}
-      <button
-        className="infobutton"
-        onClick={() => {
-          const dialog = document.querySelector("dialog[id='InfoDialog']");
-          (dialog as HTMLDialogElement).showModal();
-        }}
-      >
-        info
-      </button>
-
-      <dialog
-        id="InfoDialog"
-        style={{ textAlign: "left" }}
-        onClick={(event) => {
-          event.currentTarget.close();
-        }}
-      >
-        scroll to zoom
-        <br />
-        <br />
-        <b>hover</b>: show inbound links
-        <br />
-        <b>click</b>: show outward links
-        <br />
-        <br />
-        multi-selection possible
-        <br />
-        with <i>Ctrl</i> or <i>Shift</i>
-        <br />
-        <br />
-        drag to pan/rotate
-      </dialog>
+      {content}
     </div>
   );
 };

src/RaceChart.tsx

@@ -16,7 +16,7 @@ const determineNiceWidth = (width: number) => {
 const RaceChart: FC<RaceChartProps> = ({ players, std }) => {
   const [width, setWidth] = useState(determineNiceWidth(window.innerWidth));
   //const [height, setHeight] = useState(window.innerHeight);
-  const height = players.length * 40;
+  const height = (players.length + 1) * 40;
 
   useEffect(() => {
     const handleResize = () => {

src/Rankings.tsx

@@ -7,8 +7,8 @@ import {
   useState,
 } from "react";
 import { ReactSortable, ReactSortableProps } from "react-sortablejs";
-import { apiAuth, User } from "./api";
-import { useSession } from "./Session";
+import { apiAuth, loadPlayers, User } from "./api";
+import { TeamState, useSession } from "./Session";
 import { Chemistry, MVPRanking } from "./types";
 import TabController from "./TabController";
 
@@ -56,10 +56,11 @@ function filterSort(list: User[], ids: number[]): User[] {
 
 interface PlayerInfoProps {
   user: User;
+  teams: TeamState;
   players: User[];
 }
 
-function ChemistryDnD({ user, players }: PlayerInfoProps) {
+function ChemistryDnD({ user, teams, players }: PlayerInfoProps) {
   var otherPlayers = players.filter((player) => player.id !== user.id);
   const [playersLeft, setPlayersLeft] = useState<User[]>([]);
   const [playersMiddle, setPlayersMiddle] = useState<User[]>(otherPlayers);
@@ -68,6 +69,11 @@ function ChemistryDnD({ user, players }: PlayerInfoProps) {
   useEffect(() => {
     setPlayersMiddle(otherPlayers);
   }, [players]);
+  useEffect(() => {
+    setPlayersLeft([]);
+    setPlayersMiddle(otherPlayers);
+    setPlayersRight([]);
+  }, [teams]);
 
   const [dialog, setDialog] = useState("dialog");
   const dialogRef = useRef<HTMLDialogElement>(null);
@@ -78,22 +84,32 @@ function ChemistryDnD({ user, players }: PlayerInfoProps) {
     let left = playersLeft.map(({ id }) => id);
     let middle = playersMiddle.map(({ id }) => id);
     let right = playersRight.map(({ id }) => id);
-    const data = { user: user.id, hate: left, undecided: middle, love: right };
+    const data = {
+      user: user.id,
+      hate: left,
+      undecided: middle,
+      love: right,
+      team: teams.activeTeam,
+    };
     const response = await apiAuth("chemistry", data, "PUT");
     setDialog(response || "try sending again");
   }
 
   async function handleGet() {
-    const chemistry = (await apiAuth("chemistry", null, "GET")) as Chemistry;
-    setPlayersLeft(filterSort(otherPlayers, chemistry.hate));
-    setPlayersMiddle(
-      otherPlayers.filter(
-        (player) =>
-          !chemistry.hate.includes(player.id) &&
-          !chemistry.love.includes(player.id)
-      )
-    );
-    setPlayersRight(filterSort(otherPlayers, chemistry.love));
+    const data = await apiAuth(`chemistry/${teams.activeTeam}`, null, "GET");
+    if (data.detail) alert(data.detail);
+    else {
+      const chemistry = data as Chemistry;
+      setPlayersLeft(filterSort(otherPlayers, chemistry.hate));
+      setPlayersMiddle(
+        otherPlayers.filter(
+          (player) =>
+            !chemistry.hate.includes(player.id) &&
+            !chemistry.love.includes(player.id)
+        )
+      );
+      setPlayersRight(filterSort(otherPlayers, chemistry.love));
+    }
   }
 
   return (
@@ -163,7 +179,7 @@ function ChemistryDnD({ user, players }: PlayerInfoProps) {
   );
 }
 
-function MVPDnD({ user, players }: PlayerInfoProps) {
+function MVPDnD({ user, teams, players }: PlayerInfoProps) {
   const [availablePlayers, setAvailablePlayers] = useState<User[]>(players);
   const [rankedPlayers, setRankedPlayers] = useState<User[]>([]);
 
@@ -171,6 +187,11 @@ function MVPDnD({ user, players }: PlayerInfoProps) {
     setAvailablePlayers(players);
   }, [players]);
 
+  useEffect(() => {
+    setAvailablePlayers(players);
+    setRankedPlayers([]);
+  }, [teams]);
+
   const [dialog, setDialog] = useState("dialog");
   const dialogRef = useRef<HTMLDialogElement>(null);
 
@@ -178,15 +199,21 @@ function MVPDnD({ user, players }: PlayerInfoProps) {
     if (dialogRef.current) dialogRef.current.showModal();
     setDialog("sending...");
     let mvps = rankedPlayers.map(({ id }) => id);
-    const data = { user: user.id, mvps: mvps };
+    const data = { user: user.id, mvps: mvps, team: teams.activeTeam };
     const response = await apiAuth("mvps", data, "PUT");
     response ? setDialog(response) : setDialog("try sending again");
   }
 
   async function handleGet() {
-    const mvps = (await apiAuth("mvps", null, "GET")) as MVPRanking;
-    setRankedPlayers(filterSort(players, mvps.mvps));
-    setAvailablePlayers(players.filter((user) => !mvps.mvps.includes(user.id)));
+    const data = await apiAuth(`mvps/${teams.activeTeam}`, null, "GET");
+    if (data.detail) alert(data.detail);
+    else {
+      const mvps = data as MVPRanking;
+      setRankedPlayers(filterSort(players, mvps.mvps));
+      setAvailablePlayers(
+        players.filter((user) => !mvps.mvps.includes(user.id))
+      );
+    }
   }
 
   return (
@@ -277,21 +304,14 @@ function HeaderControl({ onLoad, onClear }: HeaderControlProps) {
 }
 
 export default function Rankings() {
-  const { user } = useSession();
+  const { user, teams } = useSession();
   const [players, setPlayers] = useState<User[] | null>(null);
 
-  async function loadPlayers() {
-    try {
-      const data = await apiAuth("player/list", null, "GET");
-      setPlayers(data as User[]);
-    } catch (error) {
-      console.error(error);
-    }
-  }
-
   useEffect(() => {
-    loadPlayers();
-  }, [user]);
+    if (teams) {
+      loadPlayers(teams.activeTeam).then((data) => setPlayers(data));
+    }
+  }, [user, teams]);
 
   const tabs = [
     { id: "Chemistry", label: "🧪 Chemistry" },
@@ -300,10 +320,10 @@ export default function Rankings() {
 
   return (
     <>
-      {user && players ? (
+      {user && teams && players ? (
         <TabController tabs={tabs}>
-          <ChemistryDnD {...{ user, players }} />
-          <MVPDnD {...{ user, players }} />
+          <ChemistryDnD {...{ user, teams, players }} />
+          <MVPDnD {...{ user, teams, players }} />
         </TabController>
       ) : (
         <span className="loader" />

src/Session.tsx

@@ -14,15 +14,22 @@ export interface SessionProviderProps {
   children: ReactNode;
 }
 
+export interface TeamState {
+  teams: Team[];
+  activeTeam: number;
+}
+
 export interface Session {
   user: User | null;
-  teams: Team[] | null;
+  teams: TeamState | null;
+  setTeams: (teams: TeamState) => void;
   onLogout: () => void;
 }
 
 const sessionContext = createContext<Session>({
   user: null,
   teams: null,
+  setTeams: () => {},
   onLogout: () => {},
 });
 
@@ -30,7 +37,7 @@ export function SessionProvider(props: SessionProviderProps) {
   const { children } = props;
 
   const [user, setUser] = useState<User | null>(null);
-  const [teams, setTeams] = useState<Team[] | null>(null);
+  const [teams, setTeams] = useState<TeamState | null>(null);
   const [err, setErr] = useState<unknown>(null);
   const [loading, setLoading] = useState(false);
 
@@ -50,13 +57,15 @@ export function SessionProvider(props: SessionProviderProps) {
 
   async function loadTeam() {
     const teams: Team[] = await apiAuth("player/me/teams", null, "GET");
-    if (teams) setTeams(teams);
+    if (teams) setTeams({ teams: teams, activeTeam: teams[0].id });
   }
 
   useEffect(() => {
     loadUser();
-    setTimeout(() => loadTeam(), 1500);
   }, []);
+  useEffect(() => {
+    loadTeam();
+  }, [user]);
 
   function onLogin(user: User) {
     setUser(user);
@@ -87,7 +96,7 @@ export function SessionProvider(props: SessionProviderProps) {
     content = <Login onLogin={onLogin} />;
   } else
     content = (
-      <sessionContext.Provider value={{ user, teams, onLogout }}>
+      <sessionContext.Provider value={{ user, teams, setTeams, onLogout }}>
         {children}
       </sessionContext.Provider>
     );

src/SetPassword.tsx

@@ -1,17 +1,29 @@
 import { jwtDecode, JwtPayload } from "jwt-decode";
-import { useEffect, useState } from "react";
-import { apiAuth, baseUrl } from "./api";
+import { ReactNode, useEffect, useState } from "react";
+import { apiAuth, baseUrl, User } from "./api";
 import { useNavigate } from "react-router";
 import { Eye, EyeSlash } from "./Icons";
 import { useSession } from "./Session";
+import { relative } from "path";
+import Header from "./Header";
 
-interface SetPassToken extends JwtPayload {
+interface PassToken extends JwtPayload {
+  username: string;
   name: string;
+  team_id: number;
+}
+
+enum Mode {
+  register = "register",
+  set = "set password",
+  change = "change password",
 }
 
 export const SetPassword = () => {
+  const [mode, setMode] = useState<Mode>();
   const [name, setName] = useState("after getting your token.");
   const [username, setUsername] = useState("");
+  const [teamID, setTeamID] = useState<number>();
   const [currentPassword, setCurrentPassword] = useState("");
   const [password, setPassword] = useState("");
   const [passwordr, setPasswordr] = useState("");
@@ -19,36 +31,22 @@ export const SetPassword = () => {
   const [error, setError] = useState("");
   const [loading, setLoading] = useState(false);
   const [visible, setVisible] = useState(false);
+  const newPlayerTemplate = {
+    username: "",
+    display_name: "",
+    number: "",
+    email: "",
+  } as User;
+  const [player, setPlayer] = useState(newPlayerTemplate);
   const navigate = useNavigate();
   const { user } = useSession();
 
-  useEffect(() => {
-    if (user) {
-      setUsername(user.username);
-      setName(user.display_name);
-    } else {
-      const params = new URLSearchParams(window.location.search);
-      const token = params.get("token");
-      if (token) {
-        setToken(token);
-        try {
-          const payload = jwtDecode<SetPassToken>(token);
-          if (payload.name) setName(payload.name);
-          else if (payload.sub) setName(payload.sub);
-          else setName("Mr. I-have-no Token");
-          payload.sub && setUsername(payload.sub);
-        } catch (InvalidTokenError) {
-          setName("Mr. I-have-no-valid Token");
-        }
-      }
-    }
-  }, []);
-
   async function handleSubmit(e: React.FormEvent) {
     e.preventDefault();
     if (password === passwordr) {
       setLoading(true);
-      if (user) {
+      if (mode === Mode.change) {
+        //====CHANGING PASSWORD====
         const resp = await apiAuth(
           "player/change_password",
           { current_password: currentPassword, new_password: password },
@@ -60,7 +58,8 @@ export const SetPassword = () => {
           setError(resp);
           setTimeout(() => navigate("/"), 2000);
         }
-      } else {
+      } else if (mode === Mode.set) {
+        //====SETTING PASSWORD====
         const req = new Request(`${baseUrl}api/set_password`, {
           method: "POST",
           headers: {
@@ -92,106 +91,240 @@ export const SetPassword = () => {
             throw new Error("Unauthorized");
           }
         }
+      } else if (mode === Mode.register) {
+        //====REGISTER NEW USER====
+        const req = new Request(`${baseUrl}api/register`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify({
+            ...player,
+            team_id: teamID,
+            token: token,
+            password: password,
+          }),
+        });
+        let resp: Response;
+        try {
+          resp = await fetch(req);
+        } catch (e) {
+          throw new Error(`request failed: ${e}`);
+        }
+        setLoading(false);
+
+        if (resp.ok) {
+          console.log(resp);
+          navigate("/", {
+            replace: true,
+            state: { username: player.username, password: password },
+          });
+        }
+
+        if (!resp.ok) {
+          const { detail } = await resp.json();
+          if (detail) setError(detail);
+          else setError("unauthorized");
+          throw new Error("Unauthorized");
+        }
       }
     } else setError("passwords are not the same");
   }
 
-  return (
+  useEffect(() => {
+    if (user) {
+      setUsername(user.username);
+      setName(user.display_name);
+      setMode(Mode.change);
+    } else {
+      const params = new URLSearchParams(window.location.search);
+      const token = params.get("token");
+      if (token) {
+        setToken(token);
+        try {
+          const payload = jwtDecode<PassToken>(token);
+          console.log(payload);
+          switch (payload.sub) {
+            case "register":
+              setMode(Mode.register);
+              if (payload.team_id) setTeamID(payload.team_id);
+              break;
+            case "set password":
+              setMode(Mode.set);
+              if (payload.username) setUsername(payload.username);
+              break;
+          }
+          if (payload.name) setName(payload.name);
+        } catch (InvalidTokenError) {
+          setName("Mr. I-have-no-valid Token");
+        }
+      }
+    }
+  }, []);
+
+  let header: ReactNode;
+  switch (mode) {
+    case Mode.change:
+      header = <h2>change your password, {name}</h2>;
+      break;
+    case Mode.set:
+      header = (
+        <>
+          <Header />
+          <h2>set your password, {name}</h2>
+        </>
+      );
+      break;
+    case Mode.register:
+      header = (
+        <>
+          <Header />
+          <h2>
+            register as a member of <i>{name}</i>
+          </h2>
+        </>
+      );
+  }
+
+  let textInputs: ReactNode;
+  switch (mode) {
+    case Mode.change:
+      textInputs = (
+        <div>
+          <input
+            type={visible ? "text" : "password"}
+            id="password"
+            name="password"
+            placeholder="current password"
+            minLength={8}
+            value={currentPassword}
+            required
+            onChange={(evt) => {
+              setError("");
+              setCurrentPassword(evt.target.value);
+            }}
+          />
+          <hr style={{ margin: "8px" }} />
+        </div>
+      );
+      break;
+    case Mode.register:
+      textInputs = (
+        <div className="new-player-inputs">
+          <div>
+            <label>name</label>
+            <input
+              type="text"
+              required
+              value={player.display_name}
+              onChange={(e) => {
+                setPlayer({
+                  ...player,
+                  display_name: e.target.value,
+                  username: e.target.value.toLowerCase().replace(/\W/g, ""),
+                });
+              }}
+            />
+          </div>
+          <div>
+            <label>username</label>
+            <input
+              type="text"
+              required
+              value={player.username}
+              onChange={(e) => {
+                setPlayer({ ...player, username: e.target.value });
+              }}
+            />
+          </div>
+          <div>
+            <label>number (optional)</label>
+            <input
+              type="text"
+              value={player.number || ""}
+              onChange={(e) => {
+                setPlayer({ ...player, number: e.target.value });
+              }}
+            />
+          </div>
+          <div>
+            <label>email (optional)</label>
+            <input
+              type="email"
+              value={player.email || ""}
+              onChange={(e) => {
+                setPlayer({ ...player, email: e.target.value });
+              }}
+            />
+          </div>
+          <hr style={{ margin: "8px" }} />
+        </div>
+      );
+      break;
+  }
+
+  let passwordInputs = (
     <>
-      {user ? (
-        <h2> change your password </h2>
-      ) : (
-        <h2>
-          set your password,
-          <br />
-          {name}
-        </h2>
-      )}
-      {!user && username && (
-        <span>
-          your username is: <i>{username}</i>
-        </span>
-      )}
+      <div>
+        <input
+          type={visible ? "text" : "password"}
+          id="password"
+          name="password"
+          placeholder="password"
+          minLength={8}
+          value={password}
+          required
+          onChange={(evt) => {
+            setError("");
+            setPassword(evt.target.value);
+          }}
+        />
+      </div>
+      <div>
+        <input
+          type={visible ? "text" : "password"}
+          id="password-repeat"
+          name="password-repeat"
+          placeholder="repeat password"
+          minLength={8}
+          value={passwordr}
+          required
+          onChange={(evt) => {
+            setError("");
+            setPasswordr(evt.target.value);
+          }}
+        />
+      </div>
+    </>
+  );
+
+  return mode ? (
+    <>
+      {header}
+      <hr style={{ width: "100%" }} />
       <form onSubmit={handleSubmit}>
         <div
           style={{
             display: "flex",
             alignItems: "center",
+            justifyContent: "center",
+            flexDirection: "column",
           }}
         >
-          <div
-            style={{
-              marginLeft: "48px",
-              marginRight: "8px",
-              display: "flex",
-              justifyContent: "center",
-              flexDirection: "column",
-            }}
-          >
-            {user && (
-              <div>
-                <input
-                  type={visible ? "text" : "password"}
-                  id="password"
-                  name="password"
-                  placeholder="current password"
-                  minLength={8}
-                  value={currentPassword}
-                  required
-                  onChange={(evt) => {
-                    setError("");
-                    setCurrentPassword(evt.target.value);
-                  }}
-                />
-                <hr
-                  style={{
-                    margin: "8px",
-                    borderStyle: "inset",
-                    display: "block",
-                  }}
-                />
-              </div>
-            )}
-            <div>
-              <input
-                type={visible ? "text" : "password"}
-                id="password"
-                name="password"
-                placeholder="password"
-                minLength={8}
-                value={password}
-                required
-                onChange={(evt) => {
-                  setError("");
-                  setPassword(evt.target.value);
-                }}
-              />
-            </div>
-            <div>
-              <input
-                type={visible ? "text" : "password"}
-                id="password-repeat"
-                name="password-repeat"
-                placeholder="repeat password"
-                minLength={8}
-                value={passwordr}
-                required
-                onChange={(evt) => {
-                  setError("");
-                  setPasswordr(evt.target.value);
-                }}
-              />
-            </div>
-          </div>
+          {textInputs}
+          {passwordInputs}
           <div
             style={{
               background: "unset",
-              fontSize: "xx-large",
+              fontSize: "medium",
               cursor: "pointer",
+              display: "flex",
+              alignItems: "center",
+              gap: "8px",
             }}
             onClick={() => setVisible(!visible)}
           >
-            {visible ? <Eye /> : <EyeSlash />}
+            {visible ? <Eye /> : <EyeSlash />} show passwords
           </div>
         </div>
         <div>{error && <span style={{ color: "red" }}>{error}</span>}</div>
@@ -201,5 +334,7 @@ export const SetPassword = () => {
         {loading && <span className="loader" />}
       </form>
     </>
+  ) : (
+    <span className="loader" />
   );
 };

src/TeamPanel.tsx

@@ -0,0 +1,209 @@
+import { FormEvent, useEffect, useState } from "react";
+import { apiAuth, loadPlayers, User } from "./api";
+import { useSession } from "./Session";
+import { ErrorState } from "./types";
+import { useNavigate } from "react-router";
+
+const TeamPanel = () => {
+  const { user, teams } = useSession();
+  const navigate = useNavigate();
+  useEffect(() => {
+    user?.scopes.includes(`team:${teams?.activeTeam}`) ||
+      teams?.activeTeam === 42 ||
+      navigate("/", { replace: true });
+  }, [user]);
+  const newPlayerTemplate = {
+    id: 0,
+    username: "",
+    display_name: "",
+    number: "",
+    email: "",
+  } as User;
+  const [error, setError] = useState<ErrorState>();
+  const [players, setPlayers] = useState<User[] | null>(null);
+  const [player, setPlayer] = useState(newPlayerTemplate);
+
+  useEffect(() => {
+    if (teams) {
+      setError({ ok: true, message: "" });
+      loadPlayers(teams.activeTeam).then((data) => setPlayers(data));
+    }
+  }, [teams]);
+
+  async function handleSubmit(e: FormEvent) {
+    e.preventDefault();
+    if (teams) {
+      if (player.id === 0) {
+        const r = await apiAuth(`player/${teams?.activeTeam}`, player, "POST");
+        if (r.detail) setError({ ok: false, message: r.detail });
+        else {
+          setError({ ok: true, message: r });
+          loadPlayers(teams.activeTeam).then((data) => setPlayers(data));
+        }
+      } else {
+        const r = await apiAuth(`player/${teams?.activeTeam}`, player, "PUT");
+        if (r.detail) setError({ ok: false, message: r.detail });
+        else {
+          setError({ ok: true, message: r });
+          loadPlayers(teams.activeTeam).then((data) => setPlayers(data));
+        }
+      }
+    }
+  }
+
+  async function handleDisable(e: FormEvent) {
+    e.preventDefault();
+    if (teams && player.id !== 0) {
+      var confirmation = confirm("are you sure?");
+      if (confirmation) {
+        const r = await apiAuth(
+          `player/${teams?.activeTeam}`,
+          { player_id: player.id },
+          "DELETE"
+        );
+        if (r.detail) setError({ ok: false, message: r.detail });
+        else {
+          setError({ ok: true, message: r });
+          setPlayer(newPlayerTemplate);
+          loadPlayers(teams.activeTeam).then((data) => setPlayers(data));
+        }
+      }
+    }
+  }
+
+  if (teams && players) {
+    const activeTeam = teams.teams.filter(
+      (team) => team.id == teams?.activeTeam
+    )[0];
+    return (
+      <div className="team-panel">
+        <h1>{activeTeam.name}</h1>
+        <div>
+          <input type="text" value={activeTeam.location || ""} disabled />
+          <br />
+          <input type="text" value={activeTeam.country || ""} disabled />
+          <hr style={{ width: "100%" }} />
+
+          <h2>players</h2>
+          {players ? (
+            <div
+              style={{
+                display: "flex",
+                flexWrap: "wrap",
+                justifyContent: "center",
+              }}
+            >
+              {players &&
+                players.map((p) => (
+                  <button
+                    className="team-player"
+                    key={p.id}
+                    onClick={() => {
+                      setPlayer(p);
+                      setError({ ok: true, message: "" });
+                    }}
+                  >
+                    {p.display_name}
+                  </button>
+                ))}
+              <button
+                className="team-player new-player"
+                key="add-player"
+                onClick={() => {
+                  setPlayer(newPlayerTemplate);
+                  setError({ ok: true, message: "" });
+                }}
+              >
+                +
+              </button>
+            </div>
+          ) : (
+            <span className="loader" />
+          )}
+          <hr style={{ width: "100%" }} />
+
+          <form className="new-player-inputs" onSubmit={handleSubmit}>
+            <div>
+              <label>name</label>
+              <input
+                type="text"
+                required
+                value={player.display_name}
+                onChange={(e) => {
+                  setPlayer({
+                    ...player,
+                    display_name: e.target.value,
+                    username: e.target.value.toLowerCase().replace(/\W/g, ""),
+                  });
+                  setError({ ok: true, message: "" });
+                }}
+              />
+            </div>
+            <div>
+              <label>username</label>
+              <input
+                type="text"
+                required
+                disabled={player.id !== 0}
+                value={player.username}
+                onChange={(e) => {
+                  setPlayer({ ...player, username: e.target.value });
+                  setError({ ok: true, message: "" });
+                }}
+              />
+            </div>
+            <div>
+              <label>number (optional)</label>
+              <input
+                type="text"
+                value={player.number || ""}
+                onChange={(e) => {
+                  setPlayer({ ...player, number: e.target.value });
+                  setError({ ok: true, message: "" });
+                }}
+              />
+            </div>
+            <div>
+              <label>email (optional)</label>
+              <input
+                type="email"
+                value={player.email || ""}
+                onChange={(e) => {
+                  setPlayer({ ...player, email: e.target.value });
+                  setError({ ok: true, message: "" });
+                }}
+              />
+            </div>
+            <div style={{ margin: "auto" }}>
+              {error?.message && (
+                <span
+                  style={{
+                    color: error.ok ? "green" : "red",
+                  }}
+                >
+                  {error.message}
+                </span>
+              )}
+            </div>
+            <div style={{ margin: "auto" }}>
+              <button className="team-player new-player">
+                {player.id === 0 ? "add player" : "modify player"}
+              </button>
+            </div>
+            {player.id !== 0 && (
+              <div style={{ margin: "auto" }}>
+                <button
+                  className="team-player disable-player"
+                  onClick={handleDisable}
+                >
+                  remove player
+                </button>
+              </div>
+            )}
+          </form>
+        </div>
+      </div>
+    );
+  } else <span className="loader" />;
+};
+export default TeamPanel;

src/api.ts

@@ -1,5 +1,4 @@
 import { useSession } from "./Session";
-import { Team } from "./types";
 
 export const baseUrl = import.meta.env.VITE_BASE_URL as string;
 
@@ -48,9 +47,7 @@ export type User = {
   id: number;
   username: string;
   display_name: string;
-  full_name: string;
   email: string;
-  player_id: number;
   number: string;
   scopes: string;
 };
@@ -79,6 +76,16 @@ export async function currentUser(): Promise<User> {
   return resp.json() as Promise<User>;
 }
 
+export async function loadPlayers(teamId: number) {
+  try {
+    const data = await apiAuth(`player/${teamId}/list`, null, "GET");
+    return data as User[];
+  } catch (error) {
+    console.error(error);
+    return null;
+  }
+}
+
 export type LoginRequest = {
   username: string;
   password: string;

src/types.ts

@@ -34,7 +34,13 @@ export interface MVPRanking {
 }
 
 export interface Team {
+  id: number;
   name: string;
   location: string;
   country: string;
 }
+
+export type ErrorState = {
+  ok: boolean;
+  message: string;
+};