"""
Roster API Endpoints
GET /api/v1/roster - Returns AthleteSchema array
"""
from typing import Optional, List
from datetime import datetime
from fastapi import APIRouter, Depends, HTTPException, Query, status, Request
from pydantic import BaseModel
from sqlalchemy.orm import Session
from sqlalchemy import and_, or_
from app.database import get_db
from app.models import Athlete, Case, School, User
from app.schemas import AthleteSchema, RosterResponse, AthleteCreate, AthleteUpdate
from app.utils.id_generator import generate_id
from app.auth import get_current_user, require_role, require_at_or_coach, require_coach
router = APIRouter(tags=["roster"])
============== VALIDATION HELPERS ==============
VALID_SEVERITY = {"mild", "moderate", "severe"}
VALID_STATUS = {"active", "resolved"}
VALID_ATTENTION_LEVELS = {"urgent", "warning", "stable"}
VALID_CURRENT_STATUS = {"cleared", "restricted", "out"}
def validate_enum(value: str, valid_set: set, field_name: str):
"""Validate enum values"""
if value not in valid_set:
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=f"Invalid {field_name}: '{value}'. Must be one of: {valid_set}"
)
============== ROUTER ENDPOINTS ==============
class RosterFilterParams(BaseModel):
"""Query parameters for roster filtering"""
school_id: str
sport: Optional[str] = None
team: Optional[str] = None
@router.get("", response_model=RosterResponse)
async def get_roster(
request: Request,
school_id: str = Query(..., description="School identifier for tenant isolation"),
sport: Optional[str] = Query(None, description="Filter by sport"),
team: Optional[str] = Query(None, description="Filter by team (e.g., Varsity)"),
current_user: User = Depends(require_at_or_coach),
db: Session = Depends(get_db),
):
"""
Get roster for a school
Role-based filtering:
- AT: Full access to all roster data
- Coach: Team-scoped only
- Parent: No access (403)
"""
role = current_user.role
# Validate school matches user's school (tenant isolation)
if current_user.school_id != school_id:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="Access denied for this school"
)
# Validate school exists
school = db.query(School).filter(School.id == school_id).first()
if not school:
raise HTTPException(
status_code=status.HTTP_404_NOT_FOUND,
detail=f"School '{school_id}' not found"
)
# Build query
query = db.query(Athlete).filter(Athlete.school_id == school_id)
# Coach: enforce sport and team scoping from user profile
if role == "coach":
assigned_sports = current_user.assigned_sports or []
assigned_teams = current_user.assigned_teams or []
# If sport param provided, verify coach is assigned to it
if sport and sport not in assigned_sports:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail=f"Coach not assigned to sport: {sport}"
)
# Filter to only assigned sports (if no sport param, show all assigned)
if not sport and assigned_sports:
# Use OR to match any of the coach's assigned sports
sport_filters = [Athlete.sports.contains([s]) for s in assigned_sports]
query = query.filter(or_(*sport_filters))
# Filter to assigned teams if specified
if assigned_teams:
query = query.filter(Athlete.team.in_(assigned_teams))
# Apply optional filters
if sport:
query = query.filter(Athlete.sports.contains([sport]))
if team:
query = query.filter(Athlete.team == team)
athletes = query.all()
return RosterResponse(
athletes=[AthleteSchema.model_validate(a) for a in athletes],
total=len(athletes),
school_id=school_id
)
@router.get("/{athlete_id}", response_model=AthleteSchema)
async def get_athlete(
request: Request,
athlete_id: str,
school_id: str = Query(..., description="School identifier for tenant isolation"),
current_user: User = Depends(require_at_or_coach),
db: Session = Depends(get_db),
):
"""Get single athlete by ID"""
role = current_user.role
# Validate school matches user's school
if current_user.school_id != school_id:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="Access denied for this school"
)
# Validate school exists
school = db.query(School).filter(School.id == school_id).first()
if not school:
raise HTTPException(
status_code=status.HTTP_404_NOT_FOUND,
detail=f"School '{school_id}' not found"
)
# Query athlete
athlete = db.query(Athlete).filter(
and_(Athlete.id == athlete_id, Athlete.school_id == school_id)
).first()
if not athlete:
raise HTTPException(
status_code=status.HTTP_404_NOT_FOUND,
detail=f"Athlete '{athlete_id}' not found"
)
# Coach: check sport and team access from user profile
if role == "coach":
assigned_sports = current_user.assigned_sports or []
assigned_teams = current_user.assigned_teams or []
# Check if athlete's sport is in coach's assigned sports
athlete_sports = athlete.sports or []
if assigned_sports and not any(s in assigned_sports for s in athlete_sports):
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="Coach does not have access to this athlete's sport"
)
# Check team access if teams are assigned
if assigned_teams and athlete.team not in assigned_teams:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="Coach does not have access to this athlete's team"
)
return AthleteSchema.model_validate(athlete)
@router.post("", response_model=AthleteSchema, status_code=status.HTTP_201_CREATED)
async def create_athlete(
request: Request,
athlete_data: AthleteCreate,
current_user: User = Depends(require_role(["at"])),
db: Session = Depends(get_db),
):
"""
Create a new athlete
Restricted to AT role
"""
# Validate user's school matches
if current_user.school_id != athlete_data.school_id:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="Cannot create athlete for different school"
)
# Validate school exists
school = db.query(School).filter(School.id == athlete_data.school_id).first()
if not school:
raise HTTPException(
status_code=status.HTTP_404_NOT_FOUND,
detail=f"School '{athlete_data.school_id}' not found"
)
# Validate grade
if athlete_data.grade < 9 or athlete_data.grade > 12:
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail="Grade must be between 9 and 12"
)
# Create athlete
athlete = Athlete(
id=generate_id("ath_"),
school_id=athlete_data.school_id,
first_name=athlete_data.first_name,
last_name=athlete_data.last_name,
grade=athlete_data.grade,
sports=athlete_data.sports or [],
team=athlete_data.team,
parent_ids=athlete_data.parent_ids or [],
current_status="cleared",
active_case_ids=[],
created_at=datetime.utcnow(),
updated_at=datetime.utcnow(),
)
db.add(athlete)
db.commit()
db.refresh(athlete)
return AthleteSchema.model_validate(athlete)
@router.patch("/{athlete_id}", response_model=AthleteSchema)
async def update_athlete(
request: Request,
athlete_id: str,
athlete_data: AthleteUpdate,
school_id: str = Query(..., description="School identifier"),
current_user: User = Depends(require_role(["at"])),
db: Session = Depends(get_db),
):
"""
Update an athlete
Restricted to AT role
"""
# Validate user's school matches
if current_user.school_id != school_id:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="Cannot update athlete in different school"
)
# Query athlete
athlete = db.query(Athlete).filter(
and_(Athlete.id == athlete_id, Athlete.school_id == school_id)
).first()
if not athlete:
raise HTTPException(
status_code=status.HTTP_404_NOT_FOUND,
detail=f"Athlete '{athlete_id}' not found"
)
# Update fields
if athlete_data.first_name is not None:
athlete.first_name = athlete_data.first_name
if athlete_data.last_name is not None:
athlete.last_name = athlete_data.last_name
if athlete_data.grade is not None:
if athlete_data.grade < 9 or athlete_data.grade > 12:
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail="Grade must be between 9 and 12"
)
athlete.grade = athlete_data.grade
if athlete_data.sports is not None:
athlete.sports = athlete_data.sports
if athlete_data.team is not None:
athlete.team = athlete_data.team
if athlete_data.parent_ids is not None:
athlete.parent_ids = athlete_data.parent_ids
athlete.updated_at = datetime.utcnow()
db.commit()
db.refresh(athlete)
return AthleteSchema.model_validate(athlete)
@router.delete("/{athlete_id}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_athlete(
request: Request,
athlete_id: str,
school_id: str = Query(..., description="School identifier"),
current_user: User = Depends(require_role(["at"])),
db: Session = Depends(get_db),
):
"""
Delete an athlete
Restricted to AT role
"""
# Validate user's school matches
if current_user.school_id != school_id:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="Cannot delete athlete in different school"
)
# Query athlete
athlete = db.query(Athlete).filter(
and_(Athlete.id == athlete_id, Athlete.school_id == school_id)
).first()
if not athlete:
raise HTTPException(
status_code=status.HTTP_404_NOT_FOUND,
detail=f"Athlete '{athlete_id}' not found"
)
db.delete(athlete)
db.commit()
return None