Implement account management features in API, including endpoints for listing accounts and updating account roles. Introduce moderator role with associated permissions, and refactor access control checks to accommodate staff roles. Update database schema to support new role constraints and enhance frontend navigation for staff access.

backend/internal/adapter/httpapi/workflow_handlers.go

@@ -79,6 +79,48 @@ func (s *Server) swapRoster(w http.ResponseWriter, r *http.Request) {
 	respond(w, out, err, http.StatusOK)
 }
 
+func (s *Server) moveRosterPlayer(w http.ResponseWriter, r *http.Request) {
+	var in struct {
+		FromTeamID      string      `json:"fromTeamId"`
+		PlayerID        string      `json:"playerId"`
+		ToTeamID        string      `json:"toTeamId"`
+		Role            domain.Role `json:"role"`
+		ExpectedVersion int         `json:"expectedVersion"`
+	}
+	if !decode(w, r, &in) {
+		return
+	}
+	out, err := s.service.MoveRosterPlayer(r.Context(), who(r).account, chi.URLParam(r, "eventID"), in.FromTeamID, in.PlayerID, in.ToTeamID, in.Role, in.ExpectedVersion)
+	respond(w, out, err, http.StatusOK)
+}
+
+func (s *Server) placeReservePlayer(w http.ResponseWriter, r *http.Request) {
+	var in struct {
+		TeamID          string      `json:"teamId"`
+		ReservePlayerID string      `json:"reservePlayerId"`
+		Role            domain.Role `json:"role"`
+		ExpectedVersion int         `json:"expectedVersion"`
+	}
+	if !decode(w, r, &in) {
+		return
+	}
+	out, err := s.service.PlaceReservePlayer(r.Context(), who(r).account, chi.URLParam(r, "eventID"), in.TeamID, in.ReservePlayerID, in.Role, in.ExpectedVersion)
+	respond(w, out, err, http.StatusOK)
+}
+
+func (s *Server) removeRosterPlayer(w http.ResponseWriter, r *http.Request) {
+	var in struct {
+		TeamID          string `json:"teamId"`
+		PlayerID        string `json:"playerId"`
+		ExpectedVersion int    `json:"expectedVersion"`
+	}
+	if !decode(w, r, &in) {
+		return
+	}
+	out, err := s.service.RemoveRosterPlayer(r.Context(), who(r).account, chi.URLParam(r, "eventID"), in.TeamID, in.PlayerID, in.ExpectedVersion)
+	respond(w, out, err, http.StatusOK)
+}
+
 func (s *Server) substituteRoster(w http.ResponseWriter, r *http.Request) {
 	s.handleSubstitute(w, r, false)
 }
@@ -126,6 +168,17 @@ func (s *Server) confirmRosters(w http.ResponseWriter, r *http.Request) {
 	respond(w, out, err, http.StatusOK)
 }
 
+func (s *Server) revertWorkflowStage(w http.ResponseWriter, r *http.Request) {
+	var in struct {
+		ExpectedVersion int `json:"expectedVersion"`
+	}
+	if !decode(w, r, &in) {
+		return
+	}
+	out, err := s.service.RevertWorkflowStage(r.Context(), who(r).account, chi.URLParam(r, "eventID"), in.ExpectedVersion)
+	respond(w, out, err, http.StatusOK)
+}
+
 func (s *Server) startScrim(w http.ResponseWriter, r *http.Request) {
 	var in struct {
 		ExpectedVersion int `json:"expectedVersion"`