Add admin/user view toggle to scoreboard

- Admin submissions endpoint at /api/scoreboard/submissions/admin
- Public endpoint filters out admin users and pre-start submissions
- Toggle in scoreboard header switches between views (admin only)

Author: Nils Bars

spa-frontend/src/api/scoreboard.ts

@@ -39,3 +39,7 @@ export function getScoreboardConfig(): Promise<ScoreboardConfig> {
 export function getScoreboardSubmissions(): Promise<SubmissionsByChallenge> {
   return apiGet<SubmissionsByChallenge>('/api/scoreboard/submissions');
 }
+
+export function getScoreboardSubmissionsAdmin(): Promise<SubmissionsByChallenge> {
+  return apiGet<SubmissionsByChallenge>('/api/scoreboard/submissions/admin');
+}

spa-frontend/src/pages/Scoreboard.vue

@@ -9,10 +9,12 @@ import {
 import {
   getScoreboardConfig,
   getScoreboardSubmissions,
+  getScoreboardSubmissionsAdmin,
   type ScoreboardConfig,
   type SubmissionsByChallenge,
   type ChallengeCfg,
 } from '../api/scoreboard';
+import { useAuthStore } from '../stores/auth';
 import { strategy } from '../ranking';
 import {
   computeAssignmentStartTimes,
@@ -27,6 +29,9 @@ import Countdown from '../components/scoreboard/Countdown.vue';
 
 const POLL_INTERVAL_MS = 5000;
 
+const auth = useAuthStore();
+const adminView = ref(false);
+
 const config = ref<ScoreboardConfig | null>(null);
 const submissions = ref<SubmissionsByChallenge>({});
 const error = ref<string | null>(null);
@@ -40,9 +45,12 @@ let pollTimer: number | undefined;
 
 async function refresh() {
   try {
+    const fetchSubs = adminView.value
+      ? getScoreboardSubmissionsAdmin()
+      : getScoreboardSubmissions();
     const [cfg, subs] = await Promise.all([
       getScoreboardConfig(),
-      getScoreboardSubmissions(),
+      fetchSubs,
     ]);
     config.value = cfg;
     submissions.value = subs;
@@ -57,6 +65,11 @@ async function refresh() {
   }
 }
 
+function toggleAdminView() {
+  adminView.value = !adminView.value;
+  refresh();
+}
+
 onMounted(async () => {
   await refresh();
   pollTimer = window.setInterval(refresh, POLL_INTERVAL_MS);
@@ -127,7 +140,7 @@ const assignmentBoundaries = computed(() => {
   if (!config.value) return [];
   const now = Date.now();
   return computeAssignmentStartTimes(assignments.value).filter(
-    (d) => d.getTime() <= now,
+    (b) => b.date.getTime() <= now,
   );
 });
 
@@ -193,6 +206,11 @@ const challengeRanking = computed(() => {
           <span class="term-live-dot" />LIVE
         </span>
         <span class="term-eyebrow term-hot">{{ config.course_name }}</span>
+        <a
+          v-if="auth.isAdmin"
+          class="term-view-toggle"
+          @click.prevent="toggleAdminView"
+        >{{ adminView ? '[ admin view ]' : '[ user view ]' }}</a>
       </div>
       <h1
         class="term-display term-hot-glow"
@@ -292,3 +310,20 @@ const challengeRanking = computed(() => {
     </section>
   </div>
 </template>
+
+<style scoped>
+.term-view-toggle {
+  margin-left: auto;
+  font-family: var(--term-font-mono);
+  font-size: 0.75rem;
+  letter-spacing: 0.15em;
+  color: rgb(var(--v-theme-secondary));
+  cursor: pointer;
+  user-select: none;
+  transition: color 150ms ease;
+}
+.term-view-toggle:hover {
+  color: rgb(var(--v-theme-primary));
+  text-shadow: 0 0 10px rgba(var(--v-theme-hot-glow), var(--v-hot-glow-alpha));
+}
+</style>

webapp/ref/frontend_api/scoreboard.py

@@ -154,35 +154,16 @@ def api_scoreboard_config():
     )
 
 
-@refbp.route("/api/scoreboard/submissions", methods=("GET",))
-@limiter.limit("20 per minute")
-def api_scoreboard_submissions():
-    """Team-grouped submission scores with per-task breakdown.
-
-    Response shape::
+def _collect_submissions(*, include_admins: bool) -> dict:
+    """Build the challenge -> team -> entries mapping.
 
-        {
-          "<short_name>": {
-            "<team label>": [
-              {
-                "ts": "DD/MM/YYYY HH:MM:SS",
-                "score": <float>,
-                "tasks": {"<task_name>": <float | null>, ...}
-              },
-              ...
-            ]
-          }
-        }
-
-    ``tasks`` values are ``null`` for tasks whose underlying raw score was
-    ``None`` (bool-returning tests). Such tasks contribute 0 to ``score``.
+    When *include_admins* is ``False``, submissions by admin users are
+    silently skipped and submissions before the assignment start time
+    are excluded so the public scoreboard only shows student work
+    within the configured window.
     """
-    _scoreboard_enabled_or_abort()
-
     scores: dict[str, dict[str, list[dict]]] = defaultdict(lambda: defaultdict(list))
 
-    # Eager-load test results; we always read them now that multi-task
-    # submissions are supported.
     submissions = Submission.query.options(
         selectinload(Submission.submission_test_results)
     ).all()
@@ -191,25 +172,32 @@ def api_scoreboard_submissions():
         instance = submission.origin_instance
         if instance is None:
             continue
+        user = instance.user
+        if user is None:
+            continue
+        if not include_admins and user.is_admin:
+            continue
         exercise = instance.exercise
         if exercise is None:
             continue
         cfg = exercise.config
         if cfg is None or cfg.category is None:
             continue
 
+        if not include_admins and cfg.submission_deadline_start:
+            if submission.submission_ts < cfg.submission_deadline_start:
+                continue
+
         if not submission.submission_test_results:
-            # Nothing was tested — no meaningful score to plot.
             continue
 
         total, breakdown = score_submission(
             submission.submission_test_results,
             cfg.per_task_scoring_policies,
         )
         if not breakdown:
-            # Every task was discarded; nothing to show for this submission.
             continue
-        team = team_identity(instance.user)
+        team = team_identity(user)
         scores[exercise.short_name][team].append(
             {
                 "ts": datetime_to_string(submission.submission_ts),
@@ -222,4 +210,51 @@ def api_scoreboard_submissions():
         for entries in challenge.values():
             entries.sort(key=lambda e: e["ts"])
 
-    return jsonify(scores)
+    return scores
+
+
+@refbp.route("/api/scoreboard/submissions", methods=("GET",))
+@limiter.limit("120 per minute")
+def api_scoreboard_submissions():
+    """Team-grouped submission scores with per-task breakdown.
+
+    Response shape::
+
+        {
+          "<short_name>": {
+            "<team label>": [
+              {
+                "ts": "DD/MM/YYYY HH:MM:SS",
+                "score": <float>,
+                "tasks": {"<task_name>": <float | null>, ...}
+              },
+              ...
+            ]
+          }
+        }
+
+    ``tasks`` values are ``null`` for tasks whose underlying raw score was
+    ``None`` (bool-returning tests). Such tasks contribute 0 to ``score``.
+
+    Submissions by admin users are excluded from the public scoreboard.
+    """
+    _scoreboard_enabled_or_abort()
+    return jsonify(_collect_submissions(include_admins=False))
+
+
+@refbp.route("/api/scoreboard/submissions/admin", methods=("GET",))
+@limiter.limit("120 per minute")
+def api_scoreboard_submissions_admin():
+    """Admin variant: includes submissions by admin users.
+
+    Requires an authenticated admin session; returns 403 otherwise.
+    Same response shape as the public endpoint.
+    """
+    from flask_login import current_user
+
+    _scoreboard_enabled_or_abort()
+
+    if not current_user.is_authenticated or not current_user.is_admin:
+        abort(403)
+
+    return jsonify(_collect_submissions(include_admins=True))