Allow using the api using team credentials

[RagnarGrootKoerkamp]

I think team credentials should be sufficient for the following endpoints (needed to merge scoreboards):

• /contests
• /contests/{cid}/problems
• /contests/{cid}/teams
• /contests/{cid}/organizations
• /contests/{cid}/scoreboard

Currently it's not possible to do this using team credentials, and a jury/admin account is needed.

In particular, this is needed when the scoreboard itself is private. This could also be solved by adding a new spectator role, which we discussing in CLICS at some point I think.

[eldering]

I think team credentials should be sufficient for the following endpoints (needed to merge scoreboards):

* `/contests`

I think this is fine to be available publicly, and thus also for the team role.

* `/contests/{cid}/problems`

This must be kept secret until contest start. Also, I think the timelimit and test_data_count should (maybe) be secret. Note that keeping things secret until a certain point will complicate the event feed, as it will now have to insert events for problems at that time. Also, we have to be very careful then to temporarily change the contest start time for testing purposes, as it might then already show up in the event feed early. A simple workaround is to not provide teams access to the event feed, as is currently already the case I think.

* `/contests/{cid}/teams`

I think it's fine to make this public. The only things that are sensitive are backup, desktop, etc, which we don't support anyways.

* `/contests/{cid}/organizations`

Fine to make publicly available.

* `/contests/{cid}/scoreboard`

Should be fine to make public, with the restrictions that it is not available before contest start, and that it shows a frozen scoreboard only.

Currently it's not possible to do this using team credentials, and a jury/admin account is needed.

In particular, this is needed when the scoreboard itself is private. This could also be solved by adding a new spectator role, which we discussing in CLICS at some point I think.

I think most of this should just be publicly available (that is, without any credentials, or maybe a role with public credentials) and then automatically for a team role as a consequence.

[nickygerritsen]

It seems this already works nowadays, if you have access to the contest, you can access these endpoints. Moreover, you can also access:

• submissions
• judgements for your own judgements
• clarifications send to all, from you or to you

I think this is exactly what we want, right?

I will close this issue but if something is missing, we can reopen.