Allow same-team clip reads in gameday

backend/app/routes/media.py

@@ -54,6 +54,26 @@ def resolve_media_scope(
     return session.external_team_id, session.external_player_id
 
 
+def resolve_media_read_scope(
+    session: UserSession,
+    *,
+    requested_team_id: str | None = None,
+    requested_player_id: str | None = None,
+) -> tuple[str, str | None]:
+    if session.is_admin:
+        team_id = requested_team_id or session.external_team_id
+        player_id = requested_player_id if requested_player_id is not None else session.external_player_id
+        if not team_id:
+            raise HTTPException(status_code=422, detail="Select a team before viewing media")
+        return team_id, player_id
+
+    if not session.external_team_id:
+        raise HTTPException(status_code=422, detail="Select a team before viewing media")
+    if requested_team_id and requested_team_id != session.external_team_id:
+        raise HTTPException(status_code=403, detail="This team does not match your selected session")
+    return session.external_team_id, requested_player_id
+
+
 def clip_to_response(clip: AudioClip) -> AudioClipResponse:
     normalized_url = f"/media/files/{clip.normalized_path}" if clip.normalized_path else None
     waveform = storage.load_or_generate_waveform(clip.asset.storage_path)
@@ -452,7 +472,7 @@ def list_clips(
     session: UserSession = Depends(require_session),
     db: Session = Depends(get_db),
 ) -> list[AudioClipResponse]:
-    external_team_id, owner_external_player_id = resolve_media_scope(
+    external_team_id, owner_external_player_id = resolve_media_read_scope(
         session,
         requested_team_id=external_team_id,
         requested_player_id=owner_external_player_id,