Countdown time not exposed properly

[Not-Baguette]

Description of the problem

API_READER role is required to see the countdown due to the countdown not being exposed properly. The API is exposable through /contest/team.html

Your environment

• Domjudge 9.0.0
• Ubuntu
• nginx

Steps to reproduce

1. Initialize Domjudge
2. Set up a contest
3. Make a frontend that does not use domjudge's propetiary web
4. Call /contest/{cid} during activation time before starting time

Expected behaviour

Time should be given like so

{"formal_name":XXXX","scoreboard_type":"scoring","start_time":"2026-04-30T11:00:00+00:00","end_time":"2026-04-30T13:30:00+00:00","scoreboard_thaw_time":"2026-05-01T11:00:00+00:00","duration":"2:30:00.000","scoreboard_freeze_duration":"1:00:00.000","cid":4,"id":"dj-4","name":"UMNPC Internal Contest 2026","shortname":"IC26","allow_submit":true,"runtime_as_score_tiebreaker":true,"warning_message":null,"penalty_time":20}

Actual behaviour

404

Any other information that you want to share?

I'm pretty sure it is caused by abstractapicontroller.php on line 49 if condition checking if the user has API_READER role. Might push a fix

[Not-Baguette]

Nevermind, tried changing it on abstractapicontroller.php but it still wouldnt expose the endpoint on contest before starting time. Easiest workaround is literally to fetch contest/team and get the time from there. I'll try to look around if I can expose the endpoint properly without causing issue

[vmcj]

Can you verify that you have the same problem in demoweb? I checked with the current branch and I can´t reproduce this, so either we already fixed it (and I think we did with 0c7db21) or you'll need to make the instructions for recreating the issue a bit more clear.

[Not-Baguette]

@vmcj Hi, while I can't send you a more detailed response for now due to me being busy. Looking at the commit it might be the fix, I did manage to replicate and pinpoint the issue last night to that and I think stable 9.0.0 has not pushed the fix yet. I apologise for the instructions. I'll try to patch the domjudge to that commit and update you on it approximately in a day or less. However for the steps, it is quite simple:

1. Make an account without API_READER role to simulate normal team member
2. Make a contest that is in activation time but not yet on starting time
3. Log into that account on a separate browser session (as admin token does have API_READER)
4. Call the /contest/{cid} endpoint directly via browser e.g. https://something.com/domjudge/api/v4/contest/dj-4
5. It should return 404 rather than the countdown without API_READER role being given