API: Update Broadcast round - set period not work

[SergioGlorias]

Exact URL of where the bug happened

API: https://lichess.org/broadcast/round/{broadcastRoundId}/edit

Steps to reproduce the bug

1. have StudyAdmin permission
2. create a broadcast with at least 1 round
3. try editing via API defined period

What did you expect to happen?

period should be defined

What happened instead?

the data is empty

Operating system

Chrome OS (but it was also tested on windows)

Browser and version (or alternate access method)

Python, N8N, Javascript

Additional information

No response

[tors42]

Most likely mod scope missing on token

[kraktus]

still happening?

[tors42]

It seems to me that it is possible to update the period value via API.

The user account needs to be a Study/Broadcast Admin,
and the token that the user account uses to access the API needs to have the scopes web:mod, study:write and study:read (possibly ok without study:read)

Here's an example which creates a broadcast round with a period (42s),
and then updates the round with a new period (20s),
https://gist.github.com/tors42/49b74ee441a767f9e7e7bfc528fe8085

[SergioGlorias]

As expected, a Studyadmin does not have access to web:mod
(to create a token)

@ornicar The period that is necessary for broadcasters

lila/modules/oauth/src/main/ui/TokenUi.scala

Lines 117 to 120 in 3d248d8

	val hidden =
	scope == OAuthScope.Web.Mod && !(
	Granter.opt(_.Shusher) || Granter.opt(_.BoostHunter) || Granter.opt(_.CheatHunter)
	)