show all known athletes for session on sync page

src/db.rs

@@ -122,6 +122,54 @@ pub async fn session_athlete(db: &PgPool, token: &str) -> Result<Option<SessionA
     }))
 }
 
+/// Return all locally known athletes that use the same credential as the
+/// current session.
+///
+/// Intervals.icu does not expose an API endpoint that enumerates every
+/// athlete a credential can access. Therefore this is the set of athletes
+/// already known to this application for the credential. The owner of the
+/// credential is included naturally because the login creates that row.
+pub async fn session_accessible_athletes(
+    db: &PgPool,
+    token: &str,
+) -> Result<Vec<SessionAthlete>> {
+    let hash = hash_token(token);
+
+    let rows = sqlx::query(
+        r#"
+        SELECT DISTINCT
+            a.id,
+            a.intervals_athlete_id,
+            a.display_name,
+            a.access_token
+        FROM sessions s
+        JOIN athletes current_athlete
+          ON current_athlete.id = s.athlete_id
+        JOIN athletes a
+          ON a.access_token = current_athlete.access_token
+        WHERE s.token_hash = $1
+          AND s.created_at > now() - interval '1 day'
+        ORDER BY a.display_name, a.intervals_athlete_id
+        "#,
+    )
+    .bind(&hash)
+    .fetch_all(db)
+    .await?;
+
+    use sqlx::Row;
+
+    rows.into_iter()
+        .map(|row| {
+            Ok(SessionAthlete {
+                id: row.try_get("id")?,
+                intervals_athlete_id: row.try_get("intervals_athlete_id")?,
+                display_name: row.try_get("display_name")?,
+                access_token: row.try_get("access_token")?,
+            })
+        })
+        .collect()
+}
+
 /// Return the start time of the most recently imported activity
 /// for an athlete.
 ///