feat: implement Phase 1 & 2 backend features + frontend integration

Phase 1 - Backend Quick Fixes:
- Wire streak achievement into CheckAndAwardAchievements
- Add writeup upvote display (vote status endpoint + sort by upvotes)
- Add challenge search & filter API (category, difficulty, tag, search)
- Add submission history endpoint (GET /submissions/my)
- Add team leadership transfer endpoint
- Add account deletion (soft delete) + GDPR data export

Phase 2 - New Backend Features:
- Solo leaderboard for users without teams (GET /leaderboard/solo)
- CTFd format export for interoperable challenges (GET /admin/export/ctfd)
- Scoreboard export as CSV/JSON for collaborators
- Discord/Slack webhook integration service
- Practice mode / archive for unscored past challenges
- Per-contest analytics for collaborators (solve rates, category breakdown)
- Challenge difficulty rating by users (1-5 stars, solver-only)
- Email notifications for solve/contest events

Frontend:
- Updated ChallengeService, TeamService, AuthService, ScoreboardService,
  CollaboratorService with new API methods
- Added Danger Zone UI to account settings (delete + export)

Lint fixes:
- Remove vestigial nil!=nil checks from MongoDB migration
- Replace loop copy with copy() builtin (S1001)
- Remove redundant non-nil check after early return

Author: Uttam-Mahata

backend/internal/config/config.go

@@ -55,6 +55,9 @@ type Config struct {
 	R2SecretAccessKey string
 	R2BucketName      string
 	R2PublicURL       string // e.g. "https://pub-xxx.r2.dev" or custom domain — used as URL prefix for uploaded files
+	// Webhook integration
+	DiscordWebhookURL string
+	SlackWebhookURL   string
 }
 
 func LoadConfig() *Config {
@@ -116,6 +119,8 @@ func LoadConfig() *Config {
 		R2SecretAccessKey:          getEnv("R2_SECRET_ACCESS_KEY", ""),
 		R2BucketName:               getEnv("R2_BUCKET_NAME", "rootaccess"),
 		R2PublicURL:                getEnv("R2_PUBLIC_URL", ""),
+		DiscordWebhookURL:          getEnv("DISCORD_WEBHOOK_URL", ""),
+		SlackWebhookURL:            getEnv("SLACK_WEBHOOK_URL", ""),
 	}
 }
 

backend/internal/database/schema.go

@@ -292,6 +292,14 @@ func BootstrapSchema(db *sql.DB) {
 			used_at TEXT,
 			created_at TEXT NOT NULL
 		);`,
+		// Challenge Difficulty Ratings
+		`CREATE TABLE IF NOT EXISTS challenge_ratings (
+			id TEXT PRIMARY KEY,
+			challenge_id TEXT NOT NULL REFERENCES challenges(id) ON DELETE CASCADE,
+			user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+			rating INTEGER NOT NULL CHECK(rating >= 1 AND rating <= 5),
+			UNIQUE(challenge_id, user_id)
+		);`,
 	}
 
 	for _, stmt := range schemas {

backend/internal/handlers/account_handler.go

@@ -0,0 +1,181 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/Uttam-Mahata/RootAccess/backend/internal/repositories"
+	"github.com/Uttam-Mahata/RootAccess/backend/internal/utils"
+	"github.com/gin-gonic/gin"
+)
+
+type AccountHandler struct {
+	userRepo       *repositories.UserRepository
+	teamRepo       *repositories.TeamRepository
+	submissionRepo *repositories.SubmissionRepository
+	achievementRepo *repositories.AchievementRepository
+	writeupRepo    *repositories.WriteupRepository
+}
+
+func NewAccountHandler(
+	userRepo *repositories.UserRepository,
+	teamRepo *repositories.TeamRepository,
+	submissionRepo *repositories.SubmissionRepository,
+	achievementRepo *repositories.AchievementRepository,
+	writeupRepo *repositories.WriteupRepository,
+) *AccountHandler {
+	return &AccountHandler{
+		userRepo:        userRepo,
+		teamRepo:        teamRepo,
+		submissionRepo:  submissionRepo,
+		achievementRepo: achievementRepo,
+		writeupRepo:     writeupRepo,
+	}
+}
+
+// DeleteAccount allows a user to soft-delete their own account
+// @Summary Delete my account
+// @Description Self-service account deletion. Sets the account status to 'deleted'. This is a soft delete.
+// @Tags Account
+// @Produce json
+// @Success 200 {object} map[string]string
+// @Failure 400 {object} map[string]string
+// @Security ApiKeyAuth
+// @Router /auth/account [delete]
+func (h *AccountHandler) DeleteAccount(c *gin.Context) {
+	userIDStr, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
+		return
+	}
+	userID := userIDStr.(string)
+
+	// Check if user is a team leader — they must transfer leadership first
+	if h.teamRepo != nil {
+		team, err := h.teamRepo.FindTeamByMemberID(userID)
+		if err == nil && team != nil && team.LeaderID == userID {
+			memberCount, _ := h.teamRepo.GetTeamMemberCount(team.ID)
+			if memberCount > 1 {
+				c.JSON(http.StatusBadRequest, gin.H{
+					"error": "You are the leader of a team with other members. Please transfer leadership or disband your team before deleting your account.",
+				})
+				return
+			}
+		}
+	}
+
+	// Prevent admins from self-deleting
+	role, _ := c.Get("role")
+	if role == "admin" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Admins cannot self-delete their account. Please ask another admin to demote you first."})
+		return
+	}
+
+	// Soft delete — set status to "deleted"
+	err := h.userRepo.UpdateFields(userID, map[string]interface{}{"status": "deleted"})
+	if err != nil {
+		utils.RespondWithError(c, http.StatusInternalServerError, "Failed to delete account", err)
+		return
+	}
+
+	// Clear the auth cookie
+	isProd := c.GetHeader("X-Forwarded-Proto") == "https"
+	if isProd {
+		c.SetSameSite(http.SameSiteNoneMode)
+	} else {
+		c.SetSameSite(http.SameSiteLaxMode)
+	}
+	c.SetCookie("auth_token", "", -1, "/", "", isProd, true)
+
+	c.JSON(http.StatusOK, gin.H{"message": "Account deleted successfully. Your data has been deactivated."})
+}
+
+// ExportAccountData exports the user's data as JSON (GDPR-compliant data export)
+// @Summary Export my account data
+// @Description Export all personal data associated with the authenticated user's account in JSON format.
+// @Tags Account
+// @Produce json
+// @Success 200 {object} map[string]interface{}
+// @Security ApiKeyAuth
+// @Router /auth/account/export [get]
+func (h *AccountHandler) ExportAccountData(c *gin.Context) {
+	userIDStr, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
+		return
+	}
+	userID := userIDStr.(string)
+
+	export := make(map[string]interface{})
+
+	// User profile
+	user, err := h.userRepo.FindByID(userID)
+	if err != nil {
+		utils.RespondWithError(c, http.StatusInternalServerError, "Failed to retrieve user data", err)
+		return
+	}
+	export["profile"] = map[string]interface{}{
+		"id":             user.ID,
+		"username":       user.Username,
+		"email":          user.Email,
+		"role":           user.Role,
+		"email_verified": user.EmailVerified,
+		"status":         user.Status,
+		"oauth_provider": user.OAuthProvider,
+		"created_at":     user.CreatedAt,
+		"updated_at":     user.UpdatedAt,
+	}
+
+	// Team membership
+	if h.teamRepo != nil {
+		team, err := h.teamRepo.FindTeamByMemberID(userID)
+		if err == nil && team != nil {
+			export["team"] = map[string]interface{}{
+				"id":        team.ID,
+				"name":      team.Name,
+				"is_leader": team.LeaderID == userID,
+			}
+		}
+	}
+
+	// Submissions
+	if h.submissionRepo != nil {
+		subs, err := h.submissionRepo.GetUserSubmissions(userID)
+		if err == nil {
+			subEntries := make([]map[string]interface{}, 0, len(subs))
+			for _, s := range subs {
+				subEntries = append(subEntries, map[string]interface{}{
+					"challenge_id": s.ChallengeID,
+					"contest_id":   s.ContestID,
+					"is_correct":   s.IsCorrect,
+					"timestamp":    s.Timestamp,
+				})
+			}
+			export["submissions"] = subEntries
+		}
+	}
+
+	// Achievements
+	if h.achievementRepo != nil {
+		achievements, err := h.achievementRepo.GetByUserID(userID)
+		if err == nil {
+			export["achievements"] = achievements
+		}
+	}
+
+	// Writeups
+	if h.writeupRepo != nil {
+		writeups, err := h.writeupRepo.GetWriteupsByUser(userID)
+		if err == nil {
+			export["writeups"] = writeups
+		}
+	}
+
+	// Set content disposition for download
+	c.Header("Content-Disposition", "attachment; filename=account_export.json")
+	c.Header("Content-Type", "application/json")
+
+	encoder := json.NewEncoder(c.Writer)
+	encoder.SetIndent("", "  ")
+	encoder.Encode(export)
+}

backend/internal/handlers/challenge_handler.go

@@ -360,6 +360,92 @@ type ChallengePublicResponse struct {
 	OfficialWriteupFormat string   `json:"official_writeup_format,omitempty"`
 }
 
+// SearchChallenges searches challenges with query params: category, difficulty, tag, search
+// @Summary Search challenges
+// @Description Search and filter challenges by category, difficulty, tag, and text search.
+// @Tags Challenges
+// @Produce json
+// @Param category query string false "Filter by category"
+// @Param difficulty query string false "Filter by difficulty"
+// @Param tag query string false "Filter by tag"
+// @Param search query string false "Text search in title and description"
+// @Success 200 {array} ChallengePublicResponse
+// @Failure 500 {object} map[string]string
+// @Security ApiKeyAuth
+// @Router /challenges/search [get]
+func (h *ChallengeHandler) SearchChallenges(c *gin.Context) {
+	filter := repositories.ChallengeFilter{
+		Category:   c.Query("category"),
+		Difficulty: c.Query("difficulty"),
+		Tag:        c.Query("tag"),
+		Search:     c.Query("search"),
+	}
+
+	challenges, err := h.challengeService.SearchChallenges(filter)
+	if err != nil {
+		utils.RespondWithError(c, http.StatusInternalServerError, err.Error(), err)
+		return
+	}
+
+	// Determine current user
+	var userID string
+	if userIDStr, exists := c.Get("user_id"); exists {
+		userID = userIDStr.(string)
+	}
+
+	var result []ChallengePublicResponse
+	for _, ch := range challenges {
+		if !ch.IsPublished {
+			continue
+		}
+		isSolved := false
+		if h.submissionRepo != nil && userID != "" {
+			if sub, _ := h.submissionRepo.FindByChallengeAndUser(ch.ID, userID); sub != nil {
+				isSolved = true
+			}
+		}
+
+		result = append(result, ChallengePublicResponse{
+			ID:                ch.ID,
+			Title:             ch.Title,
+			Description:       ch.Description,
+			DescriptionFormat: ch.DescriptionFormat,
+			Category:          ch.Category,
+			Difficulty:        ch.Difficulty,
+			MaxPoints:         ch.MaxPoints,
+			CurrentPoints:     ch.CurrentPoints(),
+			ScoringType:       ch.ScoringType,
+			SolveCount:        ch.SolveCount,
+			Files:             ch.Files,
+			Tags:              ch.Tags,
+			HintCount:         len(ch.Hints),
+			IsSolved:          isSolved,
+		})
+	}
+
+	c.JSON(http.StatusOK, result)
+}
+
+// GetCategories returns all distinct challenge categories
+// @Summary Get challenge categories
+// @Description Retrieve a list of all unique challenge categories for filtering.
+// @Tags Challenges
+// @Produce json
+// @Success 200 {array} string
+// @Security ApiKeyAuth
+// @Router /challenges/categories [get]
+func (h *ChallengeHandler) GetCategories(c *gin.Context) {
+	categories, err := h.challengeService.GetDistinctCategories()
+	if err != nil {
+		utils.RespondWithError(c, http.StatusInternalServerError, err.Error(), err)
+		return
+	}
+	if categories == nil {
+		categories = []string{}
+	}
+	c.JSON(http.StatusOK, categories)
+}
+
 // GetAllChallenges returns all challenges for users (filtered by active contest/round visibility)
 // @Summary Get all challenges
 // @Description Retrieve a list of all published challenges with public details (no flags).
@@ -819,7 +905,7 @@ func (h *ChallengeHandler) GetContestChallenges(c *gin.Context) {
 			if sub, _ := h.submissionRepo.FindByChallengeAndUserInContest(ch.ID, userID, contestID); sub != nil {
 				isSolved = true
 			}
-			if !isSolved && teamID != nil && *teamID != "" {
+			if !isSolved && *teamID != "" {
 				if teamSub, _ := h.submissionRepo.FindByChallengeAndTeamInContest(ch.ID, *teamID, contestID); teamSub != nil {
 					isSolved = true
 				}