fix: resolve 15 backend bugs across security, logic, and code quality

Critical fixes:
- Fix scoreboard export producing wrong rankings (missing sort)
- Auth middleware now rejects banned/deleted users via Redis-cached
  DB status check, preventing stale JWT abuse for up to 7 days
- Practice mode now excludes active contest challenges to prevent
  leaking live challenge data
- Fix IsChallengeVisible returning stale err variable

Medium fixes:
- SearchChallenges now enforces contest visibility (was leaking
  active contest challenges via search endpoint)
- Fix CSV injection in scoreboard export (escape team name quotes)
- Fix solo leaderboard including users with 0 distinct solves
  (len(subs) → len(seen))
- Contest analytics now validates collaborator_contest_id to prevent
  cross-contest unauthorized queries
- Fix AdjustUserScoreRequest.Delta binding:required rejecting 0
  with wrong error message

Low/cleanup fixes:
- Replace custom parseInt with strconv.Atoi (overflow protection)
- Inline all dead oid/objID variable aliases from MongoDB migration
  across contest_admin_service, hint_service, team_service,
  admin_user_handler
- Handle ignored encoder.Encode errors in export and account handlers
- Add 10s timeout to webhook HTTP client to prevent goroutine leaks

Author: Uttam-Mahata

backend/internal/handlers/account_handler.go

@@ -177,5 +177,7 @@ func (h *AccountHandler) ExportAccountData(c *gin.Context) {
 
 	encoder := json.NewEncoder(c.Writer)
 	encoder.SetIndent("", "  ")
-	encoder.Encode(export)
+	if err := encoder.Encode(export); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to encode export data"})
+	}
 }

backend/internal/handlers/admin_user_handler.go

@@ -177,8 +177,7 @@ type UpdateUserStatusRequest struct {
 // @Router /admin/users/{id}/status [put]
 func (h *AdminUserHandler) UpdateUserStatus(c *gin.Context) {
 	id := c.Param("id")
-	objID := id
-	if objID == "" {
+	if id == "" {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid user ID"})
 		return
 	}
@@ -192,7 +191,7 @@ func (h *AdminUserHandler) UpdateUserStatus(c *gin.Context) {
 		return
 	}
 	update := map[string]interface{}{"status": req.Status, "ban_reason": req.BanReason}
-	err := h.userRepo.UpdateFields(objID, update)
+	err := h.userRepo.UpdateFields(id, update)
 	if err != nil {
 		utils.RespondWithError(c, http.StatusInternalServerError, err.Error(), err)
 		return
@@ -218,8 +217,7 @@ type UpdateUserRoleRequest struct {
 // @Router /admin/users/{id}/role [put]
 func (h *AdminUserHandler) UpdateUserRole(c *gin.Context) {
 	id := c.Param("id")
-	objID := id
-	if objID == "" {
+	if id == "" {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid user ID"})
 		return
 	}
@@ -240,7 +238,7 @@ func (h *AdminUserHandler) UpdateUserRole(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid role. Must be 'admin' or 'user'"})
 		return
 	}
-	err := h.userRepo.UpdateFields(objID, map[string]interface{}{"role": req.Role})
+	err := h.userRepo.UpdateFields(id, map[string]interface{}{"role": req.Role})
 	if err != nil {
 		utils.RespondWithError(c, http.StatusInternalServerError, err.Error(), err)
 		return
@@ -250,7 +248,7 @@ func (h *AdminUserHandler) UpdateUserRole(c *gin.Context) {
 
 // AdjustUserScoreRequest represents a manual user score adjustment
 type AdjustUserScoreRequest struct {
-	Delta  int    `json:"delta" binding:"required"`
+	Delta  int    `json:"delta"`
 	Reason string `json:"reason"`
 }
 
@@ -333,8 +331,7 @@ func (h *AdminUserHandler) AdjustUserScore(c *gin.Context) {
 // @Router /admin/users/{id} [delete]
 func (h *AdminUserHandler) DeleteUser(c *gin.Context) {
 	userID := c.Param("id")
-	objID := userID
-	if objID == "" {
+	if userID == "" {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid user ID"})
 		return
 	}
@@ -364,7 +361,7 @@ func (h *AdminUserHandler) DeleteUser(c *gin.Context) {
 	// physically removing the record. This preserves data integrity for historical records
 	// like submissions and team memberships. The user will still appear in total counts.
 	// For a full purge, implement data cleanup in related tables (submissions, teams, etc.)
-	err = h.userRepo.UpdateFields(objID, map[string]interface{}{"status": "deleted"})
+	err = h.userRepo.UpdateFields(userID, map[string]interface{}{"status": "deleted"})
 	if err != nil {
 		utils.RespondWithError(c, http.StatusInternalServerError, err.Error(), err)
 		return

backend/internal/handlers/challenge_handler.go

@@ -387,17 +387,39 @@ func (h *ChallengeHandler) SearchChallenges(c *gin.Context) {
 		return
 	}
 
-	// Determine current user
+	// Determine current user and their team
 	var userID string
+	var teamID *string
 	if userIDStr, exists := c.Get("user_id"); exists {
 		userID = userIDStr.(string)
+		if h.teamRepo != nil && userID != "" {
+			if team, err := h.teamRepo.FindTeamByMemberID(userID); err == nil && team != nil {
+				teamID = &team.ID
+			}
+		}
+	}
+
+	// Build a set of visible challenge IDs to enforce contest visibility
+	visibleSet := make(map[string]bool)
+	hasActiveContest := false
+	if h.contestAdminService != nil {
+		if visibleIDs, err := h.contestAdminService.GetVisibleChallengeIDs(time.Now(), teamID); err == nil && len(visibleIDs) > 0 {
+			hasActiveContest = true
+			for _, id := range visibleIDs {
+				visibleSet[id] = true
+			}
+		}
 	}
 
 	var result []ChallengePublicResponse
 	for _, ch := range challenges {
 		if !ch.IsPublished {
 			continue
 		}
+		// If there's an active contest, only show challenges that are visible to this user
+		if hasActiveContest && !visibleSet[ch.ID] {
+			continue
+		}
 		isSolved := false
 		if h.submissionRepo != nil && userID != "" {
 			if sub, _ := h.submissionRepo.FindByChallengeAndUser(ch.ID, userID); sub != nil {

backend/internal/handlers/contest_analytics_handler.go

@@ -80,6 +80,14 @@ type CategoryAnalytics struct {
 func (h *ContestAnalyticsHandler) GetContestAnalytics(c *gin.Context) {
 	contestID := c.Param("contest_id")
 
+	// Validate that the collaborator is authorized for this specific contest
+	if collabContestID, exists := c.Get("collaborator_contest_id"); exists {
+		if collabContestID.(string) != contestID {
+			c.JSON(http.StatusForbidden, gin.H{"error": "You are not a collaborator for this contest"})
+			return
+		}
+	}
+
 	// Get registered teams count
 	teamIDs, _ := h.teamContestRegistrationRepo.GetContestTeams(contestID)
 	totalTeams := len(teamIDs)
@@ -198,6 +206,14 @@ func (h *ContestAnalyticsHandler) GetContestAnalytics(c *gin.Context) {
 func (h *ContestAnalyticsHandler) GetContestParticipantStats(c *gin.Context) {
 	contestID := c.Param("contest_id")
 
+	// Validate that the collaborator is authorized for this specific contest
+	if collabContestID, exists := c.Get("collaborator_contest_id"); exists {
+		if collabContestID.(string) != contestID {
+			c.JSON(http.StatusForbidden, gin.H{"error": "You are not a collaborator for this contest"})
+			return
+		}
+	}
+
 	teamIDs, _ := h.teamContestRegistrationRepo.GetContestTeams(contestID)
 
 	type TeamStat struct {

backend/internal/handlers/export_handler.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"sort"
 	"strings"
 
 	"github.com/Uttam-Mahata/RootAccess/backend/internal/repositories"
@@ -128,7 +129,9 @@ func (h *ExportHandler) ExportScoreboardJSON(c *gin.Context) {
 
 	encoder := json.NewEncoder(c.Writer)
 	encoder.SetIndent("", "  ")
-	encoder.Encode(entries)
+	if err := encoder.Encode(entries); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to encode scoreboard"})
+	}
 }
 
 // ExportScoreboardCSV exports the scoreboard as downloadable CSV
@@ -147,7 +150,9 @@ func (h *ExportHandler) ExportScoreboardCSV(c *gin.Context) {
 	var sb strings.Builder
 	sb.WriteString("Rank,Team Name,Score,Solve Count,Member Count\n")
 	for _, e := range entries {
-		sb.WriteString(fmt.Sprintf("%d,\"%s\",%d,%d,%d\n", e.Rank, e.TeamName, e.Score, e.SolveCount, e.MemberCount))
+		// Escape double quotes in team name to prevent CSV injection
+		escapedName := strings.ReplaceAll(e.TeamName, "\"", "\"\"")
+		sb.WriteString(fmt.Sprintf("%d,\"%s\",%d,%d,%d\n", e.Rank, escapedName, e.Score, e.SolveCount, e.MemberCount))
 	}
 	c.String(http.StatusOK, sb.String())
 }
@@ -183,7 +188,11 @@ func (h *ExportHandler) buildScoreboardEntries() []ScoreboardExportEntry {
 	}
 
 	// Sort by score descending
-	var result []ScoreboardExportEntry
+	sort.Slice(entries, func(i, j int) bool {
+		return entries[i].score > entries[j].score
+	})
+
+	result := make([]ScoreboardExportEntry, 0, len(entries))
 	for i, e := range entries {
 		result = append(result, ScoreboardExportEntry{
 			Rank:        i + 1,
@@ -194,8 +203,5 @@ func (h *ExportHandler) buildScoreboardEntries() []ScoreboardExportEntry {
 		})
 	}
 
-	if result == nil {
-		result = []ScoreboardExportEntry{}
-	}
 	return result
 }

backend/internal/handlers/practice_handler.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"net/http"
+	"time"
 
 	"github.com/Uttam-Mahata/RootAccess/backend/internal/repositories"
 	"github.com/Uttam-Mahata/RootAccess/backend/internal/services"
@@ -14,13 +15,15 @@ type PracticeHandler struct {
 	contestAdminService *services.ContestAdminService
 	challengeRepo       *repositories.ChallengeRepository
 	submissionRepo      *repositories.SubmissionRepository
+	contestEntityRepo   *repositories.ContestEntityRepository
 }
 
-func NewPracticeHandler(contestAdminService *services.ContestAdminService, challengeRepo *repositories.ChallengeRepository, submissionRepo *repositories.SubmissionRepository) *PracticeHandler {
+func NewPracticeHandler(contestAdminService *services.ContestAdminService, challengeRepo *repositories.ChallengeRepository, submissionRepo *repositories.SubmissionRepository, contestEntityRepo *repositories.ContestEntityRepository) *PracticeHandler {
 	return &PracticeHandler{
 		contestAdminService: contestAdminService,
 		challengeRepo:       challengeRepo,
 		submissionRepo:      submissionRepo,
+		contestEntityRepo:   contestEntityRepo,
 	}
 }
 
@@ -53,6 +56,19 @@ func (h *PracticeHandler) GetPracticeChallenges(c *gin.Context) {
 		return
 	}
 
+	// Build a set of challenge IDs that belong to currently active/running contests
+	// so we can exclude them from practice mode
+	activeContestChallenges := make(map[string]bool)
+	if h.contestAdminService != nil {
+		// Get challenges visible in the active contest (without team filter — we want ALL active IDs)
+		// We pass a dummy non-nil teamID to get the full set for any registered team
+		if ids, err := h.contestAdminService.GetVisibleChallengeIDs(time.Now(), nil); err == nil {
+			for _, id := range ids {
+				activeContestChallenges[id] = true
+			}
+		}
+	}
+
 	// Determine the user's own solves
 	var userID string
 	if uid, exists := c.Get("user_id"); exists {
@@ -67,12 +83,24 @@ func (h *PracticeHandler) GetPracticeChallenges(c *gin.Context) {
 		}
 	}
 
-	// Filter: only published challenges (which serve as practice when not part of an active contest)
+	// Filter: only published challenges NOT in an active contest
 	var result []PracticeChallenge
 	for _, ch := range challenges {
 		if !ch.IsPublished {
 			continue
 		}
+		// Skip challenges that are part of an active/running contest
+		if activeContestChallenges[ch.ID] {
+			continue
+		}
+		// Also skip challenges in contests that haven't ended yet (by checking ContestID)
+		if ch.ContestID != "" && h.contestEntityRepo != nil {
+			if contest, err := h.contestEntityRepo.FindByID(ch.ContestID); err == nil && contest != nil {
+				if time.Now().Before(contest.EndTime) {
+					continue // Contest hasn't ended yet
+				}
+			}
+		}
 
 		result = append(result, PracticeChallenge{
 			ID:          ch.ID,

backend/internal/handlers/scoreboard_handler.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"net/http"
+	"strconv"
 	"time"
 
 	"github.com/Uttam-Mahata/RootAccess/backend/internal/repositories"
@@ -134,7 +135,7 @@ func (h *ScoreboardHandler) GetTeamStatistics(c *gin.Context) {
 
 	days := 30
 	if daysParam := c.Query("days"); daysParam != "" {
-		if parsedDays := parseInt(daysParam); parsedDays > 0 {
+		if parsedDays, err := strconv.Atoi(daysParam); err == nil && parsedDays > 0 {
 			days = parsedDays
 		}
 	}
@@ -216,14 +217,3 @@ func (h *ScoreboardHandler) GetScoreboardContests(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"contests": result})
 }
 
-func parseInt(s string) int {
-	var result int
-	for _, char := range s {
-		if char >= '0' && char <= '9' {
-			result = result*10 + int(char-'0')
-		} else {
-			return 0
-		}
-	}
-	return result
-}

backend/internal/handlers/solo_leaderboard_handler.go

@@ -92,7 +92,7 @@ func (h *SoloLeaderboardHandler) GetSoloLeaderboard(c *gin.Context) {
 			totalScore += challengePoints[sub.ChallengeID]
 		}
 
-		if totalScore > 0 || len(subs) > 0 {
+		if totalScore > 0 || len(seen) > 0 {
 			scores = append(scores, SoloPlayerScore{
 				UserID:     user.ID,
 				Username:   user.Username,

backend/internal/middleware/auth_middleware.go

@@ -1,10 +1,14 @@
 package middleware
 
 import (
+	"context"
 	"fmt"
 	"net/http"
+	"time"
 
 	"github.com/Uttam-Mahata/RootAccess/backend/internal/config"
+	"github.com/Uttam-Mahata/RootAccess/backend/internal/database"
+	"github.com/Uttam-Mahata/RootAccess/backend/internal/repositories"
 	"github.com/gin-gonic/gin"
 	"github.com/golang-jwt/jwt/v5"
 )
@@ -57,6 +61,18 @@ func AuthMiddleware(cfg *config.Config) gin.HandlerFunc {
 			return
 		}
 
+		userID, _ := claims["user_id"].(string)
+
+		// Verify user status from DB (with short Redis cache to avoid per-request DB hits)
+		if userID != "" {
+			status := getUserStatusCached(userID)
+			if status == "banned" || status == "deleted" {
+				c.JSON(http.StatusForbidden, gin.H{"error": "Your account has been " + status})
+				c.Abort()
+				return
+			}
+		}
+
 		c.Set("user_id", claims["user_id"])
 		c.Set("username", claims["username"])
 		c.Set("email", claims["email"])
@@ -66,6 +82,39 @@ func AuthMiddleware(cfg *config.Config) gin.HandlerFunc {
 	}
 }
 
+// getUserStatusCached returns the user's account status, using Redis as a short-lived
+// cache (10s TTL) to avoid hitting the DB on every single request.
+func getUserStatusCached(userID string) string {
+	cacheKey := "user_status:" + userID
+
+	// Try Redis first
+	if database.Registry != nil && database.Registry.General != nil {
+		ctx := context.Background()
+		if cached, err := database.Registry.General.Get(ctx, cacheKey).Result(); err == nil {
+			return cached
+		}
+	}
+
+	// Fallback to DB
+	if database.TursoDB != nil {
+		userRepo := repositories.NewUserRepository(database.TursoDB)
+		if user, err := userRepo.FindByID(userID); err == nil {
+			status := user.Status
+			if status == "" {
+				status = "active"
+			}
+			// Cache in Redis for 10 seconds
+			if database.Registry != nil && database.Registry.General != nil {
+				ctx := context.Background()
+				database.Registry.General.Set(ctx, cacheKey, status, 10*time.Second)
+			}
+			return status
+		}
+	}
+
+	return "active" // fail open if DB is unreachable
+}
+
 func AdminMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		role, exists := c.Get("role")

backend/internal/routes/routes.go

@@ -175,7 +175,7 @@ func SetupRouter(cfg *config.Config) *gin.Engine {
 	accountHandler := handlers.NewAccountHandler(userRepo, teamRepo, submissionRepo, achievementRepo, writeupRepo)
 	soloLeaderboardHandler := handlers.NewSoloLeaderboardHandler(userRepo, teamRepo, submissionRepo, challengeRepo)
 	exportHandler := handlers.NewExportHandler(challengeRepo, submissionRepo, userRepo, teamRepo)
-	practiceHandler := handlers.NewPracticeHandler(contestAdminService, challengeRepo, submissionRepo)
+	practiceHandler := handlers.NewPracticeHandler(contestAdminService, challengeRepo, submissionRepo, contestEntityRepo)
 	contestAnalyticsHandler := handlers.NewContestAnalyticsHandler(submissionRepo, challengeRepo, teamRepo, userRepo, teamContestRegistrationRepo, contestSolveRepo, roundChallengeRepo, contestRoundRepo)
 	challengeRatingHandler := handlers.NewChallengeRatingHandler(database.TursoDB)
 	webhookService := services.NewWebhookService(cfg.DiscordWebhookURL, cfg.SlackWebhookURL)