Fix multiple backend and frontend bugs - #33
Conversation
… registration - Fix scoreboard ignoring solo players - Enforce SuspendedUntil logic in authentication - Include missing Swagger docs for go test - Fix incorrect OAuth backend URL paths - Pass withCredentials for contest registration to send cookies Co-authored-by: Uttam-Mahata <92252205+Uttam-Mahata@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
There was a problem hiding this comment.
Pull request overview
This PR bundles several backend + frontend fixes across authentication, contest registration, and scoreboard computation, and also commits generated Swagger docs under backend/docs.
Changes:
- Frontend: fixes OAuth redirect URLs for GitHub/Discord and ensures contest registration requests send cookies (
withCredentials). - Backend: updates scoreboard indexing to handle submissions missing
team_id, and blocks login whenSuspendedUntilis in the future. - Repo hygiene: removes
backend/docs/from.gitignoreand adds generated Swagger JSON/YAML.
Reviewed changes
Copilot reviewed 4 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| frontend/src/app/services/contest.ts | Adds withCredentials to contest registration endpoints so cookies/JWT are attached. |
| frontend/src/app/services/auth.ts | Fixes duplicated /auth in GitHub/Discord OAuth redirect URLs. |
| backend/internal/services/scoreboard_service.go | Adjusts solve indexing/scoring to handle submissions without TeamID. |
| backend/internal/services/auth_service.go | Enforces temporary suspensions during username/password login. |
| backend/docs/swagger.yaml | Adds generated Swagger spec (YAML). |
| backend/docs/swagger.json | Adds generated Swagger spec (JSON). |
| .gitignore | Stops ignoring backend/docs/ so generated docs can be committed. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| for _, sub := range submissions { | ||
| if sub.TeamID == "" { | ||
| continue | ||
| entityID := sub.TeamID | ||
| if entityID == "" { | ||
| entityID = sub.UserID | ||
| } | ||
| tid := sub.TeamID | ||
| cid := sub.ChallengeID | ||
|
|
||
| if !contestTeams[tid] || !contestChallenges[cid] { | ||
| if (sub.TeamID != "" && !contestTeams[sub.TeamID]) || !contestChallenges[cid] { | ||
| continue |
There was a problem hiding this comment.
buildTeamChallengeFirstSolveIndex now falls back to sub.UserID when sub.TeamID is empty, but it still increments challengeSolveRank[cid]. This means a submission missing TeamID can consume an early solve-rank and reduce points awarded to legitimate team solves later (and can affect team scoreboard/progression since they reuse this function). Consider normalizing these submissions to the solver's team ID (if known) before ranking, or excluding TeamID-less submissions from the shared rank calculation used for team scoring.
| // Verify team registration only for team solves (tid is TeamID, not UserID). | ||
| // Since we don't have solverUID here yet, we will check it inside the loop. | ||
| for cid, solverUID := range chMap { | ||
| if tid != solverUID && !contestTeams[tid] { | ||
| continue | ||
| } | ||
| if !contestChallenges[cid] { | ||
| continue | ||
| } | ||
| if !registeredUserIDs[solverUID] { | ||
| if tid != solverUID && !registeredUserIDs[solverUID] { | ||
| continue | ||
| } |
There was a problem hiding this comment.
In GetScoreboard, the registration checks are skipped when tid == solverUID (i.e., when the index key is a user ID from a TeamID-less submission). That allows unregistered users (or users not in a registered team) to appear on a contest scoreboard if their submissions lack TeamID. If these TeamID-less submissions are meant to be attributed to a team member of a registered team, the safer check is to still require registeredUserIDs[solverUID] (or map the submission to the user’s team) rather than bypassing registration entirely.
| // Check if user is banned | ||
| if user.Status == "banned" { | ||
| return "", nil, errors.New("your account has been banned") | ||
| } | ||
|
|
||
| // Check if user is suspended | ||
| if user.SuspendedUntil != "" { | ||
| if suspendedUntil, err := time.Parse(time.RFC3339, user.SuspendedUntil); err == nil { | ||
| if time.Now().Before(suspendedUntil) { | ||
| return "", nil, errors.New("your account is temporarily suspended") | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
Login currently blocks only Status == "banned", but admin APIs allow setting status to "suspended" and there’s no visible handler updating suspended_until. As a result, users with status="suspended" (or with a malformed SuspendedUntil) can still log in. Consider explicitly denying login when user.Status == "suspended", and treating an invalid SuspendedUntil value as an error (or as suspended) instead of silently ignoring the parse failure.
Fixed multiple issues:
SuspendedUntiltimestamp.backend/docsfrom.gitignoreand add generated Swagger documentation./authbase paths in GitHub and Discord login flows.withCredentialsto attach cookies.PR created automatically by Jules for task 3885314757463570572 started by @Uttam-Mahata