Merge pull request #309 from topcoder-platform/PM-5747

PM-5747: require passing Design F2F submissions for winner downloads

Author: jmgasper

src/api/submission/submission.controller.ts

@@ -405,7 +405,7 @@ export class SubmissionController {
   @ApiOperation({
     summary: 'Download the submission',
     description:
-      'Roles: Copilot, Admin, User, Reviewer. After challenge completion, the exact metadata value allowAllRegistrantsToDownloadWinningSubmissions=true lets every registered Submitter download only an exact final winning submission and denies non-winners without legacy fallback. Other values retain legacy passing or First2Finish eligibility. | Scopes: read:submission',
+      'Roles: Copilot, Admin, User, Reviewer. After challenge completion, the exact metadata value allowAllRegistrantsToDownloadWinningSubmissions=true lets every registered Submitter download only an exact final winning submission and denies non-winners without legacy fallback. Other values require passing-submission eligibility, except non-Design First2Finish challenges retain legacy submitter eligibility. | Scopes: read:submission',
   })
   @ApiParam({
     name: 'submissionId',

src/api/submission/submission.service.spec.ts

@@ -1364,6 +1364,52 @@ describe('SubmissionService', () => {
       expect(s3Send).not.toHaveBeenCalled();
     });
 
+    it('denies a failed Design First2Finish submitter when the new flag is disabled', async () => {
+      resourceApiService.getMemberResourcesRoles.mockResolvedValue([
+        { roleName: 'Submitter' },
+      ]);
+      challengeApiServiceMock.getChallengeDetail.mockResolvedValue({
+        status: ChallengeStatus.COMPLETED,
+        type: 'First2Finish',
+        track: 'Design',
+        metadata: {
+          submissionsViewable: 'true',
+        },
+        winners: [{ userId: 'owner-user', placement: 1 }],
+      });
+      prismaMock.submission.findFirst.mockImplementation(({ where }) =>
+        Promise.resolve(
+          where.reviewSummation ? null : { id: 'failed-own-submission' },
+        ),
+      );
+
+      await expect(
+        service.getSubmissionFileStream(
+          {
+            userId: 'failed-first2finish-submitter',
+            isMachine: false,
+            roles: [],
+          } as any,
+          'sub-123',
+        ),
+      ).rejects.toBeInstanceOf(ForbiddenException);
+
+      expect(prismaMock.submission.findFirst).toHaveBeenCalledTimes(1);
+      expect(prismaMock.submission.findFirst).toHaveBeenCalledWith({
+        where: {
+          challengeId: 'challenge-xyz',
+          memberId: 'failed-first2finish-submitter',
+          reviewSummation: {
+            some: {
+              isPassing: true,
+            },
+          },
+        },
+        select: { id: true },
+      });
+      expect(s3Send).not.toHaveBeenCalled();
+    });
+
     it('preserves manager access when Design submissions are not viewable', async () => {
       resourceApiService.getMemberResourcesRoles.mockResolvedValue([
         { roleName: 'Manager' },

src/api/submission/submission.service.ts

@@ -1285,8 +1285,9 @@ export class SubmissionService {
    *   eligible reviewers, copilots, or managers.
    * - When `allowAllRegistrantsToDownloadWinningSubmissions` is exactly
    *   `"true"`, every registered Submitter may download only an exact final
-   *   winning submission after completion. Other metadata values retain legacy
-   *   passing or First2Finish eligibility.
+   *   winning submission after completion. Other metadata values require
+   *   passing-submission eligibility, except non-Design First2Finish challenges
+   *   retain legacy submitter eligibility.
    *
    * The file is always fetched from the configured clean bucket, never from DMZ.
    * The S3 key is derived from the submission.url.
@@ -1506,8 +1507,8 @@ export class SubmissionService {
    * `"true"` makes the requested target decisive: it must be the exact canonical
    * result for a recorded placement winner (or carry matching legacy placement
    * data), and a non-winner fails closed without legacy fallback. Other metadata
-   * values retain the legacy First2Finish or passing-submission eligibility
-   * behavior.
+   * values require passing-submission eligibility, except non-Design
+   * First2Finish challenges retain legacy submitter eligibility.
    *
    * @param challengeId - Challenge containing the requested submission.
    * @param requesterMemberId - Registered Submitter requesting the download.
@@ -1534,7 +1535,10 @@ export class SubmissionService {
       return this.isWinningSubmission(challengeId, challenge, submission);
     }
 
-    if (this.isFirst2FinishChallenge(challenge)) {
+    if (
+      this.isFirst2FinishChallenge(challenge) &&
+      !this.isDesignChallenge(challenge)
+    ) {
       const memberSubmission = await this.prisma.submission.findFirst({
         where: {
           challengeId,
@@ -1560,6 +1564,26 @@ export class SubmissionService {
     return Boolean(passingSubmission);
   }
 
+  /**
+   * Determines whether a challenge belongs to the Design track.
+   *
+   * The current track name is preferred, while the legacy track is also checked
+   * so migrated Design First2Finish challenges use passing-submission
+   * eligibility.
+   *
+   * @param challenge - Challenge metadata returned by the challenge service.
+   * @returns True when either current or legacy track is named Design.
+   * @throws Never.
+   */
+  private isDesignChallenge(challenge: ChallengeData): boolean {
+    return [challenge.track, challenge.legacy?.track].some(
+      (track) =>
+        String(track ?? '')
+          .trim()
+          .toLowerCase() === 'design',
+    );
+  }
+
   /**
    * Reads the all-registrants winner-download feature flag.
    *