Skip to content

August 2026 Release 3 - #331

Merged
jmgasper merged 19 commits into
masterfrom
develop
Aug 26, 2026
Merged

August 2026 Release 3#331
jmgasper merged 19 commits into
masterfrom
develop

Conversation

@jmgasper

Copy link
Copy Markdown
Collaborator

vas3a and others added 19 commits August 19, 2026 07:53
…ity-limit

Update review opportunity limit validation
…gerprinting

PM-5601 - submission fingerprinting
…fig-update

PM-5955 - after first submission, prevent AIConfig updates
…a256

PM-5601 - compute file hash from s3 url
…ssion phase closes

What was broken
DELETE /submissions/:submissionId had no phase validation, so a submitter could
delete their own submission at any point in the challenge lifecycle - including
after the Submission / Checkpoint Submission phase had ended and the submission
had already been screened, reviewed and scored.

Root cause
SubmissionService.deleteSubmission only validated ownership (or M2M scope) and
that no AI workflow run was still active. Unlike createSubmission, which calls
ChallengeApiService.validateSubmissionCreation /
validateCheckpointSubmissionCreation / validateFinalFixSubmissionCreation, the
delete path never checked whether the phase that produced the submission was
still open.

What was changed
- Added SubmissionService.validateSubmissionDeletionPhaseWindow(), invoked for
  non-admin, non-machine callers in deleteSubmission. It resolves the phase
  names that create the submission's type (Checkpoint Submission, Final Fix, or
  Submission / Topgear Submission) via the new
  getSubmissionPhaseNamesForType() helper and rejects the delete with
  BadRequestException / code SUBMISSION_PHASE_CLOSED when none of them is open.
- Admins and M2M tokens keep their existing behaviour, and an unavailable
  Challenge API is logged and allowed through, matching submission creation.
- deleteSubmission now re-throws BadRequestException instead of wrapping it in
  a 500.
- Documented the phase restriction and the new 400 response on the controller's
  Swagger metadata.

Any added/updated tests
- src/api/submission/submission.service.spec.ts: new "deleteSubmission phase
  window" suite covering a checkpoint submission rejected once the Checkpoint
  Submission phase closed, a contest submission rejected once the Submission
  phase closed, a successful delete while the matching phase is open, and
  admins bypassing the phase window.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
What was broken
When a Marathon Match member submitted again while an earlier scorer was still
running, the earlier run was stopped without any member-visible terminal state,
so that submission stayed in the "Preparing" state indefinitely. Reporting the
stopped run required a status that is neither "in progress" nor "failed", but
the member-safe review summation metadata allowlist dropped anything other than
FAILED, IN PROGRESS and SUCCESS.

Root cause
normalizeTestStatus in buildSafeReviewSummationMetadata only recognized FAILED,
IN PROGRESS and SUCCESS. A CANCELLED testStatus written by marathon-match-api-v6
was silently stripped from member-facing review summation and submission
responses, so the UI never saw it and kept showing the generic preparing state.

What was changed
Added CANCELLED to the SafeTestStatus union and to the normalizeTestStatus
allowlist so a cancelled Marathon Match scoring run survives metadata
sanitization for both metadata.testStatus and
metadata.testProgressDetails.status. No other metadata is newly exposed.

Any added/updated tests
- src/shared/utils/review-summation-metadata.util.spec.ts: new spec covering
  that a cancelled Marathon Match run keeps its status and progress details, and
  that unsupported free-form statuses are still dropped.
PM-5961: block submitters from deleting submissions after their submission phase closes
PM-5368: allow CANCELLED Marathon Match test status through to members
@jmgasper
jmgasper merged commit d855b89 into master Aug 26, 2026
8 of 9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants