August 2026 Release 3

packages/review-prisma-client/generated/index-browser.js

@@ -358,6 +358,7 @@ exports.Prisma.SubmissionScalarFieldEnum = {
   fileType: 'fileType',
   esId: 'esId',
   submittedDate: 'submittedDate',
+  sha256Hash: 'sha256Hash',
   createdAt: 'createdAt',
   createdBy: 'createdBy',
   updatedAt: 'updatedAt',

packages/review-prisma-client/generated/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "prisma-client-e90aa6b631027b154a2d1a0332313bbe8b7b2f3ddabbec274a5b034f4c829bc1",
+  "name": "prisma-client-36e90377f45cb35d9ca8cccf526d6146684b8db7b0f493bbbc604756de816d2c",
   "main": "index.js",
   "types": "index.d.ts",
   "browser": "default.js",

packages/review-prisma-client/generated/schema.prisma

@@ -439,6 +439,9 @@ model submission {
   esId              String?   @db.Uuid
   submittedDate     DateTime?
 
+  /// Lowercase hex SHA-256 digest of the uploaded file contents; null for URL-only submissions.
+  sha256Hash String? @db.VarChar(64)
+
   createdAt DateTime  @default(now())
   createdBy String?
   updatedAt DateTime? @updatedAt
@@ -464,6 +467,7 @@ model submission {
   @@index([legacySubmissionId])
   @@index([challengeId, memberId, status])
   @@index([submittedDate])
+  @@index([sha256Hash])
 }
 
 /// Durable, idempotent processing state for a design submission preview.

prisma/migrations/20260819120000_add_submission_sha256_hash/migration.sql

@@ -0,0 +1,5 @@
+-- Add SHA-256 content hash on submission for uploaded file identification.
+ALTER TABLE "submission"
+ADD COLUMN "sha256Hash" VARCHAR(64);
+
+CREATE INDEX "submission_sha256Hash_idx" ON "submission"("sha256Hash");

prisma/schema.prisma

@@ -439,6 +439,9 @@ model submission {
   esId              String?   @db.Uuid
   submittedDate     DateTime?
 
+  /// Lowercase hex SHA-256 digest of the submission file contents; null for non-file submissions.
+  sha256Hash String? @db.VarChar(64)
+
   createdAt DateTime  @default(now())
   createdBy String?
   updatedAt DateTime? @updatedAt
@@ -464,6 +467,7 @@ model submission {
   @@index([legacySubmissionId])
   @@index([challengeId, memberId, status])
   @@index([submittedDate])
+  @@index([sha256Hash])
 }
 
 /// Durable, idempotent processing state for a design submission preview.

src/api/ai-review-config/ai-review-config.service.ts

@@ -283,7 +283,7 @@ export class AiReviewConfigService {
     });
     if (count > 0) {
       throw new ConflictException(
-        `Cannot create AI review config: challenge ${challengeId} already has submissions.`,
+        `Cannot create or update AI review config: challenge ${challengeId} already has submissions.`,
       );
     }
   }
@@ -545,6 +545,7 @@ export class AiReviewConfigService {
     const challengeId = config.challengeId;
 
     await this.validateCanManageConfigForChallenge(challengeId, authUser);
+    await this.validateNoSubmissionsExistForChallenge(challengeId);
     await this.validateChallengeNotCompleted(challengeId);
     await this.validateNoDecisionsForConfig(id);
     await this.validateNoAiRunsExistForChallenge(challengeId);

src/api/my-review/myReview.service.ts

@@ -398,6 +398,7 @@ export class MyReviewService {
             ) AS winners
           FROM challenges."ChallengeWinner" w
           WHERE w."challengeId" = c.id
+          AND w.type = 'PLACEMENT'
         ) cw ON TRUE
       `,
     );
@@ -857,6 +858,7 @@ export class MyReviewService {
             ) AS winners
           FROM challenges."ChallengeWinner" w
           WHERE w."challengeId" = bp."challengeId"
+          AND w.type = 'PLACEMENT'
         ) cw ON TRUE
         LEFT JOIN LATERAL (
           SELECT
@@ -968,6 +970,7 @@ export class MyReviewService {
             ) AS winners
           FROM challenges."ChallengeWinner" w
           WHERE w."challengeId" = bp."challengeId"
+          AND w.type = 'PLACEMENT'
         ) cw ON TRUE
         LEFT JOIN LATERAL (
           SELECT

src/api/submission/submission.controller.ts

@@ -124,9 +124,16 @@ export class SubmissionController {
     @UploadedFile() file: Express.Multer.File,
     @Body() body: SubmissionRequestDto,
   ): Promise<SubmissionResponseDto> {
-    console.log(
+    this.logger.debug(
       `Creating submission with request body: ${JSON.stringify(body)}`,
     );
+    // Diagnostic for sha256Hash: a null digest almost always means no multipart file arrived
+    this.logger.debug(
+      `Creating submission multipart file: present=${!!file}, fieldname=${file?.fieldname ?? 'n/a'}, ` +
+        `originalname=${file?.originalname ?? 'n/a'}, size=${file?.size ?? 'n/a'}, ` +
+        `bufferBytes=${Buffer.isBuffer(file?.buffer) ? file.buffer.length : 'n/a'}, ` +
+        `contentType=${req.headers['content-type'] ?? 'n/a'}`,
+    );
     const authUser: JwtUser = req['user'] as JwtUser;
     return this.service.createSubmission(authUser, body, file);
   }
@@ -473,8 +480,10 @@ export class SubmissionController {
   @Scopes(Scope.DeleteSubmission)
   @HttpCode(HttpStatus.NO_CONTENT)
   @ApiOperation({
-    summary: 'Delete a submission',
-    description: 'Roles: Admin, User | Scopes: delete:submission',
+    summary:
+      'Delete a submission (submitters only while the phase that created it is open)',
+    description:
+      'Roles: Admin, User | Scopes: delete:submission. Submitters can only delete their own submission while the matching submission phase (Submission, Checkpoint Submission, or Final Fix) is still open. Admins and M2M tokens are not restricted by the phase window.',
   })
   @ApiParam({
     name: 'submissionId',
@@ -484,6 +493,10 @@ export class SubmissionController {
     status: 204,
     description: 'Submission deleted successfully.',
   })
+  @ApiResponse({
+    status: 400,
+    description: 'The submission phase is already closed.',
+  })
   @ApiResponse({ status: 403, description: 'Forbidden.' })
   @ApiResponse({ status: 404, description: 'Submission not found.' })
   async deleteSubmission(