Merge branch 'security' of github.com:topcoder-platform/challenge-api-v6 into security

Author: jmgasper

prisma/migrations/20251112162335_aiworkflowid_in_def_challenge_reviewer/migration.sql

@@ -0,0 +1,10 @@
+/*
+  Warnings:
+
+  - You are about to drop the column `isAIReviewer` on the `DefaultChallengeReviewer` table. All the data in the column will be lost.
+
+*/
+-- AlterTable
+ALTER TABLE "DefaultChallengeReviewer" DROP COLUMN "isAIReviewer",
+ADD COLUMN     "aiWorkflowId" VARCHAR(14),
+ALTER COLUMN "scorecardId" DROP NOT NULL;

prisma/migrations/20251130100000_add_challenge_groups_gin_index/migration.sql

@@ -0,0 +1,4 @@
+-- Improve search responsiveness for group-constrained queries
+CREATE INDEX IF NOT EXISTS "challenge_groups_gin_idx"
+  ON "challenges"."Challenge"
+  USING GIN ("groups");

prisma/schema.prisma

@@ -148,6 +148,7 @@ model Challenge {
   @@index([updatedAt])
   @@index([typeId])
   @@index([trackId])
+  @@index([groups], type: Gin, map: "challenge_groups_gin_idx")
   @@index([submissionStartDate])
   @@index([submissionEndDate])
   @@index([registrationStartDate])
@@ -648,7 +649,7 @@ model DefaultChallengeReviewer {
   trackId               String
   timelineTemplateId    String?
   // Reviewer configuration (mirrors ChallengeReviewer)
-  scorecardId           String
+  scorecardId           String?
   isMemberReview        Boolean
   memberReviewerCount   Int?
   phaseName             String
@@ -658,7 +659,7 @@ model DefaultChallengeReviewer {
   baseCoefficient           Float?
   incrementalCoefficient    Float?
   opportunityType       ReviewOpportunityTypeEnum?
-  isAIReviewer          Boolean?
+  aiWorkflowId          String?                    @db.VarChar(14)
   shouldOpenOpportunity Boolean                    @default(true)
 
   // Relations
@@ -723,4 +724,4 @@ model TimelineTemplatePhase {
 
   @@index([timelineTemplateId])
   @@index([timelineTemplateId, phaseId])
-}
+}

src/common/challenge-helper.js

@@ -12,6 +12,8 @@ const { hasAdminRole } = require("./role-helper");
 const { ensureAcessibilityToModifiedGroups } = require("./group-helper");
 const { ChallengeStatusEnum } = require("@prisma/client");
 
+const SUBMISSION_PHASE_PRIORITY = ["Topcoder Submission", "Submission"];
+
 class ChallengeHelper {
   /**
    * @param {Object} challenge the challenge object
@@ -356,7 +358,9 @@ class ChallengeHelper {
   enrichChallengeForResponse(challenge, track, type, options = {}) {
     if (challenge.phases && challenge.phases.length > 0) {
       const registrationPhase = _.find(challenge.phases, (p) => p.name === "Registration");
-      const submissionPhase = _.find(challenge.phases, (p) => p.name === "Submission");
+      const submissionPhase =
+        _.find(challenge.phases, (p) => p.name === SUBMISSION_PHASE_PRIORITY[0]) ||
+        _.find(challenge.phases, (p) => p.name === SUBMISSION_PHASE_PRIORITY[1]);
 
       // select last started open phase as current phase
       _.forEach(challenge.phases, (p) => {

src/common/prisma-helper.js

@@ -3,6 +3,8 @@ const Decimal = require("decimal.js");
 const constants = require("../../app-constants");
 const { PrizeSetTypeEnum } = require("@prisma/client");
 const { dedupeChallengeTerms } = require("./helper");
+
+const SUBMISSION_PHASE_PRIORITY = ["Topcoder Submission", "Submission"];
 /**
  * Convert phases data to prisma model.
  *
@@ -11,6 +13,7 @@ const { dedupeChallengeTerms } = require("./helper");
  * @param {Object} auditFields createdBy and updatedBy
  */
 function convertChallengePhaseSchema(challenge, result, auditFields) {
+  const phases = _.isArray(challenge.phases) ? challenge.phases : [];
   // keep phase data
   const phaseFields = [
     "name",
@@ -25,24 +28,29 @@ function convertChallengePhaseSchema(challenge, result, auditFields) {
     "challengeSource",
   ];
   // current phase names
-  result.currentPhaseNames = _.map(
-    _.filter(challenge.phases, (p) => p.isOpen === true),
-    "name"
-  );
-  // get registration date and submission date
-  _.forEach(challenge.phases, (p) => {
-    if (p.name === "Registration") {
-      result.registrationStartDate = p.actualStartDate || p.scheduledStartDate;
-      result.registrationEndDate = p.actualEndDate || p.scheduledEndDate;
-    } else if (p.name === "Submission") {
-      result.submissionStartDate = p.actualStartDate || p.scheduledStartDate;
-      result.submissionEndDate = p.actualEndDate || p.scheduledEndDate;
-    }
-  });
+  result.currentPhaseNames = _.map(_.filter(phases, (p) => p.isOpen === true), "name");
+
+  const registrationPhase = _.find(phases, (p) => p.name === "Registration");
+  const submissionPhase =
+    _.find(phases, (p) => p.name === SUBMISSION_PHASE_PRIORITY[0]) ||
+    _.find(phases, (p) => p.name === SUBMISSION_PHASE_PRIORITY[1]);
+
+  if (registrationPhase) {
+    result.registrationStartDate =
+      registrationPhase.actualStartDate || registrationPhase.scheduledStartDate;
+    result.registrationEndDate =
+      registrationPhase.actualEndDate || registrationPhase.scheduledEndDate;
+  }
+  if (submissionPhase) {
+    result.submissionStartDate =
+      submissionPhase.actualStartDate || submissionPhase.scheduledStartDate;
+    result.submissionEndDate =
+      submissionPhase.actualEndDate || submissionPhase.scheduledEndDate;
+  }
   // set phases array data
-  if (!_.isEmpty(challenge.phases)) {
+  if (!_.isEmpty(phases)) {
     result.phases = {
-      create: _.map(challenge.phases, (p) => {
+      create: _.map(phases, (p) => {
         const phaseData = {
           phase: { connect: { id: p.phaseId } },
           ..._.pick(p, phaseFields),

src/services/ChallengePhaseService.js

@@ -31,6 +31,10 @@ const PHASE_RESOURCE_ROLE_REQUIREMENTS = Object.freeze({
   review: "Reviewer",
   "checkpoint review": "Checkpoint Reviewer",
 });
+const SUBMISSION_PHASE_NAME_SET = new Set(["submission", "topgear submission"]);
+const REGISTRATION_PHASE_NAME = "registration";
+
+const normalizePhaseName = (name) => String(name || "").trim().toLowerCase();
 
 async function hasPendingScorecardsForPhase(challengePhaseId) {
   if (!config.REVIEW_DB_URL) {
@@ -561,7 +565,14 @@ async function partiallyUpdateChallengePhase(currentUser, challengeId, id, data)
         return reopenedPhaseIdentifiers.has(String(phase.predecessor));
       });
 
-      if (dependentOpenPhases.length === 0) {
+      const normalizedPhaseName = normalizePhaseName(phaseName);
+      const hasSubmissionVariantOpen = openPhases.some((phase) =>
+        SUBMISSION_PHASE_NAME_SET.has(normalizePhaseName(phase?.name))
+      );
+      const allowRegistrationReopenWithoutExplicitDependency =
+        normalizedPhaseName === REGISTRATION_PHASE_NAME && hasSubmissionVariantOpen;
+
+      if (dependentOpenPhases.length === 0 && !allowRegistrationReopenWithoutExplicitDependency) {
         throw new errors.ForbiddenError(
           `Cannot reopen ${phaseName} because no currently open phase depends on it`
         );