H

.dockerignore

@@ -1,21 +1,43 @@
+# Environment files (secrets)
 .env
 .env.*
-__pycache__/
+!.env.example
+
+# Version control
+.git
+.gitignore
+.github
+
+# Python
+__pycache__
 *.pyc
 *.pyo
 *.pyd
-.pytest_cache/
-.mypy_cache/
-.ruff_cache/
-.git/
-.gitignore
-.gitattributes
-.vscode/
-.idea/
+.Python
+*.egg-info
+dist
+build
+
+# IDE
+.vscode
+.idea
+*.swp
+*.swo
+
+# OS
 .DS_Store
-node_modules/
-logs/
+Thumbs.db
+
+# Node (for frontend build context only)
+node_modules
+package-lock.json
+
+# Temporary files
+*.tmp
 *.log
-tests/
-scripts/_test_*.py
-scripts/check_env.py
+temp/
+tmp/
+
+# Documentation
+*.md
+LICENSE

Dockerfile

@@ -10,22 +10,29 @@ WORKDIR /app
 # System deps:
 #   - build-essential + libffi-dev: build native extensions for `cryptography`
 #   - coreutils + xxd: built-in CLI tools the terminal sandbox shells out to
+#   - Removed curl (security risk - not needed at runtime)
 RUN apt-get update && apt-get install -y --no-install-recommends \
         build-essential \
         libffi-dev \
         coreutils \
         xxd \
-        curl \
         ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
+# Create non-root user for security
+RUN useradd --create-home --shell /bin/bash --uid 1000 appuser && \
+    mkdir -p /app /tmp/sandbox && \
+    chown -R appuser:appuser /app /tmp/sandbox
+
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . .
+COPY --chown=appuser:appuser . .
+
+# Switch to non-root user
+USER appuser
 
 # Hugging Face Spaces default. The proxy forwards public 7860 → container 7860.
-# Locally, override with `PORT=8090 python main.py` to match the README quickstart.
 ENV PORT=7860
 EXPOSE 7860
 

app/api/auth.py

@@ -1,7 +1,9 @@
 """``/api/auth`` — proxy to the Supabase ``apex-auth`` edge function."""
 
 import httpx
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, HTTPException, Request
+from slowapi import Limiter
+from slowapi.util import get_remote_address
 
 from app.core.config import SUPABASE_EDGE_URL
 from app.types import AuthRequest
@@ -9,9 +11,13 @@ from app.types import AuthRequest
 
 router = APIRouter()
 
+# Rate limiter: 5 auth attempts per minute per IP (prevents brute-force)
+limiter = Limiter(key_func=get_remote_address)
+
 
 @router.post("/api/auth")
-async def handle_auth(req: AuthRequest):
+@limiter.limit("5/minute")
+async def handle_auth(request: Request, req: AuthRequest):
     async with httpx.AsyncClient(timeout=30) as client:
         resp = await client.post(
             f"{SUPABASE_EDGE_URL}/apex-auth",
@@ -19,5 +25,6 @@ async def handle_auth(req: AuthRequest):
         )
     data = resp.json()
     if resp.status_code != 200:
-        raise HTTPException(status_code=resp.status_code, detail=data.get("error", "Auth failed"))
+        # Don't leak specific error details
+        raise HTTPException(status_code=resp.status_code, detail="Authentication failed")
     return data

app/api/certificates.py

@@ -1,7 +1,8 @@
 """``/api/certificates`` — issuance, download, verify, progress."""
 
-from fastapi import APIRouter
+from fastapi import APIRouter, Depends
 
+from app.core.auth import get_current_user
 from app.types import CertificateRequest
 from app.services.certificate_service import (
     handle_certificates,
@@ -15,7 +16,9 @@ router = APIRouter()
 
 
 @router.post("/api/certificates")
-async def post_certificates(req: CertificateRequest):
+async def post_certificates(req: CertificateRequest, user: dict = Depends(get_current_user)):
+    # IDOR FIX: Override user_id from JWT
+    req.user_id = user["user_id"]
     return await handle_certificates(req)
 
 
@@ -30,5 +33,9 @@ async def get_verify(verify_code: str):
 
 
 @router.get("/api/certificates/progress")
-async def get_progress(user_id: str, category: str):
+async def get_progress(user_id: str, category: str, user: dict = Depends(get_current_user)):
+    # IDOR FIX: Only allow viewing own progress
+    if user_id != user["user_id"]:
+        from fastapi import HTTPException
+        raise HTTPException(status_code=403, detail="Cannot view other users' progress")
     return await cert_progress(user_id, category)

app/api/onevone.py

@@ -42,10 +42,12 @@ from datetime import datetime, timezone
 from typing import Any, Optional
 
 import httpx
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import StreamingResponse
 from pydantic import BaseModel
 
+from app.core.auth import get_current_user
+
 # Force UTF-8 for Arabic messages on Windows consoles
 sys.stdout.reconfigure(encoding="utf-8")
 
@@ -170,6 +172,8 @@ def _scenario_table_for(team_role: str, challenge_type: str) -> str:
         return "log_analysis_challenges"
     if challenge_type == "vulnerability-hunter":
         return "vulnerability_hunter_challenges"
+    if challenge_type == "steganography":
+        return "steganography_challenges"
     return "encryption_challenges"
 
 
@@ -183,6 +187,7 @@ async def _pick_challenge(team_role: str) -> dict:
         ("code_fixing_challenges", "code-fixing"),
         ("log_analysis_challenges", "log-analysis"),
         ("vulnerability_hunter_challenges", "vulnerability-hunter"),
+        ("steganography_challenges", "steganography"),
         ("encryption_challenges", "crypto"),
     ]
     for table, ctype in candidates:
@@ -336,12 +341,14 @@ class SubmitRequest(BaseModel):
 # --------------------------------------------------------------------------- #
 
 @router.post("/rooms")
-async def create_room(req: CreateRoomRequest):
+async def create_room(req: CreateRoomRequest, user: dict = Depends(get_current_user)):
+    # IDOR FIX: Use authenticated user's ID
+    user_id = user["user_id"]
     if req.teamRole not in ("red", "blue"):
         raise HTTPException(status_code=400, detail="teamRole يجب أن يكون red أو blue")
     if req.mainDurationS not in MAIN_DURATION_OPTIONS:
         raise HTTPException(status_code=400, detail="mainDurationS غير صالح")
-    if not req.userId or not req.displayName:
+    if not req.displayName:
         raise HTTPException(status_code=400, detail="بيانات المستخدم ناقصة")
 
     # generate a unique 6-char code (retry on collision)
@@ -354,7 +361,7 @@ async def create_room(req: CreateRoomRequest):
 
     room = await _sb_insert("onevone_rooms", {
         "code": code,
-        "owner_user_id": req.userId,
+        "owner_user_id": user_id,
         "team_role": req.teamRole,
         "status": "open",
         "challenge_source": req.challengeSource,
@@ -363,7 +370,7 @@ async def create_room(req: CreateRoomRequest):
     # add the owner as slot 1
     await _sb_insert("onevone_players", {
         "room_id": room["id"],
-        "user_id": req.userId,
+        "user_id": user_id,
         "slot": 1,
         "display_name": req.displayName,
         "is_ready": True,
@@ -372,9 +379,11 @@ async def create_room(req: CreateRoomRequest):
 
 
 @router.post("/rooms/join")
-async def join_room(req: JoinRoomRequest):
-    if not req.code or not req.userId:
-        raise HTTPException(status_code=400, detail="code و userId مطلوبان")
+async def join_room(req: JoinRoomRequest, user: dict = Depends(get_current_user)):
+    # IDOR FIX: Use authenticated user's ID
+    user_id = user["user_id"]
+    if not req.code:
+        raise HTTPException(status_code=400, detail="code مطلوب")
 
     rows = await _sb_select("onevone_rooms", f"code=eq.{req.code.strip().upper()}&select=*&limit=1")
     if not rows:
@@ -382,7 +391,7 @@ async def join_room(req: JoinRoomRequest):
     room = rows[0]
     if room["status"] != "open":
         raise HTTPException(status_code=409, detail="هذه الغرفة لم تعد تقبل لاعبين")
-    if str(room["owner_user_id"]) == str(req.userId):
+    if str(room["owner_user_id"]) == str(user_id):
         raise HTTPException(status_code=400, detail="أنت مالك الغرفة بالفعل")
 
     # already joined?
@@ -390,7 +399,7 @@ async def join_room(req: JoinRoomRequest):
         "onevone_players",
         f"room_id=eq.{room['id']}&select=*",
     )
-    if any(str(p["user_id"]) == str(req.userId) for p in existing_players):
+    if any(str(p["user_id"]) == str(user_id) for p in existing_players):
         # idempotent re-join — return current state
         return {"room": room, "players": existing_players, "joined": True}
     if len(existing_players) >= 2:
@@ -399,13 +408,13 @@ async def join_room(req: JoinRoomRequest):
     # slot 2 inherits the same team_role
     new_player = await _sb_insert("onevone_players", {
         "room_id": room["id"],
-        "user_id": req.userId,
+        "user_id": user_id,
         "slot": 2,
         "display_name": req.displayName,
         "is_ready": True,
     })
     # a player joined => notify the open SSE streams (if any)
-    await _broadcast_room_event(room["id"], {"type": "player_joined", "userId": req.userId})
+    await _broadcast_room_event(room["id"], {"type": "player_joined", "userId": user_id})
     existing_players.append(new_player)
     return {"room": room, "players": existing_players, "joined": True}
 
@@ -430,12 +439,14 @@ async def get_room(code: str):
 
 
 @router.post("/rooms/{code}/start")
-async def start_match(code: str, req: StartMatchRequest):
+async def start_match(code: str, req: StartMatchRequest, user: dict = Depends(get_current_user)):
+    # IDOR FIX: Use authenticated user's ID
+    user_id = user["user_id"]
     rows = await _sb_select("onevone_rooms", f"code=eq.{code.strip().upper()}&select=*&limit=1")
     if not rows:
         raise HTTPException(status_code=404, detail="رمز الغرفة غير موجود")
     room = rows[0]
-    if str(room["owner_user_id"]) != str(req.userId):
+    if str(room["owner_user_id"]) != str(user_id):
         raise HTTPException(status_code=403, detail="فقط مالك الغرفة يستطيع بدء المباراة")
     if room["status"] != "open":
         raise HTTPException(status_code=409, detail="المباراة بدأت بالفعل أو الغرفة مغلقة")
@@ -447,12 +458,13 @@ async def start_match(code: str, req: StartMatchRequest):
     # pick the challenge (manual or random)
     if room["challenge_source"].startswith("manual:"):
         challenge_id = room["challenge_source"].split(":", 1)[1]
-        # detect type by trying the 4 tables
+        # detect type by trying the 5 tables
         challenge_type = "crypto"
         for tname, ctype in (
             ("code_fixing_challenges", "code-fixing"),
             ("log_analysis_challenges", "log-analysis"),
             ("vulnerability_hunter_challenges", "vulnerability-hunter"),
+            ("steganography_challenges", "steganography"),
             ("encryption_challenges", "crypto"),
         ):
             rs = await _sb_select(tname, f"id=eq.{challenge_id}&select=id&limit=1")
@@ -498,13 +510,15 @@ async def start_match(code: str, req: StartMatchRequest):
 
 
 @router.post("/rooms/{code}/leave")
-async def leave_room(code: str, req: LeaveRoomRequest):
+async def leave_room(code: str, req: LeaveRoomRequest, user: dict = Depends(get_current_user)):
+    # IDOR FIX: Use authenticated user's ID
+    user_id = user["user_id"]
     rows = await _sb_select("onevone_rooms", f"code=eq.{code.strip().upper()}&select=*&limit=1")
     if not rows:
         raise HTTPException(status_code=404, detail="رمز الغرفة غير موجود")
     room = rows[0]
     # only remove the player row if present
-    await _sb_delete("onevone_players", f"room_id=eq.{room['id']}&user_id=eq.{req.userId}")
+    await _sb_delete("onevone_players", f"room_id=eq.{room['id']}&user_id=eq.{user_id}")
     # if match is in progress, abandon with the OTHER user as winner
     ms = await _sb_select("onevone_matches", f"room_id=eq.{room['id']}&select=*&limit=1")
     if ms and ms[0]["state"] not in ("finished",):
@@ -512,7 +526,7 @@ async def leave_room(code: str, req: LeaveRoomRequest):
         winner = None
         players = await _sb_select("onevone_players", f"room_id=eq.{room['id']}&select=user_id")
         for p in players:
-            if str(p["user_id"]) != str(req.userId):
+            if str(p["user_id"]) != str(user_id):
                 winner = str(p["user_id"])
                 break
         patch = {
@@ -537,9 +551,11 @@ async def leave_room(code: str, req: LeaveRoomRequest):
 # --------------------------------------------------------------------------- #
 
 @router.post("/matches/{match_id}/ready")
-async def post_match_ready(match_id: str, req: ReadyRequest):
+async def post_match_ready(match_id: str, req: ReadyRequest, user: dict = Depends(get_current_user)):
     """Mark this client as ready. The match timer starts when BOTH
     clients have called this endpoint (or READY_TIMEOUT_S elapses)."""
+    # IDOR FIX: Use authenticated user's ID
+    user_id = user["user_id"]
     ms = await _sb_select("onevone_matches", f"id=eq.{match_id}&select=*&limit=1")
     if not ms:
         raise HTTPException(status_code=404, detail="المباراة غير موجودة")
@@ -547,9 +563,9 @@ async def post_match_ready(match_id: str, req: ReadyRequest):
     if match["state"] not in ("countdown", "ready"):
         raise HTTPException(status_code=409, detail="المباراة بدأت بالفعل أو انتهت")
     ps = await _sb_select("onevone_players", f"room_id=eq.{match['room_id']}&select=user_id")
-    if not any(str(p["user_id"]) == str(req.userId) for p in ps):
+    if not any(str(p["user_id"]) == str(user_id) for p in ps):
         raise HTTPException(status_code=403, detail="لست لاعباً في هذه المباراة")
-    await _mark_player_ready(match_id, str(req.userId), match["room_id"])
+    await _mark_player_ready(match_id, str(user_id), match["room_id"])
     return {"ok": True, "ready_count": len(_match_ready.get(match_id, set()))}
 
 
@@ -582,7 +598,9 @@ async def _mark_player_ready(match_id: str, user_id: str, room_id: str) -> None:
 # --------------------------------------------------------------------------- #
 
 @router.post("/matches/{match_id}/submit")
-async def submit_answer(match_id: str, req: SubmitRequest):
+async def submit_answer(match_id: str, req: SubmitRequest, user: dict = Depends(get_current_user)):
+    # IDOR FIX: Use authenticated user's ID
+    user_id = user["user_id"]
     ms = await _sb_select("onevone_matches", f"id=eq.{match_id}&select=*&limit=1")
     if not ms:
         raise HTTPException(status_code=404, detail="المباراة غير موجودة")
@@ -594,7 +612,7 @@ async def submit_answer(match_id: str, req: SubmitRequest):
 
     # verify submitter is a player
     ps = await _sb_select("onevone_players", f"room_id=eq.{match['room_id']}&select=*&order=slot.asc")
-    if not any(str(p["user_id"]) == str(req.userId) for p in ps):
+    if not any(str(p["user_id"]) == str(user_id) for p in ps):
         raise HTTPException(status_code=403, detail="لست لاعباً في هذه المباراة")
 
     # route to the right verifier
@@ -606,7 +624,7 @@ async def submit_answer(match_id: str, req: SubmitRequest):
     if not is_blue_clientverdict:
         challenge_row = await _load_challenge_row(match["challenge_id"], match["challenge_type"])
 
-    if match["challenge_type"] == "crypto":
+    if match["challenge_type"] in ("crypto", "steganography"):
         # Red team: deterministic flag match. Server is the source of truth.
         correct = _check_red_answer(challenge_row, str(req.submission or ""))
     elif match["challenge_type"] in ("code-fixing", "log-analysis", "vulnerability-hunter"):
@@ -640,7 +658,7 @@ async def submit_answer(match_id: str, req: SubmitRequest):
     # log the submission
     sub_row = await _sb_insert("onevone_submissions", {
         "match_id": match_id,
-        "user_id": req.userId,
+        "user_id": user_id,
         "submission": str(req.submission)[:8000] if not isinstance(req.submission, (dict, list)) else json.dumps(req.submission, ensure_ascii=False)[:8000],
         "is_correct": bool(correct),
         "is_final": False,
@@ -662,7 +680,7 @@ async def submit_answer(match_id: str, req: SubmitRequest):
                 rpc_url,
                 json={
                     "p_match_id": match_id,
-                    "p_user_id": req.userId,
+                    "p_user_id": user_id,
                     "p_win_reason": win_reason,
                 },
                 headers=_sb_headers(content_type=True),
@@ -693,7 +711,7 @@ async def submit_answer(match_id: str, req: SubmitRequest):
             # from the players list.
             await _broadcast_room_event(match["room_id"], {
                 "type": "match_finished",
-                "winner": req.userId,
+                "winner": user_id,
                 "reason": win_reason,
             })
             try:
@@ -710,7 +728,7 @@ async def submit_answer(match_id: str, req: SubmitRequest):
             return {
                 "correct": True,
                 "won": True,
-                "winner_id": req.userId,
+                "winner_id": user_id,
                 "submission": sub_row,
             }
         # race lost: tell the loser who actually won
@@ -729,15 +747,17 @@ async def submit_answer(match_id: str, req: SubmitRequest):
 # --------------------------------------------------------------------------- #
 
 @router.get("/matches/{match_id}/challenge")
-async def get_match_challenge(match_id: str, userId: str):
+async def get_match_challenge(match_id: str, user: dict = Depends(get_current_user)):
     """Return the challenge data for the given match in the existing
     TrainingData shape — frontend reuses TrainingSession as-is."""
+    # IDOR FIX: Use authenticated user's ID
+    user_id = user["user_id"]
     ms = await _sb_select("onevone_matches", f"id=eq.{match_id}&select=*&limit=1")
     if not ms:
         raise HTTPException(status_code=404, detail="المباراة غير موجودة")
     match = ms[0]
     ps = await _sb_select("onevone_players", f"room_id=eq.{match['room_id']}&select=user_id")
-    if not any(str(p["user_id"]) == str(userId) for p in ps):
+    if not any(str(p["user_id"]) == str(user_id) for p in ps):
         raise HTTPException(status_code=403, detail="لست لاعباً في هذه المباراة")
     # delegate to the existing mapper in app.services.challenge_loader
     from app.services.challenge_loader import (
@@ -745,6 +765,7 @@ async def get_match_challenge(match_id: str, userId: str):
         map_code_fixing_row_to_training as _map_code_fixing_row_to_training,
         map_log_analysis_row_to_training as _map_log_analysis_row_to_training,
         map_vuln_hunter_row_to_training as _map_vuln_hunter_row_to_training,
+        map_steganography_row_to_training as _map_steganography_row_to_training,
     )
     row = await _load_challenge_row(match["challenge_id"], match["challenge_type"])
     # team_role on the row is the source of truth for evaluator side
@@ -757,6 +778,8 @@ async def get_match_challenge(match_id: str, userId: str):
         training = _map_log_analysis_row_to_training(row, team_role)
     elif match["challenge_type"] == "vulnerability-hunter":
         training = _map_vuln_hunter_row_to_training(row, team_role)
+    elif match["challenge_type"] == "steganography":
+        training = _map_steganography_row_to_training(row, team_role)
     else:
         training = _map_encryption_row_to_training(row, team_role)
     # Auto-mark this player as ready: a client that successfully fetched the
@@ -764,7 +787,7 @@ async def get_match_challenge(match_id: str, userId: str):
     # also POST /ready — the implicit signal is enough. /ready still works
     # as a backup for clients whose challenge load failed and recovered.
     if match["state"] in ("countdown", "ready"):
-        await _mark_player_ready(match_id, str(userId), match["room_id"])
+        await _mark_player_ready(match_id, str(user_id), match["room_id"])
     return {"training": training, "match": _serialize_match(match)}
 
 

app/api/terminal.py

@@ -1,9 +1,13 @@
 """``/api/training/terminal*`` — the in-process OS simulator endpoints."""
 
 import os
+import re
 
-from fastapi import APIRouter
+from fastapi import APIRouter, Depends, Request
+from slowapi import Limiter
+from slowapi.util import get_remote_address
 
+from app.core.auth import get_current_user
 from app.sandbox.terminal import run_terminal_command
 from app.sandbox.workdir import get_or_create_workdir, safe_join
 from app.types import (
@@ -15,31 +19,49 @@ from app.types import (
 
 router = APIRouter()
 
+# Rate limiter: 30 terminal commands per minute per IP
+limiter = Limiter(key_func=get_remote_address)
+
 
 @router.post("/api/training/terminal")
-async def post_terminal(req: TerminalRequest):
+@limiter.limit("30/minute")
+async def post_terminal(request: Request, req: TerminalRequest, user: dict = Depends(get_current_user)):
     """Execute a terminal command in the challenge's sandbox for real."""
-    team_role = req.teamRole or "red"
-    return await run_terminal_command(team_role, req.challengeId, req.command)
+    # IDOR FIX: Use authenticated user's team role from JWT
+    team_role = user.get("team_role", "red")[:10]
+    challenge_id = re.sub(r"[^a-f0-9\-]", "", req.challengeId)[:128]
+    command = (req.command or "")[:500]  # Limit command length
+    
+    if not challenge_id or not command:
+        return {"stdout": "", "stderr": "❌ مدخلات غير صالحة", "exitCode": 1}
+    
+    return await run_terminal_command(team_role, challenge_id, command)
 
 
 @router.post("/api/training/terminal/write")
-async def post_terminal_write(req: TerminalWriteRequest):
+@limiter.limit("20/minute")
+async def post_terminal_write(request: Request, req: TerminalWriteRequest, user: dict = Depends(get_current_user)):
     """Write/edit a file inside the sandbox workdir (path-traversal safe)."""
-    team_role = req.teamRole or "red"
-    challenge_id = req.challengeId
+    # IDOR FIX: Use authenticated user's team role from JWT
+    team_role = user.get("team_role", "red")[:10]
+    challenge_id = re.sub(r"[^a-f0-9\-]", "", req.challengeId)[:128]
+    
     if not challenge_id:
         return {"ok": False, "error": "❌ challengeId مفقود"}
     if not req.filename:
         return {"ok": False, "error": "❌ اسم الملف مفقود"}
+    
+    # Sanitize filename
+    filename = re.sub(r"[^a-zA-Z0-9\.\-_\/]", "", req.filename)[:200]
+    
     if len(req.content) > 200_000:
         return {"ok": False, "error": "❌ الملف كبير جداً (الحد 200KB)"}
 
     workdir, _row = await get_or_create_workdir(team_role, challenge_id)
     try:
-        target = safe_join(workdir, req.filename)
+        target = safe_join(workdir, filename)
     except ValueError as e:
-        return {"ok": False, "error": f"❌ مسار غير مسموح: {e}"}
+        return {"ok": False, "error": "❌ مسار غير مسموح"}
 
     try:
         os.makedirs(os.path.dirname(target) or workdir, exist_ok=True)
@@ -47,14 +69,17 @@ async def post_terminal_write(req: TerminalWriteRequest):
             f.write(req.content)
         return {"ok": True, "path": os.path.relpath(target, workdir).replace("\\", "/")}
     except Exception as e:
-        return {"ok": False, "error": f"❌ تعذّر الحفظ: {e}"}
+        return {"ok": False, "error": "❌ تعذّر الحفظ"}
 
 
 @router.post("/api/training/terminal/list")
-async def post_terminal_list(req: TerminalListRequest):
+@limiter.limit("60/minute")
+async def post_terminal_list(request: Request, req: TerminalListRequest, user: dict = Depends(get_current_user)):
     """List files currently in the sandbox workdir (for the file explorer)."""
-    team_role = req.teamRole or "red"
-    challenge_id = req.challengeId
+    # IDOR FIX: Use authenticated user's team role from JWT
+    team_role = user.get("team_role", "red")[:10]
+    challenge_id = re.sub(r"[^a-f0-9\-]", "", req.challengeId)[:128]
+    
     if not challenge_id:
         return {"files": []}
 

app/api/training.py

@@ -9,8 +9,9 @@ Per-type generation / mapping logic lives in
 from typing import Optional
 import random
 
-from fastapi import APIRouter, BackgroundTasks, HTTPException
+from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException
 
+from app.core.auth import get_current_user
 from app.core.constants import CYBER_SECURITY_TOPICS
 from app.core.module_router import challenge_type_for_module
 from app.services.challenge_loader import (
@@ -334,7 +335,9 @@ async def _fetch_random_scenario_typed(
 # --------------------------------------------------------------------------- #
 
 @router.post("/api/training/evaluate")
-async def post_evaluate_training(req: EvaluateRequest, background_tasks: BackgroundTasks):
+async def post_evaluate_training(req: EvaluateRequest, background_tasks: BackgroundTasks, user: dict = Depends(get_current_user)):
+    # IDOR FIX: Override userId from JWT
+    req.userId = user["user_id"]
     return await evaluate_training(req, background_tasks)
 
 
@@ -343,7 +346,9 @@ async def post_evaluate_training(req: EvaluateRequest, background_tasks: Backgro
 # --------------------------------------------------------------------------- #
 
 @router.post("/api/training/evaluate-code-fix")
-async def post_evaluate_code_fix(req: CodeFixEvaluateRequest, background_tasks: BackgroundTasks):
+async def post_evaluate_code_fix(req: CodeFixEvaluateRequest, background_tasks: BackgroundTasks, user: dict = Depends(get_current_user)):
+    # IDOR FIX: Override userId from JWT
+    req.userId = user["user_id"]
     return await evaluate_code_fix(req, background_tasks)
 
 
@@ -352,7 +357,9 @@ async def post_evaluate_code_fix(req: CodeFixEvaluateRequest, background_tasks:
 # --------------------------------------------------------------------------- #
 
 @router.post("/api/training/evaluate-log-analysis")
-async def post_evaluate_log_analysis(req: LogAnalysisEvaluateRequest, background_tasks: BackgroundTasks):
+async def post_evaluate_log_analysis(req: LogAnalysisEvaluateRequest, background_tasks: BackgroundTasks, user: dict = Depends(get_current_user)):
+    # IDOR FIX: Override userId from JWT
+    req.userId = user["user_id"]
     return await evaluate_log_analysis(req, background_tasks)
 
 
@@ -361,7 +368,9 @@ async def post_evaluate_log_analysis(req: LogAnalysisEvaluateRequest, background
 # --------------------------------------------------------------------------- #
 
 @router.post("/api/training/evaluate-vulnerability-hunter")
-async def post_evaluate_vuln_hunter(req: VulnHunterEvaluateRequest, background_tasks: BackgroundTasks):
+async def post_evaluate_vuln_hunter(req: VulnHunterEvaluateRequest, background_tasks: BackgroundTasks, user: dict = Depends(get_current_user)):
+    # IDOR FIX: Override userId from JWT
+    req.userId = user["user_id"]
     return await evaluate_vuln_hunter(req, background_tasks)
 
 

app/api/xp.py

@@ -1,26 +1,33 @@
 """``/api/xp`` — proxy to the Supabase ``apex-xp`` edge function."""
 
 import httpx
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException, Request
+from slowapi import Limiter
+from slowapi.util import get_remote_address
 
+from app.core.auth import get_current_user
 from app.core.config import SUPABASE_EDGE_URL
 from app.types import XpRequest
 
 
 router = APIRouter()
 
+# Rate limiter: 10 XP requests per minute per IP
+limiter = Limiter(key_func=get_remote_address)
+
 
 @router.post("/api/xp")
-async def handle_xp(req: XpRequest):
-    if not req.user_id:
-        raise HTTPException(status_code=400, detail="user_id is required")
+@limiter.limit("10/minute")
+async def handle_xp(request: Request, req: XpRequest, user: dict = Depends(get_current_user)):
+    # IDOR FIX: Use authenticated user's ID from JWT, ignore client-provided user_id
+    user_id = user["user_id"]
 
     async with httpx.AsyncClient(timeout=30) as client:
         resp = await client.post(
             f"{SUPABASE_EDGE_URL}/apex-xp",
-            json={"action": req.action, "user_id": req.user_id, "xp_amount": req.xp_amount},
+            json={"action": req.action, "user_id": user_id, "xp_amount": req.xp_amount},
         )
     data = resp.json()
     if resp.status_code != 200:
-        raise HTTPException(status_code=resp.status_code, detail=data.get("error", "XP operation failed"))
+        raise HTTPException(status_code=resp.status_code, detail="XP operation failed")
     return data

app/core/auth.py

@@ -0,0 +1,98 @@
+"""JWT Authentication middleware for CyberArena.
+
+Validates Supabase JWT tokens from the Authorization header and
+extracts the authenticated user_id. This prevents user ID spoofing.
+"""
+
+import jwt
+from typing import Optional
+
+from fastapi import Request, HTTPException, status
+
+from app.core.config import SUPABASE_ANON_KEY
+
+
+def _validate_jwt(token: str) -> Optional[dict]:
+    """Validate JWT and return payload if valid.
+    
+    Uses PyJWT to verify:
+    1. Token format is valid JWT
+    2. Token signature is valid (using Supabase JWT secret)
+    3. Token is not expired (exp claim)
+    4. Token has required claims (sub for user_id)
+    
+    The JWT secret is derived from the anon key's JWT payload.
+    In production, set SUPABASE_JWT_SECRET env var with the actual secret.
+    """
+    import os
+    
+    # Get JWT secret from environment (must be set in production)
+    jwt_secret = os.environ.get("SUPABASE_JWT_SECRET", "")
+    
+    if not jwt_secret:
+        # Fallback: decode anon key to get the secret for development
+        # In production, ALWAYS set SUPABASE_JWT_SECRET
+        try:
+            # Extract secret from anon key (development only)
+            payload = jwt.decode(SUPABASE_ANON_KEY, options={"verify_signature": False})
+            # For dev, use a derived secret - in production this MUST be the real JWT secret
+            jwt_secret = SUPABASE_ANON_KEY[:32]  # Not secure, dev only
+        except Exception:
+            return None
+    
+    try:
+        # Verify signature and decode
+        payload = jwt.decode(
+            token, 
+            jwt_secret, 
+            algorithms=["HS256"],
+            options={"require": ["exp", "sub"]}
+        )
+        return payload
+    except jwt.ExpiredSignatureError:
+        return None
+    except jwt.InvalidTokenError:
+        return None
+
+
+async def get_current_user(request: Request) -> dict:
+    """FastAPI dependency that extracts authenticated user from JWT.
+    
+    Returns:
+        dict with keys: user_id, email, role
+    
+    Raises:
+        HTTPException 401 if no valid token
+    """
+    auth_header = request.headers.get("Authorization", "")
+    
+    if not auth_header.startswith("Bearer "):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Missing or invalid Authorization header",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    
+    token = auth_header[7:]  # Remove "Bearer " prefix
+    
+    payload = _validate_jwt(token)
+    if not payload:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or expired token",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    
+    return {
+        "user_id": payload["sub"],
+        "email": payload.get("email", ""),
+        "role": payload.get("role", "authenticated"),
+    }
+
+
+async def get_optional_user(request: Request) -> Optional[dict]:
+    """Like get_current_user but returns None instead of raising 401."""
+    try:
+        return await get_current_user(request)
+    except HTTPException:
+        return None

app/generators/vulnerability_hunter.py

@@ -30,9 +30,9 @@ Difficulty uses 5 levels (Beginner / Easy / Medium / Hard / Expert), mapped
 to Arabic values already in the platform: مبتدئ / سهل / متوسط / صعب / خبير.
 
 Public API (used by main.py):
-    - POOL_TARGET = 15
-    - POOL_THRESHOLD = 5
-    - POOL_BATCH = 5
+    - POOL_TARGET = 5
+    - POOL_THRESHOLD = 2
+    - POOL_BATCH = 3
     - get_pool_count(team_role) -> int
     - async refill_pool(team_role, count) -> int
     - async start_pool_watcher(team_role)
@@ -262,10 +262,10 @@ DIFFICULTY_PROFILE = {
 }
 
 # Pool constants
-# 5 difficulty levels × 3 unique challenges per level = 15 unique challenges
-POOL_TARGET = 15
-POOL_THRESHOLD = 5
-POOL_BATCH = 5
+# Target: 5 challenges always available, refill when drops below 3
+POOL_TARGET = 5
+POOL_THRESHOLD = 2
+POOL_BATCH = 3
 
 SUPABASE_URL = os.environ.get("SUPABASE_URL", "")
 SUPABASE_ANON_KEY = os.environ.get("SUPABASE_ANON_KEY", "")

app/main.py

@@ -16,8 +16,12 @@ import asyncio
 import os
 import sys
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
+from slowapi import Limiter, _rate_limit_exceeded_handler
+from slowapi.util import get_remote_address
+from slowapi.errors import RateLimitExceeded
 
 from app.generators import REGISTRY as GENERATOR_REGISTRY
 
@@ -33,17 +37,43 @@ except Exception:
 #  App + middleware                                                           #
 # --------------------------------------------------------------------------- #
 
+# Rate limiter - 100 requests per minute per IP for general endpoints
+# Stricter limits for sensitive endpoints
+limiter = Limiter(key_func=get_remote_address)
+
 app = FastAPI(title="CyberArena Backend")
 
+# Add rate limiter to app
+app.state.limiter = limiter
+app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
+
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    allow_origins=[
+        "http://localhost:5173",
+        "http://localhost:3000",
+        "http://127.0.0.1:5173",
+        "https://alpha-team-cyberarena.hf.space",
+    ],
     allow_credentials=True,
-    allow_methods=["*"],
+    allow_methods=["GET", "POST"],
     allow_headers=["*"],
 )
 
 
+# Security headers middleware
+@app.middleware("http")
+async def add_security_headers(request: Request, call_next):
+    response = await call_next(request)
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["X-Frame-Options"] = "DENY"
+    response.headers["X-XSS-Protection"] = "1; mode=block"
+    response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+    response.headers["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
+    response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+    return response
+
+
 # --------------------------------------------------------------------------- #
 #  Routers                                                                    #
 # --------------------------------------------------------------------------- #
@@ -111,7 +141,7 @@ async def startup_event():
 # Run this as soon as a worker imports the module. It only fires once
 # (see app/_env.py::_is_loaded_marker_set) and gives a clear, single-line
 # error instead of a 401 from Supabase ten seconds later.
-assert_critical_env("SUPABASE_URL", "SUPABASE_ANON_KEY")
+assert_critical_env("SUPABASE_URL", "SUPABASE_ANON_KEY", "SUPABASE_JWT_SECRET")
 
 
 __all__ = ["app", "populate_pool_background"]

app/sandbox/terminal.py

@@ -2,8 +2,8 @@
 
 Parses a single command with ``shlex``, runs built-ins via
 :mod:`app.sandbox.tools`, and runs external tools via subprocess — but
-only if the challenge row whitelists them. ``python`` / ``python3`` are
-always allowed so the student can run their own scripts.
+only if the challenge row whitelists them. Python execution is sandboxed
+with restricted imports.
 
 Returns the standard ``{stdout, stderr, exitCode}`` dict (plus ``clear``
 for the ``clear`` built-in). Used by :mod:`app.api.terminal`.
@@ -12,6 +12,7 @@ for the ``clear`` built-in). Used by :mod:`app.api.terminal`.
 import os
 import shlex
 import subprocess
+import sys
 from typing import Optional
 
 from .workdir import get_or_create_workdir
@@ -19,7 +20,99 @@ from .tools import shell_builtins
 
 
 # External tools that are always allowed regardless of row whitelist.
-ALWAYS_ALLOWED = {"python", "python3", "py"}
+# NOTE: Python is NOT in this list anymore — it must be explicitly whitelisted.
+ALWAYS_ALLOWED: set[str] = set()
+
+# Dangerous Python modules that must be blocked
+BLOCKED_PYTHON_MODULES = {
+    "os", "subprocess", "shutil", "sys", "importlib", "ctypes",
+    "socket", "http", "urllib", "requests", "eval", "exec",
+    "pickle", "marshal", "shelve", "signal", "multiprocessing",
+    "threading", "asyncio", "pathlib",
+}
+
+
+def _run_restricted_python(code: str, workdir: str, env: dict) -> dict:
+    """Execute Python code in a restricted environment."""
+    import tempfile
+    
+    # Create a wrapper script that blocks dangerous modules
+    wrapper_code = f'''
+import sys
+import os
+
+# Change to workdir
+os.chdir(r"{workdir}")
+
+# Block dangerous modules
+_blocked = {repr(BLOCKED_PYTHON_MODULES)}
+
+class _BlockImporter:
+    def find_module(self, name, path=None):
+        top = name.split('.')[0]
+        if top in _blocked or name in _blocked:
+            return self
+        return None
+    def load_module(self, name):
+        raise ImportError(f"Module '{{name}}' is blocked in the sandbox")
+
+sys.meta_path.insert(0, _BlockImporter())
+
+# Block dangerous builtins
+import builtins
+_original_eval = builtins.eval
+_original_exec = builtins.exec
+def _safe_eval(*a, **kw):
+    raise RuntimeError("eval() is disabled in the sandbox")
+def _safe_exec(*a, **kw):
+    raise RuntimeError("exec() is disabled in the sandbox")
+builtins.eval = _safe_eval
+builtins.exec = _safe_exec
+
+# Execute user code
+try:
+{chr(10).join("    " + line for line in code.split(chr(10)))}
+except Exception as e:
+    print(f"Error: {{e}}", file=sys.stderr)
+    sys.exit(1)
+'''
+    
+    try:
+        # Write wrapper to temp file
+        with tempfile.NamedTemporaryFile(
+            mode='w', suffix='.py', delete=False, 
+            encoding='utf-8', dir=workdir
+        ) as f:
+            f.write(wrapper_code)
+            script_path = f.name
+        
+        # Execute the restricted script
+        proc = subprocess.run(
+            [sys.executable, script_path],
+            cwd=workdir,
+            capture_output=True,
+            timeout=8,
+            env=env,
+        )
+        
+        stdout = (proc.stdout or b"").decode("utf-8", errors="replace")
+        stderr = (proc.stderr or b"").decode("utf-8", errors="replace")
+        
+        # Clean up
+        try:
+            os.unlink(script_path)
+        except:
+            pass
+        
+        return {
+            "stdout": stdout[:8000],
+            "stderr": stderr[:3000],
+            "exitCode": proc.returncode,
+        }
+    except subprocess.TimeoutExpired:
+        return {"stdout": "", "stderr": "⏱️ انتهت المهلة (8 ثوانٍ).", "exitCode": 124}
+    except Exception as e:
+        return {"stdout": "", "stderr": "❌ خطأ غير متوقع في تنفيذ Python", "exitCode": 1}
 
 
 def parse_command(command: str) -> Optional[list[str]]:
@@ -82,6 +175,22 @@ async def run_terminal_command(team_role: str, challenge_id: str, command: str)
         env = os.environ.copy()
         env["PYTHONIOENCODING"] = "utf-8"
         env["PYTHONUTF8"] = "1"
+        
+        # For Python execution, use restricted mode
+        if tool in ("python", "python3", "py") and len(parts) > 1:
+            if parts[1] == "-c":
+                # Execute Python code with restrictions
+                user_code = " ".join(parts[2:])
+                return _run_restricted_python(user_code, workdir, env)
+            elif parts[1].endswith(".py"):
+                # Execute Python file with restrictions
+                script_path = os.path.join(workdir, parts[1])
+                if not os.path.exists(script_path):
+                    return {"stdout": "", "stderr": f"❌ الملف '{parts[1]}' غير موجود", "exitCode": 1}
+                with open(script_path, "r", encoding="utf-8", errors="replace") as f:
+                    user_code = f.read()
+                return _run_restricted_python(user_code, workdir, env)
+        
         proc = subprocess.run(
             parts,
             cwd=workdir,
@@ -101,4 +210,4 @@ async def run_terminal_command(team_role: str, challenge_id: str, command: str)
     except subprocess.TimeoutExpired:
         return {"stdout": "", "stderr": "⏱️ انتهت المهلة (8 ثوانٍ). قد يكون الأمر يدور في حلقة لا نهائية.", "exitCode": 124}
     except Exception as e:
-        return {"stdout": "", "stderr": f"❌ خطأ: {e}", "exitCode": 1}
+        return {"stdout": "", "stderr": "❌ خطأ غير متوقع", "exitCode": 1}

app/sandbox/tools.py

@@ -14,6 +14,22 @@ from typing import Optional
 from app.core.constants import HELP_TEXT
 
 
+def _safe_path(workdir: str, filename: str) -> Optional[str]:
+    """Resolve filename safely within workdir, preventing path traversal.
+    
+    Returns the resolved path if safe, None if traversal detected.
+    """
+    # Strip leading slashes and replace ..
+    cleaned = filename.lstrip("/\\").replace("..", "_")
+    target = os.path.normpath(os.path.join(workdir, cleaned))
+    # Verify the resolved path is within workdir
+    real_workdir = os.path.realpath(workdir)
+    real_target = os.path.realpath(target)
+    if not real_target.startswith(real_workdir + os.sep) and real_target != real_workdir:
+        return None
+    return target
+
+
 def shell_builtins(args: list[str], workdir: str) -> Optional[dict]:
     """Run a built-in command. Returns a ``{stdout, stderr, exitCode}``
     result dict, or ``None`` if the tool is not a built-in (caller should
@@ -26,7 +42,10 @@ def shell_builtins(args: list[str], workdir: str) -> Optional[dict]:
                 return {"stdout": "", "stderr": "cat: missing filename", "exitCode": 1}
             out, err = [], ""
             for fname in rest:
-                p = os.path.join(workdir, fname.lstrip("/\\").replace("..", "_"))
+                p = _safe_path(workdir, fname)
+                if p is None:
+                    err += f"cat: {fname}: Path traversal blocked\n"
+                    continue
                 if not os.path.isfile(p):
                     err += f"cat: {fname}: No such file\n"
                     continue
@@ -61,7 +80,10 @@ def shell_builtins(args: list[str], workdir: str) -> Optional[dict]:
                 return {"stdout": "", "stderr": f"{tool}: missing filename", "exitCode": 1}
             out, err = [], ""
             for fname in rest:
-                p = os.path.join(workdir, fname.lstrip("/\\").replace("..", "_"))
+                p = _safe_path(workdir, fname)
+                if p is None:
+                    err += f"{tool}: {fname}: Path traversal blocked\n"
+                    continue
                 if not os.path.isfile(p):
                     err += f"{tool}: {fname}: No such file\n"
                     continue
@@ -178,12 +200,22 @@ def shell_builtins(args: list[str], workdir: str) -> Optional[dict]:
             try:
                 out_lines = [f"Archive: {fname}"]
                 with zipfile.ZipFile(p, 'r') as zip_ref:
+                    # Validate all paths before extraction (Zip Slip prevention)
+                    for info in zip_ref.infolist():
+                        target = os.path.realpath(os.path.join(workdir, info.filename))
+                        if not target.startswith(os.path.realpath(workdir) + os.sep) and target != os.path.realpath(workdir):
+                            return {
+                                "stdout": "",
+                                "stderr": f"unzip: blocked path traversal: {info.filename}",
+                                "exitCode": 1,
+                            }
+                    # Safe to extract
                     zip_ref.extractall(workdir)
                     for info in zip_ref.infolist():
                         out_lines.append(f"  extracting: {info.filename}")
                 return {"stdout": "\n".join(out_lines), "stderr": "", "exitCode": 0}
             except Exception as e:
-                return {"stdout": "", "stderr": f"unzip: error: {e}", "exitCode": 1}
+                return {"stdout": "", "stderr": "unzip: error occurred", "exitCode": 1}
 
     except Exception as e:
         return {"stdout": "", "stderr": f"{tool}: {e}", "exitCode": 1}

app/services/evaluator.py

@@ -62,9 +62,6 @@ async def evaluate_training(req, background_tasks: BackgroundTasks) -> dict:
 كود/استغلال المستخدم:
 {user_code}"""
 
-    print(f"[DEBUG] GROQ_API_KEY exists: {bool(GROQ_API_KEY)}")
-    print(f"[DEBUG] GROQ_API_KEY length: {len(GROQ_API_KEY) if GROQ_API_KEY else 0}")
-
     async with httpx.AsyncClient(timeout=60) as client:
         resp = await client.post(
             GROQ_API_URL,
@@ -83,16 +80,15 @@ async def evaluate_training(req, background_tasks: BackgroundTasks) -> dict:
             },
         )
 
-    print(f"[DEBUG] Groq API response status: {resp.status_code}")
     if resp.status_code != 200:
-        error_detail = f"Groq API error: {resp.status_code}"
+        # Log error server-side only, don't leak to client
+        import logging
+        logging.error(f"Groq API error: {resp.status_code}")
         try:
-            error_body = resp.text
-            print(f"[DEBUG] Groq API error body: {error_body}")
-            error_detail += f" - {error_body}"
+            logging.error(f"Groq API error body: {resp.text[:200]}")
         except Exception:
             pass
-        raise HTTPException(status_code=500, detail=error_detail)
+        raise HTTPException(status_code=500, detail="AI evaluation service temporarily unavailable")
 
     content = resp.json()["choices"][0]["message"]["content"]
     evaluation = parse_json_safe(content)

app/services/supabase_service.py

@@ -5,6 +5,7 @@ challenge-loader / scenario-service modules build on top of these.
 """
 
 import random
+import re
 from typing import Optional
 
 import httpx
@@ -12,6 +13,26 @@ import httpx
 from app.core.config import SUPABASE_URL, SUPABASE_ANON_KEY
 
 
+# --------------------------------------------------------------------------- #
+#  Input sanitization                                                          #
+# --------------------------------------------------------------------------- #
+
+def _sanitize_id(value: str) -> str:
+    """Strip anything that isn't a UUID or alphanumeric — prevents PostgREST injection."""
+    if not value:
+        return ""
+    return re.sub(r"[^a-zA-Z0-9\-]", "", value)[:128]
+
+
+def _sanitize_string(value: str, max_len: int = 200) -> str:
+    """Strip PostgREST operators and limit length."""
+    if not value:
+        return ""
+    # Remove PostgREST filter operators
+    cleaned = re.sub(r"[=&<>!|;()\[\]{}]", "", value)
+    return cleaned[:max_len]
+
+
 # --------------------------------------------------------------------------- #
 #  Table routing                                                              #
 # --------------------------------------------------------------------------- #
@@ -77,6 +98,13 @@ async def fetch_scenario_by_id(
     if not SUPABASE_ANON_KEY or not SUPABASE_URL:
         return None
 
+    # Sanitize inputs to prevent PostgREST injection
+    scenario_id = _sanitize_id(scenario_id)
+    team_role = _sanitize_string(team_role, 10)
+
+    if not scenario_id or not team_role:
+        return None
+
     async def _fetch(tbl: str) -> Optional[dict]:
         url = f"{SUPABASE_URL}/rest/v1/{tbl}?id=eq.{scenario_id}&team_role=eq.{team_role}"
         try:
@@ -126,6 +154,13 @@ async def fetch_random_scenario_from_supabase(
     if not SUPABASE_ANON_KEY or not SUPABASE_URL:
         return None
     table = scenario_table(team_role, challenge_type)
+    
+    # Sanitize inputs
+    team_role = _sanitize_string(team_role, 10)
+    module = _sanitize_string(module, 50)
+    
+    if not team_role:
+        return None
     # When ``module`` is empty we deliberately skip the module filter
     # — this is the "give me any row of this type" code path used by
     # the dashboard list. The previous behaviour built a

requirements.txt

@@ -1,8 +1,10 @@
-fastapi
-uvicorn
-httpx
-groq
-python-dotenv
-reportlab
-qrcode[pil]
-cryptography
+fastapi==0.115.0
+uvicorn==0.34.0
+httpx==0.28.0
+groq==0.13.0
+python-dotenv==1.0.1
+reportlab==4.2.5
+qrcode[pil]==8.0
+cryptography==44.0.0
+slowapi==0.1.9
+PyJWT==2.9.0