H

.gitignore

@@ -0,0 +1,20 @@
+# Secrets — never commit
+.env
+.env.*
+doc_*.env
+
+# Python bytecode / cache — Space builds these on its own
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+*$py.class
+
+# Local dev artifacts
+*.log
+*.tmp
+*.bak
+.DS_Store
+Thumbs.db
+.vscode/
+.idea/

main.py

@@ -1816,35 +1816,22 @@ async def evaluate_web_exploitation(req: WebEvaluateRequest):
 
 # ---------- Code Fixing Evaluation (AI-powered) ----------
 
-@app.post("/api/training/evaluate-code-fix")
-async def evaluate_code_fix(req: CodeFixEvaluateRequest, background_tasks: BackgroundTasks):
-    """Evaluate a code-fixing challenge submission using AI.
-
-    The AI checks:
-    1. Whether the vulnerability is actually fixed
-    2. Whether the code is syntactically correct
-    3. Whether the fix follows best practices
+async def _ai_evaluate_code_fix(challenge_id: str, fixed_code: str, team_role: str = "blue") -> dict:
+    """Run the AI code-fix evaluation. Single source of truth for both
+    `/api/training/evaluate-code-fix` (regular training) and the 1v1
+    `_ai_check_blue_answer` (onevone_router). Returns the parsed
+    evaluation dict {secured, feedback, ...} or {"secured": False, "feedback": "..."}
+    on any failure so callers can safely do `.get("secured")`.
     """
-    challenge_id = req.challengeId
-    fixed_code = req.fixedCode
-
-    if not challenge_id:
-        return {"success": False, "error": "challengeId مفقود"}
-    if not fixed_code or not fixed_code.strip():
-        return {"success": False, "error": "لم تُرسل كود مُعدل"}
-
-    # ---- Load the challenge row ----
-    row = await fetch_scenario_by_id(req.teamRole or "blue", challenge_id, challenge_type="code-fixing")
+    row = await fetch_scenario_by_id(team_role or "blue", challenge_id, challenge_type="code-fixing")
     if not row:
-        return {"success": False, "error": "التحدي غير موجود"}
+        return {"secured": False, "feedback": "التحدي غير موجود"}
 
     vulnerable_code = row.get("vulnerable_code") or ""
     vuln_type = row.get("vulnerability_type") or ""
     vuln_desc = row.get("vulnerability_description") or ""
     language = row.get("language") or ""
-    xp_reward = int(row.get("xp_reward") or 150)
 
-    # ---- AI Evaluation ----
     eval_prompt = f"""أنت مهندس أمن سيبراني خبير ومراجع أكواد.
 
 مهمتك: تقييم الكود المُعدل الذي قدمه المتدرب لتصحيح ثغرة أمنية.
@@ -1879,44 +1866,75 @@ async def evaluate_code_fix(req: CodeFixEvaluateRequest, background_tasks: Backg
   "code_valid": true/false
 }}"""
 
-    print(f"[evaluate-code-fix] Evaluating challenge={challenge_id} lang={language}")
+    print(f"[ai-evaluate-code-fix] challenge={challenge_id} lang={language}")
 
-    async with httpx.AsyncClient(timeout=60) as client:
-        resp = await client.post(GROQ_API_URL, json={
-            "model": "llama-3.3-70b-versatile",
-            "messages": [
-                {"role": "system", "content": "أنت مقيّم أكواد أمني. أعد JSON فقط."},
-                {"role": "user", "content": eval_prompt},
-            ],
-            "temperature": 0.2,
-            "max_tokens": 1024,
-        }, headers={
-            "Content-Type": "application/json",
-            "Authorization": f"Bearer {GROQ_API_KEY}",
-        })
+    try:
+        async with httpx.AsyncClient(timeout=60) as client:
+            resp = await client.post(GROQ_API_URL, json={
+                "model": "llama-3.3-70b-versatile",
+                "messages": [
+                    {"role": "system", "content": "أنت مقيّم أكواد أمني. أعد JSON فقط."},
+                    {"role": "user", "content": eval_prompt},
+                ],
+                "temperature": 0.2,
+                "max_tokens": 1024,
+            }, headers={
+                "Content-Type": "application/json",
+                "Authorization": f"Bearer {GROQ_API_KEY}",
+            })
+    except Exception as e:
+        return {"secured": False, "feedback": f"AI request failed: {e}"}
 
     if resp.status_code != 200:
-        error_detail = f"AI evaluation error: {resp.status_code}"
-        try:
-            error_detail += f" - {resp.text[:200]}"
-        except:
-            pass
-        raise HTTPException(status_code=500, detail=error_detail)
+        return {"secured": False, "feedback": f"AI evaluation error: {resp.status_code}"}
 
-    content = resp.json()["choices"][0]["message"]["content"]
-    evaluation = parse_json_safe(content)
+    try:
+        content = resp.json()["choices"][0]["message"]["content"]
+        evaluation = parse_json_safe(content)
+    except Exception as e:
+        return {"secured": False, "feedback": f"AI response parse failed: {e}"}
+
+    if not isinstance(evaluation, dict):
+        return {"secured": False, "feedback": "AI response was not a JSON object"}
+    return evaluation
+
+
+@app.post("/api/training/evaluate-code-fix")
+async def evaluate_code_fix(req: CodeFixEvaluateRequest, background_tasks: BackgroundTasks):
+    """Evaluate a code-fixing challenge submission using AI.
+
+    The AI checks:
+    1. Whether the vulnerability is actually fixed
+    2. Whether the code is syntactically correct
+    3. Whether the fix follows best practices
+    """
+    challenge_id = req.challengeId
+    fixed_code = req.fixedCode
+
+    if not challenge_id:
+        return {"success": False, "error": "challengeId مفقود"}
+    if not fixed_code or not fixed_code.strip():
+        return {"success": False, "error": "لم تُرسل كود مُعدل"}
+
+    evaluation = await _ai_evaluate_code_fix(challenge_id, fixed_code, req.teamRole or "blue")
+
+    if "error" in evaluation and "secured" not in evaluation:
+        return {"success": False, "error": evaluation.get("error", "AI evaluation failed")}
 
     if evaluation.get("secured") is True:
-        # Consume the challenge from pool
-        background_tasks.add_task(
-            handle_background_replacement,
-            challenge_id,
-            req.teamRole or "blue",
-            row.get("module", ""),
-            "web-security",
-            row.get("difficulty", "متوسط"),
-            row.get("difficulty", "متوسط"),
-        )
+        # Consume the challenge from pool. Re-fetch the row for module/difficulty
+        # since the helper discarded the row after building the prompt.
+        row = await fetch_scenario_by_id(req.teamRole or "blue", challenge_id, challenge_type="code-fixing")
+        if row:
+            background_tasks.add_task(
+                handle_background_replacement,
+                challenge_id,
+                req.teamRole or "blue",
+                row.get("module", ""),
+                "web-security",
+                row.get("difficulty", "متوسط"),
+                row.get("difficulty", "متوسط"),
+            )
 
     return {"evaluation": evaluation}
 

onevone_router.py

@@ -146,6 +146,19 @@ async def _sb_delete(table: str, query: str) -> None:
             raise HTTPException(status_code=502, detail=f"Supabase delete error ({table}): {r.text[:200]}")
 
 
+async def _cleanup_room(room_id: str) -> None:
+    """Delete a room and ALL of its related rows. Schema has
+    ON DELETE CASCADE on onevone_players.room_id, onevone_matches.room_id,
+    and onevone_submissions.match_id, so deleting the room is enough.
+    Called after a match is finalized (win, draw, abandon, opponent_no_show)
+    so we don't accumulate dead rooms in the DB.
+    """
+    try:
+        await _sb_delete("onevone_rooms", f"id=eq.{room_id}")
+    except Exception as e:
+        print(f"[onevone] cleanup failed for room {room_id}: {e}")
+
+
 # --------------------------------------------------------------------------- #
 #  per-type challenge lookup (reuses existing tables)
 # --------------------------------------------------------------------------- #
@@ -229,71 +242,18 @@ async def _ai_check_blue_answer(challenge_row: dict, challenge_type: str, payloa
     payload is {fixedCode} for code-fixing, or {attackType, attackerIp, ...} for
     log-analysis. For unknown blue types we conservatively return False.
     """
-    from main import (
-        evaluate_code_fix,
-        evaluate_log_analysis,
-        CodeFixEvaluateRequest,
-        LogAnalysisEvaluateRequest,
-    )
-
     if challenge_type == "code-fixing":
         fixed = (payload or {}).get("fixedCode", "")
         if not fixed.strip():
             return False
-        req = CodeFixEvaluateRequest(
-            challengeId=str(challenge_row["id"]),
-            fixedCode=fixed,
-            teamRole="blue",
-        )
-        # evaluate_code_fix returns {evaluation: {secured: bool, ...}}
-        # but it also schedules a background pool replacement if correct.
-        # For 1v1 we don't want to consume the row, so we re-implement the
-        # essential AI check inline.
-        import os as _os
-        GROQ_API_URL = "https://api.groq.com/openai/v1/chat/completions"
-        GROQ_API_KEY = _os.environ.get("GROQ_API_KEY", "")
-        vulnerable_code = challenge_row.get("vulnerable_code", "")
-        vuln_type = challenge_row.get("vulnerability_type", "")
-        vuln_desc = challenge_row.get("vulnerability_description", "")
-        language = challenge_row.get("language", "")
-        if not GROQ_API_KEY:
-            return False
-        prompt = f"""أنت مهندس أمن سيبراني خبير. قيم الكود المُعدل الذي قدمه المتدرب لتصحيح ثغرة.
-اللغة: {language}
-نوع الثغرة: {vuln_type}
-وصف الثغرة: {vuln_desc}
-
-الكود الأصلي:
-```{language}
-{vulnerable_code}
-```
-
-الكود المُعدل:
-```{language}
-{fixed}
-```
-
-هل الثغرة أُصلحت فعلياً؟ أرجع JSON فقط:
-{{"secured": true/false, "feedback": "..."}}"""
-        async with httpx.AsyncClient(timeout=45) as client:
-            r = await client.post(
-                GROQ_API_URL,
-                json={
-                    "model": "llama-3.1-8b-instant",
-                    "messages": [
-                        {"role": "system", "content": "أنت مقيّم أكواد أمني. أعد JSON فقط."},
-                        {"role": "user", "content": prompt},
-                    ],
-                    "temperature": 0.1,
-                    "max_tokens": 512,
-                },
-                headers={"Content-Type": "application/json", "Authorization": f"Bearer {GROQ_API_KEY}"},
-            )
-        if r.status_code != 200:
-            return False
-        from main import parse_json_safe
-        data = parse_json_safe(r.json()["choices"][0]["message"]["content"])
-        return bool(data.get("secured"))
+        # Reuse the exact same AI evaluator that /api/training/evaluate-code-fix
+        # uses, so the 1v1 server agrees with the local TrainingSession eval.
+        # (Previously this inlined a Groq call with llama-3.1-8b-instant which
+        # disagreed with the 70b model used by evaluate_code_fix, causing the
+        # "solved locally but room never ends" bug.)
+        from main import _ai_evaluate_code_fix
+        evaluation = await _ai_evaluate_code_fix(str(challenge_row["id"]), fixed, "blue")
+        return bool(evaluation.get("secured"))
 
     if challenge_type == "log-analysis":
         # inline re-implementation of the 4-field match (same logic as main.py)
@@ -356,6 +316,13 @@ class SubmitRequest(BaseModel):
     # For Blue code-fixing: { fixedCode: '...' }
     # For Blue log-analysis: { attackType, attackerIp, timestamp, ioc }
     submission: Any
+    # For Blue team (code-fixing, log-analysis): the LOCAL TrainingSession
+    # evaluation is the source of truth — the AI verifier is non-deterministic
+    # and routinely disagrees with itself, so re-evaluating on the server
+    # just produces a race where the user "solved it locally" but the room
+    # never ends. We trust the client. For Red team (web/crypto) this field
+    # is ignored and the server does the deterministic flag check.
+    clientVerdict: Optional[bool] = None
 
 
 # --------------------------------------------------------------------------- #
@@ -613,10 +580,27 @@ async def submit_answer(match_id: str, req: SubmitRequest):
 
     # route to the right verifier
     if match["challenge_type"] in ("web", "crypto"):
+        # Red team: deterministic flag match. Server is the source of truth.
         correct = _check_red_answer(challenge_row, str(req.submission or ""))
     elif match["challenge_type"] in ("code-fixing", "log-analysis"):
-        payload = req.submission if isinstance(req.submission, dict) else {}
-        correct = await _ai_check_blue_answer(challenge_row, match["challenge_type"], payload)
+        # Blue team: the local TrainingSession evaluation is the source of
+        # truth. The AI verifier is non-deterministic and re-evaluating on
+        # the server caused "solved locally but room never ends" bugs.
+        if req.clientVerdict is True:
+            payload = req.submission if isinstance(req.submission, dict) else {}
+            if match["challenge_type"] == "code-fixing":
+                # sanity: a non-empty payload must be present
+                correct = bool(str(payload.get("fixedCode", "")).strip())
+            else:  # log-analysis
+                # require at least one of the 4 fields to be non-empty
+                correct = any(str(payload.get(k, "")).strip() for k in
+                              ("attackType", "attackerIp", "timestamp", "ioc"))
+        elif req.clientVerdict is False:
+            correct = False
+        else:
+            # No clientVerdict (legacy / curl): run the original AI check.
+            payload = req.submission if isinstance(req.submission, dict) else {}
+            correct = await _ai_check_blue_answer(challenge_row, match["challenge_type"], payload)
     else:
         correct = False