Program.fs

module Shinogi.Program

open System
open System.IO
open System.Net
open System.Net.Http
open System.Text
open System.Threading.Tasks
open System.Linq
open Microsoft.AspNetCore.Builder
open Microsoft.Extensions.Hosting
open Microsoft.Extensions.DependencyInjection
open Microsoft.Extensions.Configuration
open Microsoft.EntityFrameworkCore
open Microsoft.AspNetCore.Identity
open Microsoft.AspNetCore.Authentication.JwtBearer
open Microsoft.IdentityModel.Tokens
open Microsoft.AspNetCore.Http
open Microsoft.AspNetCore.RateLimiting
open System.Threading.RateLimiting
open Microsoft.FSharp.Linq
open Microsoft.AspNetCore.Mvc
open Shinogi.Domain
open Shinogi.Data
open Shinogi.Dtos
open Shinogi.ViewModels
open Shinogi.Services
open Shinogi.Services.Scoring
open Shinogi.Services.Security
open Yarp.ReverseProxy

let configureServices (builder: WebApplicationBuilder) =
    builder.Services.AddDbContext<CtfdDbContext>(
        Action<DbContextOptionsBuilder>(fun opt ->
            opt.UseNpgsql(builder.Configuration.GetConnectionString("Default")) |> ignore)
    ) |> ignore

    builder.Services.AddIdentity<CtfdUser, IdentityRole<Guid>>(fun o ->
        o.SignIn.RequireConfirmedEmail <- true
        o.Password.RequireNonAlphanumeric <- false
        o.Password.RequireUppercase <- false)
        .AddEntityFrameworkStores<CtfdDbContext>()
        .AddDefaultTokenProviders()
        |> ignore

    let keyBytes = builder.Configuration["Jwt:Key"] |> Encoding.UTF8.GetBytes |> SymmetricSecurityKey

    builder.Services
        .AddAuthentication()
        .AddJwtBearer(fun o ->
            o.TokenValidationParameters <- TokenValidationParameters(
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateIssuerSigningKey = true,
                ValidIssuer = builder.Configuration["Jwt:Issuer"],
                ValidAudience = builder.Configuration["Jwt:Audience"],
                IssuerSigningKey = keyBytes))
        |> ignore

    builder.Services.AddAuthorization(fun opts ->
        opts.AddPolicy("AdminOnly", fun p -> p.RequireRole("Admins") |> ignore)) |> ignore

    builder.Services.AddRateLimiter(fun opts ->
        opts.GlobalLimiter <- PartitionedRateLimiter.Create(fun (ctx: HttpContext) ->
            let ip =
                match ctx.Connection.RemoteIpAddress with
                | null -> "unknown"
                | addr -> addr.ToString()
            RateLimitPartition.GetFixedWindowLimiter(ip, fun _ ->
                FixedWindowRateLimiterOptions(PermitLimit = 200, Window = TimeSpan.FromMinutes 1., QueueLimit = 50))))
        |> ignore

    // CSRF対策: Cookie認証のMVC POST/PUT/DELETE全てにAntiforgeryトークン検証を強制する。
    // Razorのformタグヘルパーがトークンを自動注入するため既存フォーム・AJAX(FormData)はそのまま動作。
    // Minimal API(JWT/チームトークン)はこのフィルタ対象外かつヘッダー認証のためCSRF非対象。
    builder.Services.AddControllersWithViews(fun (options: MvcOptions) ->
        options.Filters.Add(AutoValidateAntiforgeryTokenAttribute()) |> ignore)
        .AddRazorRuntimeCompilation() |> ignore
    builder.Services.AddEndpointsApiExplorer() |> ignore
    builder.Services.AddSwaggerGen() |> ignore
    builder.Services.AddHttpForwarder() |> ignore
    builder.Services.AddSingleton<HttpMessageInvoker>(fun _ ->
        new HttpMessageInvoker(
            new SocketsHttpHandler(
                UseProxy = false,
                AllowAutoRedirect = false,
                AutomaticDecompression = DecompressionMethods.None,
                UseCookies = false,
                ConnectTimeout = TimeSpan.FromSeconds 60.
            )
        )) |> ignore

let loadDotEnv (path: string) =
    if File.Exists(path) then
        File.ReadAllLines(path)
        |> Array.iter (fun line ->
            let trimmed = line.Trim()
            if trimmed <> "" && not (trimmed.StartsWith("#")) then
                let idx = trimmed.IndexOf('=')
                if idx > 0 then
                    let key = trimmed.Substring(0, idx).Trim()
                    let raw = trimmed.Substring(idx + 1).Trim()
                    let value =
                        if raw.Length >= 2 then
                            let first = raw[0]
                            let last = raw[raw.Length - 1]
                            if (first = '"' && last = '"') || (first = '\'' && last = '\'') then
                                raw.Substring(1, raw.Length - 2)
                            else
                                raw
                        else
                            raw
                    if String.IsNullOrWhiteSpace(Environment.GetEnvironmentVariable(key)) then
                        Environment.SetEnvironmentVariable(key, value))

let issueJwt (config: Microsoft.Extensions.Configuration.IConfiguration) (user: CtfdUser) =
    let claims =
        [| System.Security.Claims.Claim(System.Security.Claims.ClaimTypes.NameIdentifier, user.Id.ToString())
           System.Security.Claims.Claim(System.Security.Claims.ClaimTypes.Name, user.UserName)
           System.Security.Claims.Claim(System.Security.Claims.ClaimTypes.Email, user.Email)
           System.Security.Claims.Claim(System.Security.Claims.ClaimTypes.Role, "user") |]
    let key = SymmetricSecurityKey(Encoding.UTF8.GetBytes(config["Jwt:Key"]))
    let creds = SigningCredentials(key, SecurityAlgorithms.HmacSha256)
    let token = System.IdentityModel.Tokens.Jwt.JwtSecurityToken(
                    issuer = config["Jwt:Issuer"],
                    audience = config["Jwt:Audience"],
                    claims = claims,
                    expires = DateTime.UtcNow.AddHours(6.0),
                    signingCredentials = creds)
    System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler().WriteToken(token)

let mapRoutes (app: WebApplication) =
    InstanceSubdomainProxy.useInstanceSubdomainProxy app

    let requireTrustedHost (ctx: HttpContext) =
        let envHosts =
            let list = Environment.GetEnvironmentVariable("SHINOGI_TRUSTED_HOSTS")
            let fromList =
                if String.IsNullOrWhiteSpace list then
                    [||]
                else
                    list.Split(',', StringSplitOptions.RemoveEmptyEntries ||| StringSplitOptions.TrimEntries)
            let url = Environment.GetEnvironmentVariable("SHINOGI_PUBLIC_URL")
            let fromUrl =
                if String.IsNullOrWhiteSpace url then
                    [||]
                else
                    try
                        [| Uri(url).Host |]
                    with _ ->
                        [||]
            Array.append fromList fromUrl
        let allowed =
            if envHosts.Length > 0 then
                envHosts
            else
                app.Configuration.GetSection("TrustedHosts").Get<string[]>() |> Option.ofObj |> Option.defaultValue [||]
        if allowed.Length = 0 then true
        else allowed |> Array.exists (fun h -> String.Equals(h, ctx.Request.Host.Host, StringComparison.OrdinalIgnoreCase))

    app.Use(fun (next: RequestDelegate) ->
        RequestDelegate(fun ctx ->
            task {
                if not (requireTrustedHost ctx) then
                    ctx.Response.StatusCode <- StatusCodes.Status400BadRequest
                    return ()
                else
                    return! next.Invoke ctx
            } :> Task))
    |> ignore

    app.UseHttpsRedirection() |> ignore
    app.UseStaticFiles() |> ignore
    app.UseRouting() |> ignore
    app.UseAuthentication() |> ignore
    app.UseAuthorization() |> ignore
    app.UseRateLimiter() |> ignore
    app.UseSwagger() |> ignore
    app.UseSwaggerUI() |> ignore

    // ===== Auth API =====
    let auth = app.MapGroup("/api/v1/auth")
    auth.MapPost("/register", Func<RegisterDto, UserManager<CtfdUser>, CtfdDbContext, Task<IResult>>(fun dto userMgr db ->
        task {
            if String.IsNullOrWhiteSpace dto.Email || String.IsNullOrWhiteSpace dto.Password then
                return Results.BadRequest("Missing email or password")
            else
                let user = CtfdUser(Email = dto.Email, UserName = dto.Email, DisplayName = dto.DisplayName, EmailConfirmed = true)
                let! res = userMgr.CreateAsync(user, dto.Password)
                if not res.Succeeded then
                    return Results.BadRequest(res.Errors |> Seq.map (fun e -> e.Description))
                else
                    return Results.Ok(issueJwt app.Configuration user)
        } :> Task<IResult>
    )) |> ignore

    auth.MapPost("/login", Func<LoginDto, SignInManager<CtfdUser>, UserManager<CtfdUser>, Task<IResult>>(fun dto signInMgr userMgr ->
        task {
            let! user = userMgr.FindByEmailAsync(dto.Email)
            match user with
            | null -> return Results.Unauthorized()
            | u ->
                let! check = signInMgr.CheckPasswordSignInAsync(u, dto.Password, true)
                if not check.Succeeded then
                    return Results.Unauthorized()
                else
                    return Results.Ok(issueJwt app.Configuration u)
        } :> Task<IResult>
    )) |> ignore

    // ===== Challenges API =====
    let challenges = app.MapGroup("/api/v1/challenges")
    challenges.MapGet("/", Func<CtfdDbContext, Task<IResult>>(fun db ->
        task {
            let! eventState = CtfTime.getEventState db
            match eventState with
            | CtfTime.NotStarted _ ->
                // イベント開始前はチャレンジを公開しない
                return Results.Ok(List.empty<obj>)
            | _ ->
                let now = DateTimeOffset.UtcNow
                let! items =
                    db.Challenges
                      .Where(fun c -> c.Published)
                      .OrderBy(fun c -> c.CreatedAt)
                      .ToListAsync()
                // Challenge 型は判別共用体を含み JSON シリアライズできないため匿名型に射影する
                let payload =
                    items
                    |> Seq.filter (CtfTime.isReleased now)
                    |> Seq.map (fun c ->
                        box {| id = c.Id
                               name = c.Name
                               category = c.Category
                               difficulty = c.Difficulty
                               description = c.Description
                               valueInitial = c.ValueInitial
                               valueMinimum = c.ValueMinimum
                               decay = c.Decay
                               func = c.Function.ToString()
                               logic = c.Logic.ToString()
                               maxAttempts = (match c.MaxAttempts with | Some m -> Nullable m | None -> Nullable())
                               requiresInstance = c.RequiresInstance
                               createdAt = c.CreatedAt |})
                    |> Seq.toList
                return Results.Ok(payload)
        } :> Task<IResult>)) |> ignore

    let challengeCreateHandler =
        challenges.MapPost("/", Func<ChallengeCreateDto, CtfdDbContext, Task<IResult>>(fun dto db ->
            task {
                let func =
                    match dto.Function.ToLowerInvariant() with
                    | "log" -> ScoreFunction.Log
                    | "exp" -> ScoreFunction.Exp
                    | _ -> ScoreFunction.Linear
                let logic =
                    match dto.Logic.ToLowerInvariant() with
                    | "all" -> ChallengeLogic.All
                    | "teamconsensus" -> ChallengeLogic.TeamConsensus
                    | _ -> ChallengeLogic.Any
                let challenge =
                  { Id = Guid.NewGuid()
                    Name = dto.Name
                    Category = dto.Category
                    Difficulty = ""
                    Description = dto.Description
                    ValueInitial = dto.ValueInitial
                    ValueMinimum = dto.ValueMinimum
                    Decay = dto.Decay
                    Function = func
                    Logic = logic
                    MaxAttempts = dto.MaxAttempts
                    Published = false
                    ReleaseAt = None
                    CreatedAt = DateTimeOffset.UtcNow
                    RequiresInstance = false
                    InstanceImage = ""
                    InstanceDockerFolder = ""
                    InstancePort = None
                    InstanceLifetimeMinutes = 15
                    InstanceCpuLimit = "0.5"
                    InstanceMemoryLimit = "256m" }
                db.Challenges.Add(challenge) |> ignore
                let! _ = db.SaveChangesAsync()
                // Challenge 型は判別共用体を含み JSON シリアライズできないため匿名型で返す
                return Results.Created(
                    $"/api/v1/challenges/{challenge.Id}",
                    box {| id = challenge.Id; name = challenge.Name; category = challenge.Category |})
            } :> Task<IResult>))
    challengeCreateHandler.RequireAuthorization("AdminOnly") |> ignore

    let flagCreateHandler =
        challenges.MapPost("/{id:guid}/flags", Func<Guid, FlagCreateDto, CtfdDbContext, Task<IResult>>(fun id dto db ->
            task {
                let! exists = db.Challenges.AnyAsync(fun c -> c.Id = id)
                if not exists then
                    return Results.NotFound()
                else
                    let flag =
                      { Id = Guid.NewGuid()
                        ChallengeId = id
                        Content = dto.Content
                        ContentHash = Security.sha256 (if dto.CaseSensitive then dto.Content else dto.Content.ToLowerInvariant())
                        CaseSensitive = dto.CaseSensitive }
                    db.Flags.Add(flag) |> ignore
                    let! _ = db.SaveChangesAsync()
                    return Results.Created($"/api/v1/challenges/{id}/flags/{flag.Id}", flag.Id)
            } :> Task<IResult>))
    flagCreateHandler.RequireAuthorization("AdminOnly") |> ignore

    // ===== Submit via JWT (user) =====
    let submitHandler =
        challenges.MapPost("/{id:guid}/submit", Func<Guid, SubmitDto, HttpContext, CtfdDbContext, Task<IResult>>(fun id dto ctx db ->
            task {
                let userIdClaim = ctx.User.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)
                if isNull userIdClaim then
                    return Results.Unauthorized()
                else
                    let userId = Guid.Parse userIdClaim.Value
                    let! submittable = CtfTime.checkSubmittable db
                    match submittable with
                    | Error msg -> return Results.BadRequest(msg)
                    | Ok () ->
                    let! challenge = db.Challenges.FirstOrDefaultAsync(fun c -> c.Id = id && c.Published)
                    match challenge with
                    | null -> return Results.NotFound()
                    | c when not (CtfTime.isReleased DateTimeOffset.UtcNow c) -> return Results.NotFound()
                    | c ->
                        let! alreadySolved = db.Submissions.AnyAsync(fun s -> s.AccountId = userId && s.ChallengeId = id && s.IsCorrect)
                        if alreadySolved then
                            return Results.BadRequest("Already solved")
                        else
                        let! attempts = db.Submissions.CountAsync(fun s -> s.AccountId = userId && s.ChallengeId = id)
                        match c.MaxAttempts with
                        | Some max when attempts >= max -> return Results.BadRequest("Max attempts reached")
                        | _ ->
                            let normalized = if isNull dto.Flag then "" else dto.Flag
                            let hashExact = Security.sha256 normalized
                            let hashLower = Security.sha256 (normalized.ToLowerInvariant())
                            let! correct = db.Flags.AnyAsync(fun f -> f.ChallengeId = id && ((f.CaseSensitive && f.ContentHash = hashExact) || ((not f.CaseSensitive) && f.ContentHash = hashLower)))
                            let! solveCount = db.Submissions.CountAsync(fun s -> s.ChallengeId = id && s.IsCorrect)
                            let awarded = if correct then Scoring.dynamicValue c solveCount else 0
                            let ip =
                                match ctx.Connection.RemoteIpAddress with
                                | null -> "unknown"
                                | addr -> addr.ToString()
                            let submission =
                                { Id = Guid.NewGuid()
                                  AccountId = userId
                                  ChallengeId = id
                                  SubmittedAt = DateTimeOffset.UtcNow
                                  IsCorrect = correct
                                  ValueAwarded = awarded
                                  Ip = ip }
                            db.Submissions.Add(submission) |> ignore
                            let! _ = db.SaveChangesAsync()
                            if correct then
                                return Results.Ok(box {| status = "correct"; value = awarded |})
                            else
                                return Results.Ok(box {| status = "incorrect" |})
            } :> Task<IResult>))
    submitHandler.RequireAuthorization() |> ignore

    // ===== Scoreboard API =====
    app.MapGet("/api/v1/scoreboard", Func<CtfdDbContext, Task<IResult>>(fun db ->
        task {
            // 凍結時刻以降の提出・ヒント開放は反映しない
            let! freezeAt = CtfTime.getFreezeAt db
            let! allSubmissions =
                db.Submissions
                  .Where(fun s -> s.IsCorrect)
                  .ToListAsync()
            let! allUnlocks = db.HintUnlocks.ToListAsync()
            let submissions =
                match freezeAt with
                | Some f -> allSubmissions |> Seq.filter (fun s -> s.SubmittedAt < f) |> Seq.toList
                | None -> allSubmissions |> Seq.toList
            let unlocks =
                match freezeAt with
                | Some f -> allUnlocks |> Seq.filter (fun u -> u.UnlockedAt < f) |> Seq.toList
                | None -> allUnlocks |> Seq.toList
            let netScores = Scoring.netScoresByAccount submissions unlocks
            let accountIds = netScores |> Map.toSeq |> Seq.map fst |> Seq.toArray
            let! users =
                if accountIds.Length = 0 then
                    Task.FromResult(System.Collections.Generic.List<CtfdUser>())
                else
                    db.Users.Where(fun u -> accountIds.Contains u.Id).ToListAsync()
            let userById = users |> Seq.map (fun u -> u.Id, u) |> dict
            let! allMembers = db.TeamMembers.ToListAsync()
            let! allTeams = db.Teams.ToListAsync()
            let teamById = allTeams |> Seq.map (fun t -> t.Id, t) |> dict
            let memberByUserId = allMembers |> Seq.map (fun m -> m.UserId, m) |> dict
            let resolveTeamName (accountId: Guid) =
                match memberByUserId.TryGetValue(accountId) with
                | true, m ->
                    match teamById.TryGetValue(m.TeamId) with
                    | true, t -> t.Name
                    | _ -> ""
                | _ -> ""
            let scores =
                netScores
                |> Map.toSeq
                |> Seq.choose (fun (accountId, score) ->
                    match userById.TryGetValue(accountId) with
                    | false, _ -> None  // 削除済みユーザーは除外
                    | true, u ->
                        let displayName = if String.IsNullOrWhiteSpace u.DisplayName then u.Email else u.DisplayName
                        Some { AccountId = accountId
                               DisplayName = displayName
                               TeamName = resolveTeamName accountId
                               Score = score })
                |> Seq.sortByDescending (fun e -> e.Score)
                |> Seq.toList
            return Results.Ok(scores)
        } :> Task<IResult>
    )) |> ignore

    // ===== Team Token API =====
    let resolveTeamFromToken (ctx: HttpContext) (db: CtfdDbContext) =
        task {
            let tokenHeader = ctx.Request.Headers.["X-Team-Token"].ToString()
            if String.IsNullOrWhiteSpace tokenHeader then
                return None
            else
                match Guid.TryParse tokenHeader with
                | false, _ -> return None
                | true, tokenGuid ->
                    let! team = db.Teams.FirstOrDefaultAsync(fun t -> t.Token = tokenGuid)
                    match team with
                    | null -> return None
                    | t -> return Some t
        }

    /// チームAPI経由の操作を記録するアカウント: AIメンバー優先、いなければオーナー、いなければチームID。
    let resolveTeamSubmitter (db: CtfdDbContext) (teamId: Guid) =
        task {
            let! aiMember = db.TeamMembers.FirstOrDefaultAsync(fun m -> m.TeamId = teamId && m.Role = MemberRole.AI)
            match aiMember with
            | null ->
                let! owner = db.TeamMembers.FirstOrDefaultAsync(fun m -> m.TeamId = teamId && m.Role = MemberRole.Owner)
                return (if isNull owner then teamId else owner.UserId)
            | ai -> return ai.UserId
        }

    let teamApi = app.MapGroup("/api/v1/team")

    // GET /api/v1/team/info — チーム情報取得
    teamApi.MapGet("/info", Func<HttpContext, CtfdDbContext, Task<IResult>>(fun ctx db ->
        task {
            let! teamOpt = resolveTeamFromToken ctx db
            match teamOpt with
            | None -> return Results.Unauthorized()
            | Some team ->
                let! members =
                    db.TeamMembers
                      .Where(fun m -> m.TeamId = team.Id)
                      .ToListAsync()
                let! memberInfos =
                    task {
                        let results = System.Collections.Generic.List<_>()
                        for m in members do
                            let! user = db.Users.FirstOrDefaultAsync(fun u -> u.Id = m.UserId)
                            let displayName = if isNull user then "不明" else user.DisplayName
                            let email = if isNull user then "" else user.Email
                            results.Add(box {| userId = m.UserId; displayName = displayName; email = email; role = m.Role.ToString(); joinedAt = m.JoinedAt |})
                        return results |> Seq.toList
                    }
                return Results.Ok(box {| id = team.Id; name = team.Name; createdAt = team.CreatedAt; members = memberInfos |})
        } :> Task<IResult>
    )) |> ignore

    // GET /api/v1/team/challenges — チャレンジ一覧取得
    teamApi.MapGet("/challenges", Func<HttpContext, CtfdDbContext, Task<IResult>>(fun ctx db ->
        task {
            let! teamOpt = resolveTeamFromToken ctx db
            match teamOpt with
            | None -> return Results.Unauthorized()
            | Some _ ->
                let! eventState = CtfTime.getEventState db
                match eventState with
                | CtfTime.NotStarted _ ->
                    // イベント開始前はチャレンジを公開しない
                    return Results.Ok(List.empty<obj>)
                | _ ->
                    let now = DateTimeOffset.UtcNow
                    let! items =
                        db.Challenges
                          .Where(fun c -> c.Published)
                          .OrderBy(fun c -> c.CreatedAt)
                          .ToListAsync()
                    let challenges =
                        items
                        |> Seq.filter (CtfTime.isReleased now)
                        |> Seq.map (fun c -> box {| id = c.Id; name = c.Name; category = c.Category; description = c.Description; valueInitial = c.ValueInitial; valueMinimum = c.ValueMinimum; decay = c.Decay; func = c.Function.ToString(); logic = c.Logic.ToString() |})
                        |> Seq.toList
                    return Results.Ok(challenges)
        } :> Task<IResult>
    )) |> ignore

    // POST /api/v1/team/challenges/{id}/submit — フラグ提出（AI対応）
    teamApi.MapPost("/challenges/{id:guid}/submit", Func<Guid, SubmitDto, HttpContext, CtfdDbContext, Task<IResult>>(fun id dto ctx db ->
        task {
            let! teamOpt = resolveTeamFromToken ctx db
            match teamOpt with
            | None -> return Results.Unauthorized()
            | Some team ->
                let! submittable = CtfTime.checkSubmittable db
                match submittable with
                | Error msg -> return Results.BadRequest(msg)
                | Ok () ->
                    let! submitterId = resolveTeamSubmitter db team.Id
                    let! challenge = db.Challenges.FirstOrDefaultAsync(fun c -> c.Id = id && c.Published)
                    match challenge with
                    | null -> return Results.NotFound()
                    | c when not (CtfTime.isReleased DateTimeOffset.UtcNow c) -> return Results.NotFound()
                    | c ->
                    let! alreadySolved = db.Submissions.AnyAsync(fun s -> s.AccountId = submitterId && s.ChallengeId = id && s.IsCorrect)
                    if alreadySolved then
                        return Results.BadRequest("既に正解済みです")
                    else
                    let! attempts = db.Submissions.CountAsync(fun s -> s.AccountId = submitterId && s.ChallengeId = id)
                    match c.MaxAttempts with
                    | Some max when attempts >= max -> return Results.BadRequest("試行回数の上限に達しました")
                    | _ ->
                        let normalized = if isNull dto.Flag then "" else dto.Flag
                        let hashExact = Security.sha256 normalized
                        let hashLower = Security.sha256 (normalized.ToLowerInvariant())
                        let! correct = db.Flags.AnyAsync(fun f -> f.ChallengeId = id && ((f.CaseSensitive && f.ContentHash = hashExact) || ((not f.CaseSensitive) && f.ContentHash = hashLower)))
                        let! solveCount = db.Submissions.CountAsync(fun s -> s.ChallengeId = id && s.IsCorrect)
                        let awarded = if correct then Scoring.dynamicValue c solveCount else 0
                        let ip =
                            match ctx.Connection.RemoteIpAddress with
                            | null -> "unknown"
                            | addr -> addr.ToString()
                        let submission =
                            { Id = Guid.NewGuid()
                              AccountId = submitterId
                              ChallengeId = id
                              SubmittedAt = DateTimeOffset.UtcNow
                              IsCorrect = correct
                              ValueAwarded = awarded
                              Ip = ip }
                        db.Submissions.Add(submission) |> ignore
                        let! _ = db.SaveChangesAsync()
                        if correct then
                            return Results.Ok(box {| status = "correct"; value = awarded |})
                        else
                            return Results.Ok(box {| status = "incorrect" |})
        } :> Task<IResult>
    )) |> ignore

    // GET /api/v1/team/challenges/{id}/files — 配布ファイル一覧
    teamApi.MapGet("/challenges/{id:guid}/files", Func<Guid, HttpContext, CtfdDbContext, Task<IResult>>(fun id ctx db ->
        task {
            let! teamOpt = resolveTeamFromToken ctx db
            match teamOpt with
            | None -> return Results.Unauthorized()
            | Some _ ->
                let! challenge = db.Challenges.FirstOrDefaultAsync(fun c -> c.Id = id && c.Published)
                if isNull (box challenge) || not (CtfTime.isReleased DateTimeOffset.UtcNow challenge) then
                    return Results.NotFound()
                else
                    let! fileRows =
                        db.ChallengeFiles
                          .Where(fun f -> f.ChallengeId = id)
                          .OrderBy(fun f -> f.UploadedAt)
                          .ToListAsync()
                    // EF Core は F# 匿名レコードへの Select を翻訳できないためメモリ内で変換する
                    let files =
                        fileRows
                        |> Seq.map (fun f -> box {| id = f.Id; originalName = f.OriginalName; uploadedAt = f.UploadedAt |})
                        |> Seq.toList
                    return Results.Ok(box {| challengeId = id; files = files |})
        } :> Task<IResult>
    )) |> ignore

    // GET /api/v1/team/challenges/{id}/files/{fileId} — 配布ファイルダウンロード
    teamApi.MapGet("/challenges/{id:guid}/files/{fileId:guid}", Func<Guid, Guid, HttpContext, CtfdDbContext, Task<IResult>>(fun id fileId ctx db ->
        task {
            let! teamOpt = resolveTeamFromToken ctx db
            match teamOpt with
            | None -> return Results.Unauthorized()
            | Some _ ->
                let! challenge = db.Challenges.FirstOrDefaultAsync(fun c -> c.Id = id && c.Published)
                if isNull (box challenge) || not (CtfTime.isReleased DateTimeOffset.UtcNow challenge) then
                    return Results.NotFound()
                else
                let! file = db.ChallengeFiles.FirstOrDefaultAsync(fun f -> f.Id = fileId && f.ChallengeId = id)
                match file with
                | null -> return Results.NotFound()
                | f ->
                    let uploadsDir = Path.Combine(app.Environment.ContentRootPath, "uploads", id.ToString())
                    let filePath = Path.Combine(uploadsDir, f.StoredName)
                    if not (File.Exists filePath) then
                        return Results.NotFound()
                    else
                        let bytes = File.ReadAllBytes(filePath)
                        return Results.File(bytes, "application/octet-stream", f.OriginalName)
        } :> Task<IResult>
    )) |> ignore

    // GET /api/v1/team/notifications — 運営からの通知一覧（新しい順）
    teamApi.MapGet("/notifications", Func<HttpContext, CtfdDbContext, Task<IResult>>(fun ctx db ->
        task {
            let! teamOpt = resolveTeamFromToken ctx db
            match teamOpt with
            | None -> return Results.Unauthorized()
            | Some _ ->
                let! rows =
                    db.Notifications
                      .OrderByDescending(fun n -> n.CreatedAt)
                      .ToListAsync()
                // EF Core は F# 匿名レコードへの Select を翻訳できないためメモリ内で変換する
                let items =
                    rows
                    |> Seq.map (fun n -> box {| id = n.Id; title = n.Title; content = n.Content; createdAt = n.CreatedAt |})
                    |> Seq.toList
                return Results.Ok(items)
        } :> Task<IResult>
    )) |> ignore

    // GET /api/v1/team/challenges/{id}/hints — ヒント一覧（チームの誰かが開放済みなら内容を含む）
    teamApi.MapGet("/challenges/{id:guid}/hints", Func<Guid, HttpContext, CtfdDbContext, Task<IResult>>(fun id ctx db ->
        task {
            let! teamOpt = resolveTeamFromToken ctx db
            match teamOpt with
            | None -> return Results.Unauthorized()
            | Some team ->
                let! challenge = db.Challenges.FirstOrDefaultAsync(fun c -> c.Id = id && c.Published)
                if isNull (box challenge) || not (CtfTime.isReleased DateTimeOffset.UtcNow challenge) then
                    return Results.NotFound()
                else
                    let! memberIds =
                        db.TeamMembers
                          .Where(fun m -> m.TeamId = team.Id)
                          .Select(fun m -> m.UserId)
                          .ToListAsync()
                    let! hints =
                        db.Hints
                          .Where(fun h -> h.ChallengeId = id)
                          .OrderBy(fun h -> h.SortOrder)
                          .ToListAsync()
                    let hintIds = hints |> Seq.map (fun h -> h.Id) |> Seq.toArray
                    let! unlocked =
                        if hintIds.Length = 0 then
                            Task.FromResult(System.Collections.Generic.List<HintUnlock>())
                        else
                            db.HintUnlocks
                              .Where(fun u -> hintIds.Contains(u.HintId) && memberIds.Contains(u.AccountId))
                              .ToListAsync()
                    let unlockedSet = unlocked |> Seq.map (fun u -> u.HintId) |> Set.ofSeq
                    let payload =
                        hints
                        |> Seq.map (fun h ->
                            if unlockedSet.Contains h.Id then
                                box {| id = h.Id; cost = h.Cost; unlocked = true; content = h.Content |}
                            else
                                box {| id = h.Id; cost = h.Cost; unlocked = false; content = "" |})
                        |> Seq.toList
                    return Results.Ok(payload)
        } :> Task<IResult>
    )) |> ignore

    // POST /api/v1/team/challenges/{id}/hints/{hintId}/unlock — ヒント開放（コストはスコアから減算）
    teamApi.MapPost("/challenges/{id:guid}/hints/{hintId:guid}/unlock", Func<Guid, Guid, HttpContext, CtfdDbContext, Task<IResult>>(fun id hintId ctx db ->
        task {
            let! teamOpt = resolveTeamFromToken ctx db
            match teamOpt with
            | None -> return Results.Unauthorized()
            | Some team ->
                let! submittable = CtfTime.checkSubmittable db
                match submittable with
                | Error msg -> return Results.BadRequest(msg)
                | Ok () ->
                    let! challenge = db.Challenges.FirstOrDefaultAsync(fun c -> c.Id = id && c.Published)
                    if isNull (box challenge) || not (CtfTime.isReleased DateTimeOffset.UtcNow challenge) then
                        return Results.NotFound()
                    else
                    let! hint = db.Hints.FirstOrDefaultAsync(fun h -> h.Id = hintId && h.ChallengeId = id)
                    if isNull (box hint) then
                        return Results.NotFound()
                    else
                    let! submitterId = resolveTeamSubmitter db team.Id
                    let! already = db.HintUnlocks.AnyAsync(fun u -> u.HintId = hintId && u.AccountId = submitterId)
                    if already then
                        return Results.Ok(box {| status = "already_unlocked"; cost = hint.Cost; content = hint.Content |})
                    else
                        let unlock =
                            { Id = Guid.NewGuid()
                              HintId = hint.Id
                              ChallengeId = id
                              AccountId = submitterId
                              Cost = hint.Cost
                              UnlockedAt = DateTimeOffset.UtcNow }
                        db.HintUnlocks.Add(unlock) |> ignore
                        let! _ = db.SaveChangesAsync()
                        return Results.Ok(box {| status = "unlocked"; cost = hint.Cost; content = hint.Content |})
        } :> Task<IResult>
    )) |> ignore

    app.MapControllerRoute(
        name = "default",
        pattern = "{controller=Home}/{action=Index}/{id?}") |> ignore

let [<EntryPoint>] main args =
    let resolveContentRoot () =
        let rec findUp (dir: DirectoryInfo) (predicate: DirectoryInfo -> bool) =
            if isNull dir then
                None
            elif predicate dir then
                Some dir.FullName
            else
                findUp dir.Parent predicate
        let baseDir = DirectoryInfo(AppContext.BaseDirectory)
        let envRoot = findUp baseDir (fun d -> File.Exists(Path.Combine(d.FullName, ".env")))
        let viewsRoot = findUp baseDir (fun d -> Directory.Exists(Path.Combine(d.FullName, "Views")))
        match envRoot, viewsRoot with
        | Some path, _ -> path
        | None, Some path -> path
        | None, None -> AppContext.BaseDirectory
    let contentRoot = resolveContentRoot()
    loadDotEnv (Path.Combine(contentRoot, ".env"))
    let options = WebApplicationOptions(ContentRootPath = contentRoot, Args = args)
    let builder = WebApplication.CreateBuilder(options)
    configureServices builder
    let app = builder.Build()
    use scope = app.Services.CreateScope()
    let db = scope.ServiceProvider.GetRequiredService<CtfdDbContext>()
    if db.Database.GetMigrations().Any() then
        db.Database.Migrate() |> ignore
    else
        db.Database.EnsureCreated() |> ignore

    let ensureTeamTables () =
        // Teams テーブル（Token列付き）
        db.Database.ExecuteSqlRaw(
            "CREATE TABLE IF NOT EXISTS \"Teams\" (\"Id\" uuid PRIMARY KEY, \"Name\" text NOT NULL, \"Token\" uuid NOT NULL DEFAULT gen_random_uuid(), \"JoinPassword\" text NOT NULL DEFAULT '', \"CreatedAt\" timestamptz NOT NULL);") |> ignore
        // TeamMembers テーブル（Role列付き）
        db.Database.ExecuteSqlRaw(
            "CREATE TABLE IF NOT EXISTS \"TeamMembers\" (\"Id\" uuid PRIMARY KEY, \"TeamId\" uuid NOT NULL, \"UserId\" uuid NOT NULL, \"JoinedAt\" timestamptz NOT NULL, \"Role\" text NOT NULL DEFAULT 'Player');") |> ignore
        // Token列がなければ追加（レガシースキーマ移行）
        db.Database.ExecuteSqlRaw(
            "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Teams' AND column_name='Token') THEN ALTER TABLE \"Teams\" ADD COLUMN \"Token\" uuid NOT NULL DEFAULT gen_random_uuid(); END IF; END $$;") |> ignore
        // JoinPassword列がなければ追加（レガシースキーマ移行）
        db.Database.ExecuteSqlRaw(
            "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Teams' AND column_name='JoinPassword') THEN ALTER TABLE \"Teams\" ADD COLUMN \"JoinPassword\" text NOT NULL DEFAULT ''; END IF; END $$;") |> ignore
        // Role列がなければ追加し、レガシーIsOwner列から移行
        db.Database.ExecuteSqlRaw(
            "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='TeamMembers' AND column_name='Role') THEN ALTER TABLE \"TeamMembers\" ADD COLUMN \"Role\" text NOT NULL DEFAULT 'Player'; END IF; END $$;") |> ignore
        db.Database.ExecuteSqlRaw(
            "DO $$ BEGIN IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='TeamMembers' AND column_name='IsOwner') THEN UPDATE \"TeamMembers\" SET \"Role\" = 'Owner' WHERE \"IsOwner\" = true AND \"Role\" = 'Player'; ALTER TABLE \"TeamMembers\" DROP COLUMN \"IsOwner\"; END IF; END $$;") |> ignore
        // インデックス
        db.Database.ExecuteSqlRaw(
            "CREATE UNIQUE INDEX IF NOT EXISTS \"IX_Teams_Name\" ON \"Teams\" (\"Name\");") |> ignore
        db.Database.ExecuteSqlRaw(
            "CREATE UNIQUE INDEX IF NOT EXISTS \"IX_Teams_Token\" ON \"Teams\" (\"Token\");") |> ignore
        db.Database.ExecuteSqlRaw(
            "CREATE INDEX IF NOT EXISTS \"IX_TeamMembers_UserId\" ON \"TeamMembers\" (\"UserId\");") |> ignore
        db.Database.ExecuteSqlRaw(
            "CREATE UNIQUE INDEX IF NOT EXISTS \"IX_TeamMembers_TeamId_UserId\" ON \"TeamMembers\" (\"TeamId\", \"UserId\");") |> ignore

    ensureTeamTables ()

    // ChallengeFiles テーブル作成
    db.Database.ExecuteSqlRaw(
        "CREATE TABLE IF NOT EXISTS \"ChallengeFiles\" (\"Id\" uuid PRIMARY KEY, \"ChallengeId\" uuid NOT NULL, \"OriginalName\" text NOT NULL, \"StoredName\" text NOT NULL, \"UploadedAt\" timestamptz NOT NULL);") |> ignore

    // CtfSettings テーブル作成
    db.Database.ExecuteSqlRaw(
        "CREATE TABLE IF NOT EXISTS \"CtfSettings\" (\"Id\" uuid PRIMARY KEY, \"EventStart\" timestamptz, \"EventEnd\" timestamptz);") |> ignore
    // Flags の ContentHash ユニーク制約を複合ユニーク(ChallengeId, ContentHash)に変更
    db.Database.ExecuteSqlRaw(
        "DROP INDEX IF EXISTS \"IX_Flags_ContentHash\";") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE UNIQUE INDEX IF NOT EXISTS \"IX_Flags_ChallengeId_ContentHash\" ON \"Flags\" (\"ChallengeId\", \"ContentHash\");") |> ignore
    // Flags に Content列がなければ追加（元のフラグ文字列を保持）
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Flags' AND column_name='Content') THEN ALTER TABLE \"Flags\" ADD COLUMN \"Content\" text NOT NULL DEFAULT ''; END IF; END $$;") |> ignore
    // ThemePreset列がなければ追加（レガシースキーマ移行）
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='CtfSettings' AND column_name='ThemePreset') THEN ALTER TABLE \"CtfSettings\" ADD COLUMN \"ThemePreset\" text NOT NULL DEFAULT 'purple-network'; END IF; END $$;") |> ignore
    // FreezeAt列がなければ追加（スコアボード凍結機能）
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='CtfSettings' AND column_name='FreezeAt') THEN ALTER TABLE \"CtfSettings\" ADD COLUMN \"FreezeAt\" timestamptz; END IF; END $$;") |> ignore

    // Hints / HintUnlocks テーブル作成（ヒント機能）
    db.Database.ExecuteSqlRaw(
        "CREATE TABLE IF NOT EXISTS \"Hints\" (\"Id\" uuid PRIMARY KEY, \"ChallengeId\" uuid NOT NULL, \"Content\" text NOT NULL, \"Cost\" integer NOT NULL DEFAULT 0, \"SortOrder\" integer NOT NULL DEFAULT 0);") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE INDEX IF NOT EXISTS \"IX_Hints_ChallengeId\" ON \"Hints\" (\"ChallengeId\");") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE TABLE IF NOT EXISTS \"HintUnlocks\" (\"Id\" uuid PRIMARY KEY, \"HintId\" uuid NOT NULL, \"ChallengeId\" uuid NOT NULL, \"AccountId\" uuid NOT NULL, \"Cost\" integer NOT NULL DEFAULT 0, \"UnlockedAt\" timestamptz NOT NULL);") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE UNIQUE INDEX IF NOT EXISTS \"IX_HintUnlocks_HintId_AccountId\" ON \"HintUnlocks\" (\"HintId\", \"AccountId\");") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE INDEX IF NOT EXISTS \"IX_HintUnlocks_AccountId\" ON \"HintUnlocks\" (\"AccountId\");") |> ignore

    // Notifications テーブル作成（通知機能）
    db.Database.ExecuteSqlRaw(
        "CREATE TABLE IF NOT EXISTS \"Notifications\" (\"Id\" uuid PRIMARY KEY, \"Title\" text NOT NULL, \"Content\" text NOT NULL, \"CreatedAt\" timestamptz NOT NULL);") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE INDEX IF NOT EXISTS \"IX_Notifications_CreatedAt\" ON \"Notifications\" (\"CreatedAt\");") |> ignore
    // Challenges に ReleaseAt / Difficulty 列を追加（レガシースキーマ移行）
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Challenges' AND column_name='ReleaseAt') THEN ALTER TABLE \"Challenges\" ADD COLUMN \"ReleaseAt\" timestamptz; END IF; END $$;") |> ignore
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Challenges' AND column_name='Difficulty') THEN ALTER TABLE \"Challenges\" ADD COLUMN \"Difficulty\" text NOT NULL DEFAULT ''; END IF; END $$;") |> ignore
    // ChallengeCategories / ChallengeDifficulties マスタテーブル
    db.Database.ExecuteSqlRaw(
        "CREATE TABLE IF NOT EXISTS \"ChallengeCategories\" (\"Id\" uuid PRIMARY KEY, \"Name\" text NOT NULL, \"SortOrder\" integer NOT NULL DEFAULT 0);") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE UNIQUE INDEX IF NOT EXISTS \"IX_ChallengeCategories_Name\" ON \"ChallengeCategories\" (\"Name\");") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE TABLE IF NOT EXISTS \"ChallengeDifficulties\" (\"Id\" uuid PRIMARY KEY, \"Name\" text NOT NULL, \"SortOrder\" integer NOT NULL DEFAULT 0);") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE UNIQUE INDEX IF NOT EXISTS \"IX_ChallengeDifficulties_Name\" ON \"ChallengeDifficulties\" (\"Name\");") |> ignore

    // ChallengeInstances テーブル作成
    db.Database.ExecuteSqlRaw(
        "CREATE TABLE IF NOT EXISTS \"ChallengeInstances\" (\"Id\" uuid PRIMARY KEY, \"ChallengeId\" uuid NOT NULL, \"UserId\" uuid NOT NULL, \"ContainerId\" text NOT NULL, \"HostPort\" integer NOT NULL, \"Url\" text NOT NULL, \"Flag\" text NOT NULL, \"CreatedAt\" timestamptz NOT NULL, \"ExpiresAt\" timestamptz NOT NULL, \"Status\" text NOT NULL DEFAULT 'Running');") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE INDEX IF NOT EXISTS \"IX_ChallengeInstances_UserId\" ON \"ChallengeInstances\" (\"UserId\");") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE INDEX IF NOT EXISTS \"IX_ChallengeInstances_ChallengeId\" ON \"ChallengeInstances\" (\"ChallengeId\");") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE INDEX IF NOT EXISTS \"IX_ChallengeInstances_Status\" ON \"ChallengeInstances\" (\"Status\");") |> ignore

    // Challenges にインスタンス関連列を追加（レガシースキーマ移行）
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Challenges' AND column_name='RequiresInstance') THEN ALTER TABLE \"Challenges\" ADD COLUMN \"RequiresInstance\" boolean NOT NULL DEFAULT false; END IF; END $$;") |> ignore
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Challenges' AND column_name='InstanceImage') THEN ALTER TABLE \"Challenges\" ADD COLUMN \"InstanceImage\" text NOT NULL DEFAULT ''; END IF; END $$;") |> ignore
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Challenges' AND column_name='InstancePort') THEN ALTER TABLE \"Challenges\" ADD COLUMN \"InstancePort\" integer; END IF; END $$;") |> ignore
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Challenges' AND column_name='InstanceLifetimeMinutes') THEN ALTER TABLE \"Challenges\" ADD COLUMN \"InstanceLifetimeMinutes\" integer NOT NULL DEFAULT 15; END IF; END $$;") |> ignore
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Challenges' AND column_name='InstanceCpuLimit') THEN ALTER TABLE \"Challenges\" ADD COLUMN \"InstanceCpuLimit\" text NOT NULL DEFAULT '0.5'; END IF; END $$;") |> ignore
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Challenges' AND column_name='InstanceMemoryLimit') THEN ALTER TABLE \"Challenges\" ADD COLUMN \"InstanceMemoryLimit\" text NOT NULL DEFAULT '256m'; END IF; END $$;") |> ignore
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Challenges' AND column_name='InstanceDockerFolder') THEN ALTER TABLE \"Challenges\" ADD COLUMN \"InstanceDockerFolder\" text NOT NULL DEFAULT ''; END IF; END $$;") |> ignore
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='ChallengeInstances' AND column_name='ComposeProject') THEN ALTER TABLE \"ChallengeInstances\" ADD COLUMN \"ComposeProject\" text NOT NULL DEFAULT ''; END IF; END $$;") |> ignore
    db.Database.ExecuteSqlRaw(
        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='ChallengeInstances' AND column_name='AccessSlug') THEN ALTER TABLE \"ChallengeInstances\" ADD COLUMN \"AccessSlug\" text NOT NULL DEFAULT ''; END IF; END $$;") |> ignore
    db.Database.ExecuteSqlRaw(
        "CREATE UNIQUE INDEX IF NOT EXISTS \"IX_ChallengeInstances_AccessSlug_Running\" ON \"ChallengeInstances\" (\"AccessSlug\") WHERE \"Status\" = 'Running' AND \"AccessSlug\" <> '';") |> ignore
    db.Database.ExecuteSqlRaw("ALTER TABLE \"Challenges\" ALTER COLUMN \"InstanceLifetimeMinutes\" SET DEFAULT 15;") |> ignore

    // カテゴリ・難易度の初期データ
    let seedMasters () =
        task {
            let! catCount = db.ChallengeCategories.CountAsync()
            if catCount = 0 then
                let categories =
                    [| ("Crypto", 0); ("Forensics", 1); ("Misc", 2); ("Pwn", 3); ("Reversing", 4); ("Web", 5) |]
                for (name, order) in categories do
                    db.ChallengeCategories.Add({ Id = Guid.NewGuid(); Name = name; SortOrder = order }) |> ignore
                let! _ = db.SaveChangesAsync()
                Console.WriteLine("Seeded default categories.")
            let! diffCount = db.ChallengeDifficulties.CountAsync()
            if diffCount = 0 then
                let difficulties =
                    [| ("Warmup", 0); ("Easy", 1); ("Medium", 2); ("Hard", 3); ("Insane", 4) |]
                for (name, order) in difficulties do
                    db.ChallengeDifficulties.Add({ Id = Guid.NewGuid(); Name = name; SortOrder = order }) |> ignore
                let! _ = db.SaveChangesAsync()
                Console.WriteLine("Seeded default difficulties.")
        }
        |> fun t -> t.GetAwaiter().GetResult()
    seedMasters ()

    let parseBoolEnv (name: string) =
        let value = Environment.GetEnvironmentVariable(name)
        if String.IsNullOrWhiteSpace value then false
        else
            match value.Trim().ToLowerInvariant() with
            | "1" | "true" | "yes" | "y" | "on" -> true
            | _ -> false

    let seedIdentity () =
        task {
            let roleMgr = scope.ServiceProvider.GetRequiredService<RoleManager<IdentityRole<Guid>>>()
            let userMgr = scope.ServiceProvider.GetRequiredService<UserManager<CtfdUser>>()
            let roles = [| "Admins"; "Player"; "AI" |]
            for roleName in roles do
                let! exists = roleMgr.RoleExistsAsync(roleName)
                if not exists then
                    let! created = roleMgr.CreateAsync(IdentityRole<Guid>(Name = roleName))
                    if not created.Succeeded then
                        Console.WriteLine($"Role create failed: {roleName}")

            let adminEmail = Environment.GetEnvironmentVariable("SHINOGI_ADMIN_EMAIL")
            let adminPassword = Environment.GetEnvironmentVariable("SHINOGI_ADMIN_PASSWORD")
            let adminDisplay = Environment.GetEnvironmentVariable("SHINOGI_ADMIN_DISPLAYNAME")
            let resetPassword = parseBoolEnv "SHINOGI_ADMIN_RESET_PASSWORD"
            if not (String.IsNullOrWhiteSpace adminEmail) && not (String.IsNullOrWhiteSpace adminPassword) then
                let! existing = userMgr.FindByEmailAsync(adminEmail)
                let mutable user = existing
                if isNull user then
                    let newUser =
                        CtfdUser(
                            Email = adminEmail,
                            UserName = adminEmail,
                            DisplayName = (if String.IsNullOrWhiteSpace adminDisplay then adminEmail else adminDisplay),
                            EmailConfirmed = true)
                    let! created = userMgr.CreateAsync(newUser, adminPassword)
                    if created.Succeeded then
                        user <- newUser
                    else
                        user <- null
                        let errors = created.Errors |> Seq.map (fun e -> e.Description) |> String.concat "; "
                        Console.WriteLine($"Admin create failed: {errors}")
                if not (isNull user) then
                    if not user.EmailConfirmed then
                        user.EmailConfirmed <- true
                        let! _ = userMgr.UpdateAsync(user)
                        ()
                    let! hasRole = userMgr.IsInRoleAsync(user, "Admins")
                    if not hasRole then
                        let! _ = userMgr.AddToRoleAsync(user, "Admins")
                        ()
                    if resetPassword then
                        let! token = userMgr.GeneratePasswordResetTokenAsync(user)
                        let! reset = userMgr.ResetPasswordAsync(user, token, adminPassword)
                        if not reset.Succeeded then
                            let errors = reset.Errors |> Seq.map (fun e -> e.Description) |> String.concat "; "
                            Console.WriteLine($"Admin password reset failed: {errors}")

                    // Adminsチームの作成または取得
                    let! adminsTeam = db.Teams.FirstOrDefaultAsync(fun t -> t.Name = "Admins")
                    let mutable teamId = Guid.Empty
                    if isNull adminsTeam then
                        let newTeam =
                            { Id = Guid.NewGuid()
                              Name = "Admins"
                              Token = Guid.NewGuid()
                              JoinPassword = ""
                              CreatedAt = DateTimeOffset.UtcNow }
                        db.Teams.Add(newTeam) |> ignore
                        let! _ = db.SaveChangesAsync()
                        teamId <- newTeam.Id
                        Console.WriteLine("Admins team created.")
                    else
                        teamId <- adminsTeam.Id

                    // AdminユーザーがAdminsチームに所属しているか確認
                    let! existingMembership = db.TeamMembers.FirstOrDefaultAsync(fun m -> m.UserId = user.Id && m.TeamId = teamId)
                    if isNull existingMembership then
                        let membership =
                            { Id = Guid.NewGuid()
                              TeamId = teamId
                              UserId = user.Id
                              JoinedAt = DateTimeOffset.UtcNow
                              Role = MemberRole.Owner }
                        db.TeamMembers.Add(membership) |> ignore
                        let! _ = db.SaveChangesAsync()
                        Console.WriteLine($"Admin user added to Admins team.")
            else
                Console.WriteLine("Admin seed skipped: SHINOGI_ADMIN_EMAIL or SHINOGI_ADMIN_PASSWORD missing.")
        }
        |> fun t -> t.GetAwaiter().GetResult()
    seedIdentity ()

    // テスト用シーダー（環境変数 SHINOGI_SEED_DATA=true で有効化）
    let seedTestData () =
        if not (parseBoolEnv "SHINOGI_SEED_DATA") then ()
        else
        task {
            let userMgr = scope.ServiceProvider.GetRequiredService<UserManager<CtfdUser>>()
            // 既にシード済みならスキップ
            let! existingTeam = db.Teams.AnyAsync(fun t -> t.Name = "Team Alpha")
            if existingTeam then
                Console.WriteLine("Seed data already exists, skipping.")
            else
                Console.WriteLine("Seeding test data...")

                // --- ユーザー作成 ---
                let seedUsers =
                    [| ("alice@example.com", "Alice", "Password1!")
                       ("bob@example.com", "Bob", "Password1!")
                       ("charlie@example.com", "Charlie", "Password1!")
                       ("dave@example.com", "Dave", "Password1!")
                       ("eve@example.com", "Eve", "Password1!")
                       ("frank@example.com", "Frank", "Password1!") |]

                let userIds = System.Collections.Generic.List<Guid * string>()
                for (email, displayName, password) in seedUsers do
                    let! existing = userMgr.FindByEmailAsync(email)
                    if isNull existing then
                        let newUser = CtfdUser(Email = email, UserName = email, DisplayName = displayName, EmailConfirmed = true)
                        let! created = userMgr.CreateAsync(newUser, password)
                        if created.Succeeded then
                            let! _ = userMgr.AddToRoleAsync(newUser, "Player")
                            userIds.Add((newUser.Id, displayName))
                            Console.WriteLine($"  User created: {displayName} ({email})")
                        else
                            let errs = created.Errors |> Seq.map (fun e -> e.Description) |> String.concat "; "
                            Console.WriteLine($"  User create failed: {displayName} - {errs}")
                    else
                        userIds.Add((existing.Id, displayName))

                if userIds.Count >= 6 then
                    // --- AIユーザー作成 ---
                    let! aiExisting = userMgr.FindByEmailAsync("ai-agent@example.com")
                    let mutable aiUserId = Guid.Empty
                    if isNull aiExisting then
                        let aiUser = CtfdUser(Email = "ai-agent@example.com", UserName = "ai-agent@example.com", DisplayName = "AI Agent", EmailConfirmed = true)
                        let! created = userMgr.CreateAsync(aiUser, "Password1!")
                        if created.Succeeded then
                            let! _ = userMgr.AddToRoleAsync(aiUser, "AI")
                            aiUserId <- aiUser.Id
                            Console.WriteLine("  User created: AI Agent")
                    else
                        aiUserId <- aiExisting.Id

                    // --- チーム作成 ---
                    let teamAlpha =
                        { Id = Guid.NewGuid(); Name = "Team Alpha"; Token = Guid.NewGuid(); JoinPassword = ""; CreatedAt = DateTimeOffset.UtcNow }
                    let teamBravo =
                        { Id = Guid.NewGuid(); Name = "Team Bravo"; Token = Guid.NewGuid(); JoinPassword = ""; CreatedAt = DateTimeOffset.UtcNow }
                    let teamCharlie =
                        { Id = Guid.NewGuid(); Name = "Team Charlie"; Token = Guid.NewGuid(); JoinPassword = ""; CreatedAt = DateTimeOffset.UtcNow }
                    db.Teams.Add(teamAlpha) |> ignore
                    db.Teams.Add(teamBravo) |> ignore
                    db.Teams.Add(teamCharlie) |> ignore

                    // --- チームメンバー割当 ---
                    // Team Alpha: Alice(Owner), Bob(Player), AI Agent(AI)
                    let memberAlphaOwner =
                        { Id = Guid.NewGuid(); TeamId = teamAlpha.Id; UserId = fst userIds.[0]; JoinedAt = DateTimeOffset.UtcNow; Role = MemberRole.Owner }
                    let memberAlphaPlayer =
                        { Id = Guid.NewGuid(); TeamId = teamAlpha.Id; UserId = fst userIds.[1]; JoinedAt = DateTimeOffset.UtcNow; Role = MemberRole.Player }
                    db.TeamMembers.Add(memberAlphaOwner) |> ignore
                    db.TeamMembers.Add(memberAlphaPlayer) |> ignore
                    if aiUserId <> Guid.Empty then
                        let memberAlphaAI =
                            { Id = Guid.NewGuid(); TeamId = teamAlpha.Id; UserId = aiUserId; JoinedAt = DateTimeOffset.UtcNow; Role = MemberRole.AI }
                        db.TeamMembers.Add(memberAlphaAI) |> ignore

                    // Team Bravo: Charlie(Owner), Dave(Player)
                    let memberBravoOwner =
                        { Id = Guid.NewGuid(); TeamId = teamBravo.Id; UserId = fst userIds.[2]; JoinedAt = DateTimeOffset.UtcNow; Role = MemberRole.Owner }
                    let memberBravoPlayer =
                        { Id = Guid.NewGuid(); TeamId = teamBravo.Id; UserId = fst userIds.[3]; JoinedAt = DateTimeOffset.UtcNow; Role = MemberRole.Player }
                    db.TeamMembers.Add(memberBravoOwner) |> ignore
                    db.TeamMembers.Add(memberBravoPlayer) |> ignore

                    // Team Charlie: Eve(Owner), Frank(Player)
                    let memberCharlieOwner =
                        { Id = Guid.NewGuid(); TeamId = teamCharlie.Id; UserId = fst userIds.[4]; JoinedAt = DateTimeOffset.UtcNow; Role = MemberRole.Owner }
                    let memberCharliePlayer =
                        { Id = Guid.NewGuid(); TeamId = teamCharlie.Id; UserId = fst userIds.[5]; JoinedAt = DateTimeOffset.UtcNow; Role = MemberRole.Player }
                    db.TeamMembers.Add(memberCharlieOwner) |> ignore
                    db.TeamMembers.Add(memberCharliePlayer) |> ignore

                    let! _ = db.SaveChangesAsync()
                    Console.WriteLine($"  Teams created: Alpha(token={teamAlpha.Token}), Bravo(token={teamBravo.Token}), Charlie(token={teamCharlie.Token})")

                    // --- チャレンジ＆フラグ作成 ---
                    let challenges =
                        [| ("Basic Reversing", "Reversing", "Easy", "バイナリを解析してフラグを見つけてください。", 500, 100, 20, ScoreFunction.Linear, "flag{hello_reversing}")
                           ("Web Login Bypass", "Web", "Medium", "ログイン画面の脆弱性を見つけてください。", 300, 50, 15, ScoreFunction.Log, "flag{sql_injection_101}")
                           ("Crypto Basics", "Crypto", "Hard", "暗号文を復号してフラグを取得してください。", 400, 80, 25, ScoreFunction.Exp, "flag{caesar_is_easy}") |]
                    let challengeIds = System.Collections.Generic.List<Guid>()
                    for (name, category, difficulty, desc, initial, minimum, decay, func, flagContent) in challenges do
                        let challenge =
                            { Id = Guid.NewGuid()
                              Name = name
                              Category = category
                              Difficulty = difficulty
                              Description = desc
                              ValueInitial = initial
                              ValueMinimum = minimum
                              Decay = decay
                              Function = func
                              Logic = ChallengeLogic.Any
                              MaxAttempts = None
                              Published = true
                              ReleaseAt = None
                              CreatedAt = DateTimeOffset.UtcNow
                              RequiresInstance = false
                              InstanceImage = ""
                              InstanceDockerFolder = ""
                              InstancePort = None
                              InstanceLifetimeMinutes = 15
                              InstanceCpuLimit = "0.5"
                              InstanceMemoryLimit = "256m" }
                        db.Challenges.Add(challenge) |> ignore
                        let flag =
                            { Id = Guid.NewGuid()
                              ChallengeId = challenge.Id
                              Content = flagContent
                              ContentHash = Security.sha256 flagContent
                              CaseSensitive = true }
                        db.Flags.Add(flag) |> ignore
                        challengeIds.Add(challenge.Id)
                        Console.WriteLine($"  Challenge created: {name} ({category})")

                    let! _ = db.SaveChangesAsync()

                    // --- サンプル提出データ（スコアボードグラフ用） ---
                    let baseTime = DateTimeOffset.UtcNow.AddHours(-6.0)
                    let sampleSubmissions =
                        [| // Team Alpha の提出
                           (fst userIds.[0], challengeIds.[0], baseTime.AddMinutes(30.0), true, 450)
                           (fst userIds.[1], challengeIds.[1], baseTime.AddHours(1.0), true, 280)
                           (fst userIds.[0], challengeIds.[2], baseTime.AddHours(2.5), true, 370)
                           // Team Bravo の提出
                           (fst userIds.[2], challengeIds.[1], baseTime.AddMinutes(45.0), true, 290)
                           (fst userIds.[3], challengeIds.[0], baseTime.AddHours(1.5), true, 430)
                           (fst userIds.[2], challengeIds.[2], baseTime.AddHours(3.0), true, 350)
                           // Team Charlie の提出
                           (fst userIds.[4], challengeIds.[0], baseTime.AddHours(2.0), true, 410)
                           (fst userIds.[5], challengeIds.[2], baseTime.AddHours(4.0), true, 330) |]

                    for (userId, challengeId, time, correct, score) in sampleSubmissions do
                        let sub =
                            { Id = Guid.NewGuid()
                              AccountId = userId
                              ChallengeId = challengeId
                              SubmittedAt = time
                              IsCorrect = correct
                              ValueAwarded = score
                              Ip = "127.0.0.1" }
                        db.Submissions.Add(sub) |> ignore

                    let! _ = db.SaveChangesAsync()
                    Console.WriteLine("  Sample submissions created.")
                    Console.WriteLine("Seed data completed.")
        }
        |> fun t -> t.GetAwaiter().GetResult()
    seedTestData ()

    // バックグラウンドでインスタンスクリーンアップタスク開始
    let startInstanceCleanupTask () =
        Task.Run(fun () ->
            task {
                while true do
                    try
                        use scope = app.Services.CreateScope()
                        let db = scope.ServiceProvider.GetRequiredService<CtfdDbContext>()
                        let! count = InstanceManager.cleanupExpiredInstances db
                        ()
                    with ex ->
                        Console.WriteLine($"Instance cleanup error: {ex.Message}")
                    do! Task.Delay(TimeSpan.FromMinutes(5.0))
            } :> Task)
    startInstanceCleanupTask () |> ignore

    mapRoutes app
    app.Run()
    0