Major fixes

Author: ShreeBohara

.dockerignore

@@ -0,0 +1,17 @@
+.git
+.github
+node_modules
+**/node_modules
+apps/web/.next
+apps/web/tsconfig.tsbuildinfo
+apps/web/next-env.d.ts
+apps/web/pnpm-lock.yaml
+apps/web/pnpm-workspace.yaml
+apps/api/venv
+apps/api/.pytest_cache
+apps/api/.ruff_cache
+apps/api/.coverage
+apps/api/data
+data
+Documents
+*.log

.github/workflows/ci.yml

@@ -51,7 +51,7 @@ jobs:
     - name: Install pnpm
       uses: pnpm/action-setup@v3
       with:
-        version: 9
+        version: 10.28.2
 
     - name: Setup Node.js
       uses: actions/setup-node@v4
@@ -66,7 +66,7 @@ jobs:
       run: pnpm --filter web lint
 
     - name: Type Check
-      run: pnpm --filter web tsc --noEmit
+      run: pnpm --filter web type-check
 
     - name: Run Tests
       run: pnpm --filter web test

.gitignore

@@ -83,4 +83,4 @@ htmlcov/
 *.tmp
 .cache/
 Documents/
-repos/
+/repos/

apps/api/src/api/routes/learning.py

@@ -2,12 +2,14 @@
 
 from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel
+from sqlalchemy.orm import Session
 
-from src.dependencies import get_gamification_service, get_learning_service
+from src.dependencies import get_db, get_gamification_service, get_learning_service
 from src.models.codetour_schemas import CodeTour
 from src.models.learning import LessonContent, Persona, Syllabus
 from src.services.gamification import GamificationService, UserStats
 from src.services.learning_service import LearningService
+from src.services.challenges import ChallengeService
 
 router = APIRouter(tags=["learning"])
 
@@ -262,15 +264,12 @@ async def generate_challenge(
     repo_id: str,
     lesson_id: str,
     request: GenerateChallengeRequest,
-    learning_service: LearningService = Depends(get_learning_service)
+    learning_service: LearningService = Depends(get_learning_service),
+    db: Session = Depends(get_db),
 ):
     """Generate an interactive challenge for a lesson."""
-    from src.dependencies import get_db
-    from src.services.challenges import ChallengeService
-
     try:
         # Create challenge service with LLM from learning service
-        db = next(get_db())
         challenge_service = ChallengeService(db, learning_service._llm)
 
         challenge = await challenge_service.generate_challenge(
@@ -295,21 +294,20 @@ class ValidateBugHuntRequest(BaseModel):
 async def validate_bug_hunt(
     repo_id: str,
     request: ValidateBugHuntRequest,
-    gamification: GamificationService = Depends(get_gamification_service)
+    gamification: GamificationService = Depends(get_gamification_service),
+    db: Session = Depends(get_db),
 ):
     """Validate a bug hunt challenge answer."""
-    from src.dependencies import get_db
-    from src.services.challenges import ChallengeService
-
     try:
-        db = next(get_db())
         challenge_service = ChallengeService(db)
         result = challenge_service.validate_bug_hunt(request.challenge, request.selected_line)
 
         # Award XP if correct
         if result["correct"]:
             xp_gain = gamification.record_challenge_complete(repo_id, request.used_hint)
             result["xp_gained"] = xp_gain.model_dump()
+            result["xp_earned"] = xp_gain.amount + xp_gain.bonus
+            result["stats"] = gamification.get_user_stats(repo_id).model_dump()
 
         return result
     except Exception as e:
@@ -326,21 +324,20 @@ class ValidateCodeTraceRequest(BaseModel):
 async def validate_code_trace(
     repo_id: str,
     request: ValidateCodeTraceRequest,
-    gamification: GamificationService = Depends(get_gamification_service)
+    gamification: GamificationService = Depends(get_gamification_service),
+    db: Session = Depends(get_db),
 ):
     """Validate a code trace challenge answer."""
-    from src.dependencies import get_db
-    from src.services.challenges import ChallengeService
-
     try:
-        db = next(get_db())
         challenge_service = ChallengeService(db)
         result = challenge_service.validate_code_trace(request.challenge, request.selected_index)
 
         # Award XP if correct
         if result["correct"]:
             xp_gain = gamification.record_challenge_complete(repo_id, request.used_hint)
             result["xp_gained"] = xp_gain.model_dump()
+            result["xp_earned"] = xp_gain.amount + xp_gain.bonus
+            result["stats"] = gamification.get_user_stats(repo_id).model_dump()
 
         return result
     except Exception as e:
@@ -357,21 +354,20 @@ class ValidateFillBlankRequest(BaseModel):
 async def validate_fill_blank(
     repo_id: str,
     request: ValidateFillBlankRequest,
-    gamification: GamificationService = Depends(get_gamification_service)
+    gamification: GamificationService = Depends(get_gamification_service),
+    db: Session = Depends(get_db),
 ):
     """Validate a fill in the blank challenge answer."""
-    from src.dependencies import get_db
-    from src.services.challenges import ChallengeService
-
     try:
-        db = next(get_db())
         challenge_service = ChallengeService(db)
         result = challenge_service.validate_fill_blank(request.challenge, request.answers)
 
         # Award XP if correct
         if result["correct"]:
             xp_gain = gamification.record_challenge_complete(repo_id, request.used_hint)
             result["xp_gained"] = xp_gain.model_dump()
+            result["xp_earned"] = xp_gain.amount + xp_gain.bonus
+            result["stats"] = gamification.get_user_stats(repo_id).model_dump()
 
         return result
     except Exception as e:

apps/api/src/core/github/repo_manager.py

@@ -152,18 +152,24 @@ async def cleanup_local_repo(self, local_path: str):
 
     async def get_file_content(self, owner: str, name: str, file_path: str) -> str:
         """Read content of a specific file in the repository."""
+        requested_path = Path(file_path)
+        if requested_path.is_absolute():
+            raise ValueError(f"Invalid file path: {file_path}")
+
         repo_root = self.get_local_path(owner, name).resolve()
-        target_path = (repo_root / file_path).resolve()
+        target_path = (repo_root / requested_path).resolve()
 
         # Security check: Ensure target is within repo root
-        if not str(target_path).startswith(str(repo_root)):
+        try:
+            target_path.relative_to(repo_root)
+        except ValueError:
             raise ValueError(f"Invalid file path: {file_path}")
 
         if not target_path.exists():
             raise FileNotFoundError(f"File not found: {file_path}")
 
         if not target_path.is_file():
-             raise ValueError(f"Path is not a file: {file_path}")
+            raise ValueError(f"Path is not a file: {file_path}")
 
         # Read file with utf-8, ignoring errors
         with open(target_path, "r", encoding="utf-8", errors="ignore") as f:

apps/api/src/services/challenges.py

@@ -97,7 +97,11 @@ async def generate_challenge(
         prompt = self._build_challenge_prompt(challenge_type, context, code_references)
 
         try:
-            response = await self._llm.generate(prompt)
+            messages = [
+                {"role": "system", "content": "You are a challenge generator. Output valid JSON only."},
+                {"role": "user", "content": prompt},
+            ]
+            response = await self._llm.generate(messages)
             challenge_data = self._parse_challenge_response(response, challenge_type)
 
             return {

apps/api/tests/integration/test_learning_challenges.py

@@ -0,0 +1,98 @@
+from unittest.mock import MagicMock
+
+from src.dependencies import get_db, get_gamification_service
+from src.services.gamification import LevelInfo, StreakInfo, UserStats, XPGain
+
+
+class DummyGamificationService:
+    def __init__(self):
+        self.record_calls = []
+
+    def record_challenge_complete(self, repo_id: str, used_hint: bool) -> XPGain:
+        self.record_calls.append((repo_id, used_hint))
+        if used_hint:
+            return XPGain(amount=75, reason="challenge_complete")
+        return XPGain(amount=150, reason="challenge_perfect")
+
+    def get_user_stats(self, repo_id: str) -> UserStats:
+        return UserStats(
+            total_xp=225,
+            level=LevelInfo(
+                level=2,
+                title="Explorer",
+                icon="🔍",
+                current_xp=225,
+                xp_for_next_level=500,
+                xp_progress=0.1,
+            ),
+            streak=StreakInfo(current=2, longest=3, active_today=True),
+            lessons_completed=1,
+            quizzes_passed=1,
+            challenges_completed=2,
+            perfect_quizzes=0,
+        )
+
+
+def test_validate_bug_hunt_returns_backend_scoring_payload(client):
+    dummy_service = DummyGamificationService()
+    mock_db = MagicMock()
+
+    app = client.app
+    app.dependency_overrides[get_db] = lambda: mock_db
+    app.dependency_overrides[get_gamification_service] = lambda: dummy_service
+
+    payload = {
+        "challenge": {
+            "data": {
+                "bug_line": 4,
+                "bug_description": "Null check missing",
+            }
+        },
+        "selected_line": 4,
+        "used_hint": True,
+    }
+
+    response = client.post("/api/learning/repo-1/challenges/validate/bug_hunt", json=payload)
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["correct"] is True
+    assert data["xp_earned"] == 75
+    assert data["xp_gained"]["amount"] == 75
+    assert data["stats"]["total_xp"] == 225
+    assert dummy_service.record_calls == [("repo-1", True)]
+
+    app.dependency_overrides.clear()
+
+
+def test_validate_code_trace_incorrect_does_not_award_xp(client):
+    dummy_service = DummyGamificationService()
+    mock_db = MagicMock()
+
+    app = client.app
+    app.dependency_overrides[get_db] = lambda: mock_db
+    app.dependency_overrides[get_gamification_service] = lambda: dummy_service
+
+    payload = {
+        "challenge": {
+            "data": {
+                "correct_index": 1,
+                "options": ["A", "B", "C", "D"],
+                "explanation": "B is correct",
+            }
+        },
+        "selected_index": 0,
+        "used_hint": False,
+    }
+
+    response = client.post("/api/learning/repo-2/challenges/validate/code_trace", json=payload)
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["correct"] is False
+    assert data["xp_earned"] == 0
+    assert "xp_gained" not in data
+    assert "stats" not in data
+    assert dummy_service.record_calls == []
+
+    app.dependency_overrides.clear()

apps/api/tests/unit/test_repo_manager.py

@@ -0,0 +1,61 @@
+from pathlib import Path
+
+import pytest
+
+from src.config import settings
+from src.core.github.repo_manager import RepoManager
+
+
+@pytest.mark.asyncio
+async def test_get_file_content_reads_valid_repo_file(tmp_path, monkeypatch):
+    repos_root = tmp_path / "repos"
+    monkeypatch.setattr(settings, "repos_dir", str(repos_root))
+
+    owner = "octocat"
+    repo = "hello-world"
+    repo_root = repos_root / owner / repo
+    target = repo_root / "src" / "main.py"
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text("print('hello')", encoding="utf-8")
+
+    manager = RepoManager()
+    content = await manager.get_file_content(owner, repo, "src/main.py")
+
+    assert content == "print('hello')"
+
+
+@pytest.mark.asyncio
+async def test_get_file_content_rejects_parent_traversal(tmp_path, monkeypatch):
+    repos_root = tmp_path / "repos"
+    monkeypatch.setattr(settings, "repos_dir", str(repos_root))
+
+    owner = "octocat"
+    repo = "hello-world"
+    repo_root = repos_root / owner / repo
+    repo_root.mkdir(parents=True, exist_ok=True)
+    outside = repos_root / owner / "secret.txt"
+    outside.write_text("do not read", encoding="utf-8")
+
+    manager = RepoManager()
+    with pytest.raises(ValueError, match="Invalid file path"):
+        await manager.get_file_content(owner, repo, "../secret.txt")
+
+
+@pytest.mark.asyncio
+async def test_get_file_content_rejects_prefix_sibling_escape(tmp_path, monkeypatch):
+    repos_root = tmp_path / "repos"
+    monkeypatch.setattr(settings, "repos_dir", str(repos_root))
+
+    owner = "octocat"
+    repo = "hello-world"
+    repo_root = repos_root / owner / repo
+    repo_root.mkdir(parents=True, exist_ok=True)
+
+    sibling_repo = repos_root / owner / "hello-world-evil"
+    sibling_target = sibling_repo / "secret.txt"
+    sibling_target.parent.mkdir(parents=True, exist_ok=True)
+    sibling_target.write_text("sensitive", encoding="utf-8")
+
+    manager = RepoManager()
+    with pytest.raises(ValueError, match="Invalid file path"):
+        await manager.get_file_content(owner, repo, "../hello-world-evil/secret.txt")

apps/web/next.config.ts

@@ -1,7 +1,7 @@
 import type { NextConfig } from "next";
 
 const nextConfig: NextConfig = {
-  /* config options here */
+  output: "standalone",
 };
 
 export default nextConfig;

apps/web/package.json

@@ -7,7 +7,8 @@
     "build": "next build",
     "start": "next start",
     "lint": "eslint",
-    "test": "vitest"
+    "test": "vitest",
+    "type-check": "tsc --noEmit"
   },
   "dependencies": {
     "@types/react-syntax-highlighter": "^15.5.13",
@@ -45,4 +46,4 @@
     "typescript": "^5",
     "vitest": "^4.0.18"
   }
-}
+}