feat: Peer Challenge (SP Wager System) — P2P competitive challenges with escrow & settlement - #99
Open
nit1914 wants to merge 8 commits into
Open
feat: Peer Challenge (SP Wager System) — P2P competitive challenges with escrow & settlement#99nit1914 wants to merge 8 commits into
nit1914 wants to merge 8 commits into
Conversation
- Resolve B1: Default Express ADMIN_EMAIL and ADMIN_TOKEN to empty strings.
- Resolve B2: Eliminate XSS vulnerability in Needs Attention card by replacing dangerouslySetInnerHTML with structured safe JSX.
- Resolve B3: Rewrite spLedger.js service layer to match correct SPTransaction schema fields.
- Resolve B4: Correct sp.js service layer field names and add fallback safety defaults.
- Address non-blocking improvements:
* N5: Wrap search/confirm API routes in try-catch to prevent MongoDB crashes.
* N6: Wrap AdminView fetch requests in try-catch blocks to prevent UI hangs.
* N7: Evict stale liveViewers entries every 5 minutes to prevent memory bloat.
* N9: Eliminate duplicate .metric class in stylesheet.
* N10: Add aria-label='Close' and × character to close buttons.
* N14: Fix admin ping useEffect to track [auth] credentials.
* N17: Remove invalid '.chart-dot:hover { r: 5 }' rule.
- Revert studentEmailFromRequest() to return a plain email string to prevent Mongo query failures across survey/status and ping routes. vibeData is now attached directly to req.vibeData. - Default ADMIN_EMAIL and ADMIN_TOKEN to null (instead of ''). Update isAdmin() to block unconfigured blank-header authorization requests. - Restructure appendTransaction() in spLedger.js to perform an atomic findOneAndUpdate update on student SP, guaranteeing consistency of balanceAfter. - Remove redundant duplicate formatDate() declaration in SpTrendChart.
…ixes, and dummy student seeder
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the Peer Challenge feature — a student-vs-student SP wager system where classmates can challenge each other on tracked topics (Vibe Course Progress, Matrix Questions, Poll Accuracy), lock SP in escrow, and have outcomes settled automatically.
What's Included
Backend (
server/)models/Challenge.js): Mongoose schema with full lifecycle (pending → active → settled/expired/cancelled/declined), escrow tracking, audit trail, and progress snapshotsroutes/challenges.js): Complete REST API for challenge CRUD:GET /topics— available challenge topicsGET /peers?q=— peer search with concurrent-challenge limit checksPOST /— create challenge with SP validation & escrowGET /mine— fetch all challenges for the logged-in student (categorized into sent/received/active/history)GET /:id— single challenge detail with live progressPOST /:id/accept— accept with opponent SP verificationPOST /:id/decline— decline a pending challengePOST /:id/cancel— cancel own pending challengemiddleware/challengeMiddleware.js): Auth & access control for challenge routesjobs/settleChallenges.js): Background job (runs every 5 min) that auto-expires timed-out pending challenges and settles completed active challenges with SP transfersFrontend (
client/src/)/spurti/challenges): Public-facing page explaining how challenges workGuardrails & Validation
Testing
No Changes to Existing Data Model
This PR does not modify the existing
Studentschema or any upstream collections. TheChallengemodel is a new, additive collection. SP transfers on settlement use the existingSpTransactionmodel.