Skip to content

fix(team-debates): require captain auth and matched teams on create - #788

Draft
Shreyas-Gowda26 wants to merge 1 commit into
AOSSIE-Org:mainfrom
Shreyas-Gowda26:fix/638-clean-pr
Draft

Shreyas-Gowda26 wants to merge 1 commit into
AOSSIE-Org:mainfrom
Shreyas-Gowda26:fix/638-clean-pr

Conversation

@Shreyas-Gowda26

Copy link
Copy Markdown
Contributor

Addressed Issues:

Fixes #638

Screenshots/Recordings:

Before: POST /team-debates/ returned 200 OK and created a debate with
GET /matchmaking/pool showing poolSize: 0 (see the screenshot in #638).
image

After:

  • Teams not in the matchmaking pool -> 409 Conflict
  • Logged in as a non-captain member of team 1 -> 403 Forbidden
  • Captain of team 1, both teams matched in the pool -> 200 OK; pool is then empty (poolSize: 0)
  • Repeating the same request -> 409 Conflict (no duplicate debate)
Screenshot 2026-10-29 at 10 19 00 AM Screenshot 2026-10-29 at 10 12 16 AM Screenshot 2026-10-29 at 10 10 31 AM

Additional Notes:

  • POST /team-debates/ now requires an authenticated user (401) who is the
    captain of team1Id (403), and both teams must currently be matched in the
    matchmaking pool (409).
  • Both teams are claimed from the pool atomically (ClaimMatchedTeams), so one
    match can't create duplicate debates. They are restored if creation fails.
  • Team 2's captain is not asked to confirm, since both teams opted in by
    joining the pool. A confirmation step would be a separate feature.
  • The matchmaking pool is still in-memory (single backend instance), as before.
  • Added unit tests in services/team_matchmaking_claim_test.go.

Checklist

  • My PR addresses a single issue, fixes a single bug or makes a single improvement.
  • My code follows the project's code style and conventions
  • If applicable, I have made corresponding changes or additions to the documentation
  • If applicable, I have made corresponding changes or additions to tests
  • My changes generate no new warnings or errors
  • I have joined the Discord server and I will share a link to this PR with the project maintainers there
  • I have read the Contribution Guidelines
  • Once I submit my PR, CodeRabbit AI will automatically review it and I will address CodeRabbit's comments.
  • I have filled this PR template completely and carefully, and I understand that my PR may be closed without review otherwise.

@coderabbitai

coderabbitai Bot commented Oct 29, 2026

Copy link
Copy Markdown

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@gitcordapp

gitcordapp Bot commented Oct 29, 2026

Copy link
Copy Markdown

Link your account with Gitcord

Thanks for opening this PR, @Shreyas-Gowda26!

To receive Discord notifications and contributor tracking for this organization:

  1. Join Discord: https://discord.gg/hjUhu33uAn
  2. In Discord, run /link Shreyas-Gowda26
  3. Paste the verification code into your GitHub bio (or a public gist)
  4. Click Verify in Discord (or run /verify-link Shreyas-Gowda26)

Once linked, Gitcord can notify you about reviews, merges, and more.

— Posted by Gitcord

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG]: Team debate endpoint allows unauthorized and unmatched teams

1 participant