262 lines
7.4 KiB
Markdown
262 lines
7.4 KiB
Markdown
# Code Submission
|
|
|
|
This project is a Leptos + Axum app for a multi-step code submission challenge. It exposes a small web UI where users enter a code, accepts challenge submissions for valid codes, and can toggle the server between offline and live mode for SMS-driven challenge flow testing.
|
|
|
|
## Overview
|
|
|
|
The app supports:
|
|
|
|
- A home page for entering challenge codes.
|
|
- A `/submit/:code` route that validates supported codes.
|
|
- A `/manage` page to toggle the server between live and offline states.
|
|
- A `/history` page for successful submission records.
|
|
- A protected `POST /event/buzz` endpoint for challenge code 1, which validates a secret and timing window.
|
|
- TextBee SMS notifications when the server is live.
|
|
|
|
This repository is not a generic template anymore; it is a working challenge server with specific code-handling behavior and operational configuration.
|
|
|
|
## Project structure
|
|
|
|
```text
|
|
.
|
|
├── Cargo.toml
|
|
├── README.md
|
|
├── dev.env
|
|
├── LICENSE
|
|
├── end2end/
|
|
│ ├── package.json
|
|
│ ├── playwright.config.ts
|
|
│ └── tests/
|
|
├── public/
|
|
│ ├── challenge3.txt
|
|
│ ├── challenge3_annotated.txt
|
|
│ └── favicon.ico
|
|
├── src/
|
|
│ ├── app.rs
|
|
│ ├── lib.rs
|
|
│ ├── main.rs
|
|
│ ├── manage.rs
|
|
│ ├── secrets.rs
|
|
│ └── codes/
|
|
│ ├── code1.rs
|
|
│ ├── code2.rs
|
|
│ ├── code5.rs
|
|
│ ├── history.rs
|
|
│ └── mod.rs
|
|
├── style/
|
|
│ └── main.scss
|
|
└── target/
|
|
```
|
|
|
|
## Features
|
|
|
|
### Code 1
|
|
|
|
Code 1 is the timed buzz challenge. It accepts a `POST /event/buzz` request with:
|
|
|
|
```json
|
|
{
|
|
"delay_ms": 6388,
|
|
"secret": "<your CODE1_SECRET value>"
|
|
}
|
|
```
|
|
|
|
Behavior:
|
|
|
|
- `delay_ms` must be a non-negative integer.
|
|
- `secret` must match `CODE1_SECRET` exactly.
|
|
- The request is only accepted in the `America/Chicago` window from 11:00 AM to 1:30 PM inclusive.
|
|
- The server computes the signed delta from the target of `6430 ms`.
|
|
- Deltas outside the inclusive range `-500` to `+500` are rejected and ignored.
|
|
- Valid submissions return HTTP `202`.
|
|
- When live, the app sends SMS notifications via TextBee to the configured recipients.
|
|
- When offline, it logs the planned SMS actions instead.
|
|
|
|
The challenge text includes the literal strings `CHALLENGE_1_FIRST` and `CHALLENGE_1_SECOND`, which are sent to the configured recipients once the buzz is accepted.
|
|
|
|
### Code 2
|
|
|
|
The code value is `QJ4EAN` and is case-insensitive.
|
|
|
|
On successful submission:
|
|
|
|
- It records the success in the submission history.
|
|
- If the server is live, it sends a TextBee SMS to `RECIPIENT_SELF`.
|
|
- If the server is offline, it logs the notification instead.
|
|
|
|
### Code 5
|
|
|
|
The code value is `V7MK2P` and is case-insensitive.
|
|
|
|
On successful submission:
|
|
|
|
- It records the success in the submission history.
|
|
- If the server is live, it sends a TextBee SMS to `RECIPIENT_SELF`.
|
|
- If the server is offline, it logs the notification instead.
|
|
- It shows a completion message without providing a download.
|
|
|
|
## Getting started
|
|
|
|
### Prerequisites
|
|
|
|
You need Rust, the Leptos toolchain, and the project dependencies.
|
|
|
|
If you do not have `cargo-leptos` installed:
|
|
|
|
```bash
|
|
cargo install cargo-leptos --locked
|
|
```
|
|
|
|
If you need the additional tooling required by cargo-leptos:
|
|
|
|
```bash
|
|
rustup toolchain install nightly --allow-downgrade
|
|
rustup target add wasm32-unknown-unknown
|
|
cargo install cargo-generate
|
|
npm install -g sass
|
|
```
|
|
|
|
Then install the end-to-end test dependencies:
|
|
|
|
```bash
|
|
cd end2end
|
|
npm install
|
|
```
|
|
|
|
### Environment configuration
|
|
|
|
Copy the sample environment file to `.env` before starting the app:
|
|
|
|
```powershell
|
|
Copy-Item dev.env .env
|
|
```
|
|
|
|
The app loads `.env` automatically at startup and validates the required values. The expected settings are defined in `src/secrets.rs` and include:
|
|
|
|
- `DEV_SECRET_KEY` — required for admin actions such as toggling live/offline mode and accessing submission history.
|
|
- `TEXTBEE_API_KEY` — required for sending SMS via TextBee.
|
|
- `TEXTBEE_DEVICE_ID` — optional, selects a specific paired device.
|
|
- `RECIPIENT_SELF`, `RECIPIENT_1`, `RECIPIENT_2` — each must be a valid E.164 phone number.
|
|
- `CODE1_SECRET` — required and must be at least 32 bytes long.
|
|
- `PROD` — set to `true` to start the server in the live state. Truthy values are `1`, `true`, `yes`, and `on` (case-insensitive); any other value starts the server offline.
|
|
|
|
Do not commit secrets or expose them in client-side code.
|
|
|
|
### Run the app
|
|
|
|
```bash
|
|
cargo leptos watch
|
|
```
|
|
|
|
Then open the local app in your browser as directed by cargo-leptos.
|
|
|
|
## Management and admin flow
|
|
|
|
The app includes a status management page at `/manage`.
|
|
|
|
- It shows whether the server is currently live.
|
|
- It lets an operator toggle the server status.
|
|
- It requires the configured `DEV_SECRET_KEY` before changing state.
|
|
|
|
This is how the system can be transitioned between testing/offline and live challenge operation without exposing the settings publicly.
|
|
|
|
## Challenge testing
|
|
|
|
### Test Code 1 with curl
|
|
|
|
With the server running locally and `CODE1_SECRET` set in your shell:
|
|
|
|
```sh
|
|
curl.exe -X POST http://127.0.0.1:3000/event/buzz -H "Content-Type: application/json" -d '{"delay_ms":6388,"secret":"<your CODE1_SECRET value>"}'
|
|
```
|
|
|
|
The server calculates `6388 - 6430 = -42` ms, and a valid request returns HTTP `202`.
|
|
|
|
### Test Code 1 with Postman
|
|
|
|
Create a `POST` request to `http://127.0.0.1:3000/event/buzz`, select Body > raw > JSON, and send:
|
|
|
|
```json
|
|
{
|
|
"delay_ms": 6388,
|
|
"secret": "<your CODE1_SECRET value>"
|
|
}
|
|
```
|
|
|
|
### Test Code 1 with Node.js
|
|
|
|
```javascript
|
|
async function main() {
|
|
const delayMs = 6388;
|
|
const secret = process.env.CODE1_SECRET;
|
|
if (!secret) throw new Error("CODE1_SECRET is not set");
|
|
|
|
const response = await fetch("http://127.0.0.1:3000/event/buzz", {
|
|
method: "POST",
|
|
headers: { "content-type": "application/json" },
|
|
body: JSON.stringify({ delay_ms: delayMs, secret }),
|
|
});
|
|
|
|
console.log(response.status, await response.text());
|
|
}
|
|
|
|
main().catch((error) => {
|
|
console.error(error);
|
|
process.exitCode = 1;
|
|
});
|
|
```
|
|
|
|
When the server is live, a successful test event sends the configured TextBee SMS to the configured recipients. When it is offline, it logs the action instead.
|
|
|
|
## Build, test, and release
|
|
|
|
### Compile for release
|
|
|
|
```bash
|
|
cargo leptos build --release
|
|
```
|
|
|
|
This will generate the server binary in `target/release` and the site bundle in `target/site`.
|
|
|
|
### End-to-end tests
|
|
|
|
```bash
|
|
cargo leptos end-to-end
|
|
```
|
|
|
|
```bash
|
|
cargo leptos end-to-end --release
|
|
```
|
|
|
|
Cargo-leptos uses Playwright for browser tests and the test files are under `end2end/tests`.
|
|
|
|
## Remote deployment without the Rust toolchain
|
|
|
|
After running `cargo leptos build --release`, the minimum files needed are:
|
|
|
|
1. The server binary in `target/server/release`
|
|
2. The `site` directory and all files inside it in `target/site`
|
|
|
|
Copy these files to your remote server. The expected directory structure is:
|
|
|
|
```text
|
|
code_submission
|
|
site/
|
|
```
|
|
|
|
Set the appropriate environment variables before starting the binary:
|
|
|
|
```sh
|
|
export LEPTOS_OUTPUT_NAME="code_submission"
|
|
export LEPTOS_SITE_ROOT="site"
|
|
export LEPTOS_SITE_PKG_DIR="pkg"
|
|
export LEPTOS_SITE_ADDR="0.0.0.0:3000"
|
|
export LEPTOS_RELOAD_PORT="3001"
|
|
```
|
|
|
|
Then run the server binary.
|
|
|
|
## Licensing
|
|
|
|
This project is released under the repository's existing license. The default template license is present in `LICENSE`, and you should replace it with an appropriate license if you intend to distribute this project publicly.
|