[prince-shakyaa]

Fixes #514

Summary

Removes a login check in the challenge check and hint endpoints that never actually runs. Players without an account can still use both endpoints, same as today.

What was wrong

check_challenge and use_hint in finbot/apps/ctf/routes/challenges.py both had this:

if not session_context:
    raise HTTPException(status_code=401, detail="Authentication required")

This never runs. get_session_context always returns a session, even for players who haven't signed up (temporary sessions), so session_context is never empty. The code looks like it blocks logged-out players, but it doesn't do anything. That's misleading for anyone reading or changing this code later.

What this PR changes

finbot/apps/ctf/routes/challenges.py

• Removed the dead check from check_challenge and use_hint.
• Kept get_session_context on both, so players without an account can still check progress and use hints.
• Added a short note in each docstring saying this is on purpose.

tests/unit/apps/ctf/test_challenge_auth.py (new)

• A temporary session can call POST /check and gets a 200 (and the attempt is recorded).
• A temporary session can call POST /hint and gets a 200 with the hint text.
• Both endpoints use get_session_context.
• The dead if not session_context check is gone from both.

Behavior

	Before	After
Player without account calls /check or /hint	Works	Works (no change)
Logged-in player calls /check or /hint	Works	Works (no change)
Dead if not session_context check	In code, never runs	Removed

No change for players. This is a cleanup plus tests.

Why not require login?

The first version of this PR switched both endpoints to get_authenticated_session_context, which would block players without an account. Based on the comments here and on #514, the CTF is meant to be playable without signing up, so I took that out.

Follow-up (not in this PR)

• If we want players without an account to get fewer hints (as @stealthwhizz suggested), I can add a limit in a separate PR once we agree on the number.
• list_challenges and get_challenge have a similar if session_context: check that is always true. It's harmless there, so I left it alone to keep this PR small.

Testing

pytest tests/unit/apps/ctf/test_challenge_auth.py -v   # 6 passed
pytest tests/unit -q                                   # 313 passed, 26 skipped, 3 failed

The 3 failures are in tests/unit/agents/test_specialized_agents.py. They fail on main too and aren't related to this change.

Checklist

• Dead check removed from both endpoints
• Players without an account can still use /check and /hint
• GET /challenges and GET /challenges/{id} unchanged
• New tests added and passing
• No new test failures

[prince-shakyaa]

Hey @saikishu @e2hln ,
I found a dead auth guard in the check and hint challenge endpoints where if not session_context could never fire, letting unauthenticated users freely access both endpoints and leak hint text. Fixed it by swapping to get_authenticated_session_context (same pattern as every other protected route) and added 9 unit tests to prevent regression.
Happy to make any changes based on your review!
Thank You.

[joshlochner]

Sai, do we want unauthenticated users to be able to get hints?

[stealthwhizz]

Sai, do we want unauthenticated users to be able to get hints?

Hey @joshlochner , i think there should be a difference between auth and unauth users..
People wont signup if its same for both Right...
and at EOD this is meant for learning
so i think providing unauth users with less hints would be a better option.

[prince-shakyaa]

Thanks @joshlochner and @stealthwhizz for the input, and @c-thiam for the comment on #514.

I've updated the PR based on that. It no longer requires login. Players without an account can still check progress and use hints, same as now. The PR now just removes the dead if not session_context check and adds tests, so it should be safe to merge either way.

@saikishu if you'd like players without an account to get fewer hints, I'm happy to do that in a follow-up PR. Just let me know what limit you'd want.