[rohanbuilds-ai]

Summary

• Require persistent authenticated sessions for challenge checking and hint usage.
• Replace ineffective temporary-session truthiness checks with the existing authentication dependency.
• Preserve public challenge read endpoints.

Security rationale

Temporary sessions are valid SessionContext objects, so checking whether the context exists does not reject anonymous visitors. The authenticated dependency rejects temporary sessions with HTTP 401.

Tests

• uv run pytest tests/unit/ctf/test_challenge_auth_guard.py -v — 6 passed
• uv run pytest tests/unit/apps/web/test_routes.py -q — 13 passed
• isort, Black, and git diff --check — clean (0 errors)

Fixes #514

[prince-shakyaa]

Hi @rohanbuilds-ai, thanks for working on this! Just a heads-up: this looks like a duplicate of #515, which I opened on May 28 for the same issue (#514, which I also filed). Both PRs make the same change: they swap to get_authenticated_session_context and remove the dead if not session_context guard.

@saikishu @e2hln, flagging the overlap so you can decide how you'd like to proceed. Happy to update #515 based on your direction.

[rohanbuilds-ai]

Hi @prince-shakyaa, thanks for pointing this out! I wasn't aware of #515 when I opened my PR. Since yours was opened earlier for the same issue, I'm happy to close #602 to avoid duplication. If helpful, I can review #515 and contribute any missing test coverage or improvements there. Thanks for the heads-up!

[prince-shakyaa]

Thanks @rohanbuilds-ai, really appreciate it! Just so you know, I've since updated #515 after @c-thiam's comment on #514. It no longer requires login, since players without an account are meant to be able to check progress and use hints. It now only removes the dead if not session_context check and adds tests. A review there would be great, and any extra test cases are welcome too.