Add idempotency and duplicate-submission protection

[A6dulmalik]

Priority: P0

Labels: backend, security, gameplay, priority: p0

Problem

A player could potentially submit the same answer multiple times because of:

• double clicking
• network retries
• browser refresh
• malicious requests
• frontend bugs

This becomes especially dangerous when XP or rewards are involved.

Requirements

Implement idempotency for challenge submissions.

Example:

submissionId

or:

Idempotency-Key

The backend must ensure the same submission cannot:

award XP twice
advance the session twice
create duplicate rewards

Acceptance Criteria

• Duplicate submissions are detected.
• XP cannot be duplicated.
• Reward eligibility cannot be duplicated.
• Session cannot advance twice.
• Tests cover repeated requests.

[samkay-ops]

Hi team,
I'm applying to work on this issue.
I have strong experience with TypeScript, NestJS, and Soroban smart contracts. I will deliver clean, tested code following the acceptance criteria.
Ready to start immediately.
Best regards,
samkay-ops

[TechBroAfrica]

Focused on building trust through consistent, meaningful contributions. I approach every issue with curiosity, attention to detail, and a commitment to delivering clean, maintainable, and well-tested solutions. Driven by impact, not just commits, I value clear communication, effective collaboration with maintainers, continuous learning, and delivering meaningful value to every project I contribute to.

[arandomogg]

Hi, I’m interested in contributing to this issue. I’m a full-stack blockchain developer with experience in JavaScript/TypeScript and Web3 development. I’ve gone through the requirements and would be happy to work on the implementation, follow the project’s conventions, and submit a clean PR for review.

[m-hajjo]

Hello Maintainer

i would love to handle this issue

[grantfox-oss]

🦊 GrantFox — @m-hajjo has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #626)
2. Your PR will be reviewed by the MindBlockLabs maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!

@m-hajjo's PR #650 was approved and merged by @A6dulmalik.

🏆 @m-hajjo: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (694 total points). Track your full progress on GrantFox.

👏 Great work, @m-hajjo! Keep contributing to MindBlockLabs.