CLI support: GitHub token storage, completion validation, local dev (#184)

* Store GitHub token on login for CLI fork support

- Add github_token column to users table
- Store GitHub OAuth token when user logs in via GitHub
- Expose github_token in UserResource when include_github_token=1 is requested
- Token is hidden by default (in $hidden array)

* Validate submission before completion, skip screenshot locally

- Block marking challenge as complete without a submission (422)
- Skip screenshot service when SCREENSHOT_SERVICE_BASE_URL is empty
  (allows local development without the screenshot service)
- Same change applied to both submit and updateSubmission methods

* Add tests for completion validation

- Test that completing without submission returns 422
- Test that completing after submission succeeds

Author: icaroharry

app/Http/Controllers/Auth/GithubLoginController.php

@@ -68,6 +68,7 @@ public function githubLogin(Request $request)
             $user->github_id = $githubUserData->getId();
             $user->github_user = $githubUserData->getNickname();
             $user->github_data = $githubUserData->user;
+            $user->github_token = $request->input('github_token');
 
             $user->save();
 

app/Http/Controllers/ChallengeController.php

@@ -249,6 +249,17 @@ public function updateChallengeUser(Request $request, $slug)
             'fork_url' => 'nullable|url',
         ]);
 
+        // Prevent marking as complete without a submission
+        if (! empty($validated['completed']) && $validated['completed'] === true) {
+            $pivot = $challenge->users()->where('user_id', $request->user()->id)->first();
+            if ($pivot && ! $pivot->pivot->submitted_at) {
+                return response()->json(
+                    ['error' => 'You must submit your solution before marking as complete.'],
+                    422
+                );
+            }
+        }
+
         $challenge
             ->users()
             ->updateExistingPivot($request->user()->id, $validated);
@@ -325,22 +336,26 @@ public function submit(Request $request, $slug)
             "challenge-screenshots/$slug-$challengeUser->github_id-".
             Str::random(10).
             '.webp';
-        $apiUrl = config('services.screenshot.base_url').'/screenshot';
 
-        $response = Http::withHeaders([
-            'Authorization' => 'Bearer '.config('services.screenshot.token'),
-            'Accept' => 'application/json',
-        ])->post($apiUrl, [
-            'url' => $validated['submission_url'],
-            'fileName' => $imagePath,
-        ]);
+        $imageUrl = null;
+        $apiUrl = config('services.screenshot.base_url');
 
-        if ($response->failed()) {
-            abort(500, $response);
-        }
+        if ($apiUrl) {
+            $response = Http::withHeaders([
+                'Authorization' => 'Bearer '.config('services.screenshot.token'),
+                'Accept' => 'application/json',
+            ])->post($apiUrl.'/screenshot', [
+                'url' => $validated['submission_url'],
+                'fileName' => $imagePath,
+            ]);
 
-        $data = $response->json();
-        $imageUrl = $data['imageUrl'];
+            if ($response->failed()) {
+                abort(500, $response);
+            }
+
+            $data = $response->json();
+            $imageUrl = $data['imageUrl'];
+        }
 
         // Saves in DB
         $challengeUser->pivot->submission_url = $validated['submission_url'];
@@ -472,24 +487,28 @@ public function updateSubmission(Request $request, $slug)
             "challenge-screenshots/$slug-$challengeUser->github_id-".
             Str::random(10).
             '.webp';
-        $apiUrl = config('services.screenshot.base_url').'/screenshot';
 
-        $response = Http::withHeaders([
-            'Authorization' => 'Bearer '.config('services.screenshot.token'),
-            'Accept' => 'application/json',
-        ])->put($apiUrl, [
-            'url' => $validated['submission_url'],
-            'fileName' => $imagePath,
-            'oldFilename' => $challengeUser->pivot->submission_image_url,
-        ]);
+        $s3Location = $challengeUser->pivot->submission_image_url;
+        $apiUrl = config('services.screenshot.base_url');
+
+        if ($apiUrl) {
+            $response = Http::withHeaders([
+                'Authorization' => 'Bearer '.config('services.screenshot.token'),
+                'Accept' => 'application/json',
+            ])->put($apiUrl.'/screenshot', [
+                'url' => $validated['submission_url'],
+                'fileName' => $imagePath,
+                'oldFilename' => $challengeUser->pivot->submission_image_url,
+            ]);
 
-        if ($response->failed()) {
-            $error = $response->json();
-            abort(500, 'API request failed: '.$error['message']);
-        }
+            if ($response->failed()) {
+                $error = $response->json();
+                abort(500, 'API request failed: '.$error['message']);
+            }
 
-        $data = $response->json();
-        $s3Location = $data['imageUrl'];
+            $data = $response->json();
+            $s3Location = $data['imageUrl'];
+        }
 
         // Saves in DB
         $challengeUser->pivot->submission_url = $validated['submission_url'];

app/Http/Resources/UserResource.php

@@ -27,6 +27,7 @@ public function toArray(Request $request): array
             'created_at' => $this->created_at,
             'settings' => $this->settings,
             'avatar' => new UserAvatarResource($this),
+            'github_token' => $this->when($request->boolean('include_github_token'), $this->github_token),
         ];
     }
 }

app/Models/User.php

@@ -40,6 +40,7 @@ class User extends Authenticatable
         'remember_token',
         'discord_data',
         'github_data',
+        'github_token',
     ];
 
     protected $casts = [

database/migrations/2026_03_22_202213_add_github_token_to_users_table.php

@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->text('github_token')->nullable()->after('github_data');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn('github_token');
+        });
+    }
+};

tests/Feature/ChallengeSubmissionTest.php

@@ -232,4 +232,49 @@ public function it_returns_participant_avatars(): void
         ]);
         $this->assertEquals(5, $response->json('count'));
     }
+
+    /** @test */
+    public function it_prevents_marking_complete_without_submission(): void
+    {
+        Event::fake();
+        Mail::fake();
+
+        $user = User::factory()->create();
+        $challenge = Challenge::factory()->create(['status' => 'published']);
+        $challenge->users()->attach($user->id);
+
+        $response = $this->signIn($user)
+            ->putJson("/api/challenges/{$challenge->slug}", [
+                'completed' => true,
+            ]);
+
+        $response->assertStatus(422);
+        $response->assertJson(['error' => 'You must submit your solution before marking as complete.']);
+    }
+
+    /** @test */
+    public function it_allows_marking_complete_after_submission(): void
+    {
+        Event::fake();
+        Mail::fake();
+
+        $user = User::factory()->create();
+        $challenge = Challenge::factory()->create(['status' => 'published']);
+        $challenge->users()->attach($user->id, [
+            'submitted_at' => now(),
+            'submission_url' => 'https://example.com',
+        ]);
+
+        $response = $this->signIn($user)
+            ->putJson("/api/challenges/{$challenge->slug}", [
+                'completed' => true,
+            ]);
+
+        $response->assertOk();
+
+        $this->assertEquals(
+            1,
+            $challenge->users()->where('user_id', $user->id)->first()->pivot->completed
+        );
+    }
 }