Remove turnstile - #157
Merged
Merged
Conversation
Fixes #154 Specifically the hardcoded maps part of it
Turnstile creates unnecessary friction for competitors. It has been shown that Turnstile can be bypassed with little effort, so it only harms the good guys. We should remove it and rely on monitoring to detect automation.
There was a problem hiding this comment.
Pull request overview
This PR removes the Turnstile requirement from the private game-match creation endpoint, and adjusts tournament series map selection to be driven by a per-competition settings.tournamentMaps configuration (with integration tests updated to provide that setting and to re-enable coverage around unique map selection).
Changes:
- Removed
@RequireTurnstilefromPOST /api/v1/game-match. - Updated tournament series map selection to read from
Competition.settings["tournamentMaps"]instead of a hard-coded list. - Updated/re-enabled tournament integration tests to set
tournamentMapsin competition settings and validate unique-map behavior.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/main/java/org/bytefight/webserver/gamematch/infra/PrivateGameMatchController.java | Removes Turnstile enforcement on private match creation endpoint. |
| src/main/java/org/bytefight/webserver/tournament/application/TournamentMatchScheduler.java | Switches series map pool source from hard-coded list to Competition.settings.tournamentMaps. |
| src/test/java/org/bytefight/webserver/tournament/TournamentServiceIntegrationTest.java | Ensures competition test fixtures include tournamentMaps in settings. |
| src/test/java/org/bytefight/webserver/tournament/TournamentResultHandlerIntegrationTest.java | Ensures competition test fixtures include tournamentMaps in settings. |
| src/test/java/org/bytefight/webserver/tournament/TournamentMatchSchedulerIntegrationTest.java | Re-enables and updates series map uniqueness test; adds tournamentMaps to fixture settings. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
43
to
46
| private final GameMatchService gameMatchService; | ||
|
|
||
| @PostMapping | ||
| @RequireTurnstile | ||
| public ResponseEntity<List<GameMatchDto>> createGameMatch( |
Comment on lines
+271
to
+284
| @SuppressWarnings("unchecked") | ||
| private List<String> getTournamentMaps(Competition competition) { | ||
| Map<String, Object> settings = competition.getSettings(); | ||
| Object value = settings == null ? null : settings.get(TOURNAMENT_MAPS_SETTING_KEY); | ||
| if (!(value instanceof List)) { | ||
| throw new IllegalStateException( | ||
| "Competition '" | ||
| + competition.getSlug() | ||
| + "' is missing the required '" | ||
| + TOURNAMENT_MAPS_SETTING_KEY | ||
| + "' setting."); | ||
| } | ||
| return (List<String>) value; | ||
| } |
Comment on lines
233
to
+237
|
|
||
| // Determine the next game number (1-based). | ||
| int nextGameNumber = existingGames.size() + 1; | ||
| Map<String, Object> matchSettings = buildSeriesMatchSettings(existingGames); | ||
| List<String> tournamentMaps = getTournamentMaps(match.getTournament().getCompetition()); | ||
| Map<String, Object> matchSettings = buildSeriesMatchSettings(existingGames, tournamentMaps); |
jaeheonshim
added a commit
that referenced
this pull request
Aug 19, 2026
* Add admin endpoints to cors allowed origins * Remove redundant is_deleted field from soft deletion entities is_deleted is redundant since an entity is soft-deleted if and only if deleted_at is not null. Updated the entity to remove this field and refactored all existing queries utilizing is_deleted to check nullity of deleted_at * fixed Tournament should be refactored to avoid hardcoding maps Fixes #154 Specifically the hardcoded maps part of it * Remove turnstile (#157) * fixed Tournament should be refactored to avoid hardcoding maps Fixes #154 Specifically the hardcoded maps part of it * Remove RequireTurnstile from createGameMatch endpoint Turnstile creates unnecessary friction for competitors. It has been shown that Turnstile can be bypassed with little effort, so it only harms the good guys. We should remove it and rely on monitoring to detect automation. --------- Co-authored-by: RoopjeetSingh <roopjeetsingh2004@gmail.com> * Add workflow_dispatch to deploy-staging.yml * Observability - local Grafana session (#155) Add prometheus and postgres_exporter, allowing us to query metrics about our Postgres database in Grafana * Fix ladder creation defaulting maxQueuedPerTeam to 0 (#168) * Fix ladder creation defaulting maxQueuedPerTeam to 0 (#159) * Drop V16 backfill migration The entity default fixes every ladder created from here on. Repairing rows already at max_queued_per_team = 0 is left to the newly-exposed admin PATCH endpoint rather than a data migration. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Add localhost:3000 to the CORS list to allow local debugging against the prod server (#178) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: RoopjeetSingh <roopjeetsingh2004@gmail.com> Co-authored-by: Anika Viswanathan <57320183+anikaviswa@users.noreply.github.com> Co-authored-by: Razam Sherwani <65174825+razam-sherwani@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
jaeheonshim
added a commit
that referenced
this pull request
Aug 20, 2026
* Add admin endpoints to cors allowed origins * Remove redundant is_deleted field from soft deletion entities is_deleted is redundant since an entity is soft-deleted if and only if deleted_at is not null. Updated the entity to remove this field and refactored all existing queries utilizing is_deleted to check nullity of deleted_at * fixed Tournament should be refactored to avoid hardcoding maps Fixes #154 Specifically the hardcoded maps part of it * Remove turnstile (#157) * fixed Tournament should be refactored to avoid hardcoding maps Fixes #154 Specifically the hardcoded maps part of it * Remove RequireTurnstile from createGameMatch endpoint Turnstile creates unnecessary friction for competitors. It has been shown that Turnstile can be bypassed with little effort, so it only harms the good guys. We should remove it and rely on monitoring to detect automation. --------- Co-authored-by: RoopjeetSingh <roopjeetsingh2004@gmail.com> * Add workflow_dispatch to deploy-staging.yml * Observability - local Grafana session (#155) Add prometheus and postgres_exporter, allowing us to query metrics about our Postgres database in Grafana * Fix ladder creation defaulting maxQueuedPerTeam to 0 (#168) * Fix ladder creation defaulting maxQueuedPerTeam to 0 (#159) * Drop V16 backfill migration The entity default fixes every ladder created from here on. Repairing rows already at max_queued_per_team = 0 is left to the newly-exposed admin PATCH endpoint rather than a data migration. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Add localhost:3000 to the CORS list to allow local debugging against the prod server (#178) * Separate engine and admin roles (#181) * Add is_service_account to users table * Allow service accounts to download any submission * Add tests to verify service account submission download * Allow service accounts to upload game match files * Update game match file upload tests --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: RoopjeetSingh <roopjeetsingh2004@gmail.com> Co-authored-by: Anika Viswanathan <57320183+anikaviswa@users.noreply.github.com> Co-authored-by: Razam Sherwani <65174825+razam-sherwani@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
jaeheonshim
added a commit
that referenced
this pull request
Aug 20, 2026
* Add admin endpoints to cors allowed origins * Remove redundant is_deleted field from soft deletion entities is_deleted is redundant since an entity is soft-deleted if and only if deleted_at is not null. Updated the entity to remove this field and refactored all existing queries utilizing is_deleted to check nullity of deleted_at * fixed Tournament should be refactored to avoid hardcoding maps Fixes #154 Specifically the hardcoded maps part of it * Remove turnstile (#157) * fixed Tournament should be refactored to avoid hardcoding maps Fixes #154 Specifically the hardcoded maps part of it * Remove RequireTurnstile from createGameMatch endpoint Turnstile creates unnecessary friction for competitors. It has been shown that Turnstile can be bypassed with little effort, so it only harms the good guys. We should remove it and rely on monitoring to detect automation. --------- Co-authored-by: RoopjeetSingh <roopjeetsingh2004@gmail.com> * Add workflow_dispatch to deploy-staging.yml * Observability - local Grafana session (#155) Add prometheus and postgres_exporter, allowing us to query metrics about our Postgres database in Grafana * Fix ladder creation defaulting maxQueuedPerTeam to 0 (#168) * Fix ladder creation defaulting maxQueuedPerTeam to 0 (#159) * Drop V16 backfill migration The entity default fixes every ladder created from here on. Repairing rows already at max_queued_per_team = 0 is left to the newly-exposed admin PATCH endpoint rather than a data migration. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Add localhost:3000 to the CORS list to allow local debugging against the prod server (#178) * Separate engine and admin roles (#181) * Add is_service_account to users table * Allow service accounts to download any submission * Add tests to verify service account submission download * Allow service accounts to upload game match files * Update game match file upload tests * Add internal field to competitions, only list internal competitions if the user is an internal user * Guard access to internal competition resources * Allow service accounts to see internal competitions as well --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: RoopjeetSingh <roopjeetsingh2004@gmail.com> Co-authored-by: Anika Viswanathan <57320183+anikaviswa@users.noreply.github.com> Co-authored-by: Razam Sherwani <65174825+razam-sherwani@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.