Final refactoring before v1.1.0 release.

[yulmwu]

The following refactoring and improvements have been made:

1. Fixed missing UTC normalization in the current time logic (Now()).

2. Skipped logging for endpoints that handle sensitive data, such as:

   • /api/auth/login
   • /api/auth/register
   • /api/auth/refresh
   • /api/auth/logout
   • /api/challenges/{id}/submit

3. Removed the window parameter from the Timeline API and optimized Redis cache key unification and invalidation. (Cache keys are now unified as timeline:users, timeline:teams, leaderboard:users, leaderboard:teams.)

4. Previously, if deletion of the old file failed during file upload, the database had already been updated with the new key but still returned an error. We determined that orphaned files are acceptable in this case and updated the logic as follows:

   if previousKey != nil && *previousKey != "" && s.fileStore != nil {
       if err := s.fileStore.Delete(ctx, *previousKey); err != nil {
           return nil, storage.PresignedPost{}, fmt.Errorf("ctf.RequestChallengeFileUpload delete: %w", err)
       }
       // Best-effort cleanup. Keep the new file active even if cleanup fails.
       _ = s.fileStore.Delete(ctx, *previousKey)
   }

5. Cache invalidation was missing in scenarios such as username changes, team transfers, and challenge point updates. This has now been addressed.

Additional refactoring may be added later and will be noted in the comments.

[yulmwu]

There was also a suggestion to remove fields from the stack DB schema that are updated by the Container Provisioner, such as stack status, target port, ttl, node port, and public IP. However, we decided to keep them as-is, as the trade-offs introduced by refactoring were considered greater than the potential benefits.

[codecov]

Codecov Report

❌ Patch coverage is 76.27628% with 79 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/service/user_service.go	53.93%	25 Missing and 16 partials ⚠️
internal/service/scoreboard_service.go	77.50%	9 Missing and 9 partials ⚠️
internal/http/handlers/handler.go	79.31%	4 Missing and 2 partials ⚠️
internal/http/middleware/request_logger.go	76.92%	3 Missing and 3 partials ⚠️
internal/http/router.go	0.00%	4 Missing ⚠️
internal/stack/mock.go	97.97%	1 Missing and 1 partial ⚠️
internal/logging/logging.go	50.00%	0 Missing and 1 partial ⚠️
internal/service/team_service.go	50.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[yulmwu]

Codecov Report

❌ Patch coverage is 83.33333% with 7 lines in your changes missing coverage. Please review.

Upon review, no additional tests are required.

[yulmwu]

Additionally, the Handler-Service–Repository backend pattern has been further clarified through refactoring, and parts of the test code have also been refactored.

[yulmwu]

PostgreSQL testcontainers(for Go) appear to be unstable. We will consider improving this in the future by adopting a different testing library or container library.

[Copilot]

Pull request overview

This PR implements several refactoring improvements and bug fixes in preparation for the v1.1.0 release:

Changes:

• Introduced UserService and ScoreboardService layers to separate business logic from handlers
• Unified Redis cache keys (timeline:users, timeline:teams, leaderboard:users, leaderboard:teams) and removed window parameter from Timeline API
• Added comprehensive cache invalidation for username changes, team transfers, and challenge point updates
• Implemented skip-logging for sensitive endpoints (auth endpoints and challenge submissions)
• Changed file upload cleanup to best-effort (orphaned files acceptable if cleanup fails)
• Added ProvisionerMock for stack testing to replace inline test stubs
• Added UTC normalization in logging
• Added coverage check scripts

Reviewed changes

Copilot reviewed 30 out of 30 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/coverage_check/main.py	New coverage calculation script excluding specific files
scripts/coverage_check.sh	Bash wrapper for coverage check script
internal/stack/mock.go	New ProvisionerMock implementation for easier testing
internal/stack/mock_test.go	Tests for ProvisionerMock
internal/service/user_service.go	New UserService layer for user operations
internal/service/user_service_test.go	Tests for UserService
internal/service/scoreboard_service.go	New ScoreboardService layer with timeline aggregation
internal/service/scoreboard_service_test.go	Tests for ScoreboardService
internal/service/errors.go	Added service.ErrNotFound
internal/service/ctf_service.go	Changed file cleanup to best-effort
internal/service/ctf_service_test.go	Updated test to reflect new file cleanup behavior
internal/service/team_service.go	Updated to return service.ErrNotFound instead of repo.ErrNotFound
internal/service/team_service_test.go	Updated to use service.ErrNotFound
internal/service/testenv_test.go	Added new service instances to test environment
internal/service/stack_service_test.go	Refactored to use ProvisionerMock
internal/logging/logging.go	Added UTC normalization for time.Now() calls
internal/http/router.go	Updated to use UserService and ScoreboardService
internal/http/middleware/request_logger.go	Added sensitive path skipping and UTC normalization
internal/http/middleware/request_logger_test.go	Tests for sensitive path skipping
internal/http/handlers/handler.go	Major refactoring: service delegation, cache invalidation, timeline simplification
internal/http/handlers/handler_test.go	Tests for cache invalidation behavior
internal/http/handlers/testenv_test.go	Added new service instances to test environment
internal/http/handlers/errors.go	Updated to use service.ErrNotFound
internal/http/handlers/errors_test.go	Updated error mapping test
internal/http/integration/*.go	Updated to use ProvisionerMock and new services
docs/docs/scoreboard.md	Removed window parameter documentation
cmd/server/main.go	Wired up new services

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The error section "Errors: - 400 invalid input" should be removed from the Team Timeline documentation since the window parameter was removed and there are no validation errors for this endpoint anymore.