Leaderboard scores writable directly via Supabase client with no server-side validation

[anshul23102]

Bug Description

The leaderboard table accepts arbitrary score values via direct Supabase client upserts from the frontend. Any authenticated user can set their score to any integer without the server verifying the increment is legitimate.

Steps to Reproduce

1. Log in and capture the Supabase anon key and your user ID.
2. Run:

await supabase.from('leaderboard')
  .upsert({ user_id: '<your_id>', score: 999999 });

3. Observe: your score is updated to 999999 on the public leaderboard.

Root Cause

Score updates are performed client-side with no backend validation endpoint or database trigger enforcing that scores only increase by legitimate amounts.

Impact

Leaderboard manipulation; unfair competition; loss of trust in the platform.

Proposed Fix

-- Prevent direct writes; use a Supabase Function instead
REVOKE UPDATE ON leaderboard FROM anon, authenticated;

-- Server-side function that only allows increments
CREATE OR REPLACE FUNCTION increment_score(points integer)
RETURNS void LANGUAGE plpgsql SECURITY DEFINER AS $$
BEGIN
  UPDATE leaderboard SET score = score + points
  WHERE user_id = auth.uid() AND points > 0 AND points <= 100;
END;
$$;

[anshul23102]

@durdana3105 Hi! I came across this issue and I would love to work on it as part of GSSoC '26.

I have reviewed the problem description carefully and am confident I can deliver a well-tested, production-ready fix within the contribution timeline. Please let me know if you need any additional context or have specific implementation preferences before I get started.

Could you please assign this issue to me?

/assign
/claim