feat: reward store redemptions have no server-side validation — members can redeem rewards with insufficient points via direct POST requests, bypassing the client-side balance check

[divyanshim27]

Summary

The Gamify reward store allows members to redeem points for real or
virtual rewards. The frontend displays available balance and disables
the redeem button when points are insufficient. However, this is
purely client-side enforcement.

The backend route POST /api/rewards/redeem (in server/routes/) does
not verify that user.points >= reward.cost before processing the
redemption. A member with 50 points can redeem a 500-point reward by
sending a raw HTTP request directly to the API.

Reproduction

# Member with 50 points redeems a 500-point reward by bypassing the UI:
curl -X POST http://localhost:5000/api/rewards/redeem \
  -H "Authorization: Bearer <valid_jwt>" \
  -H "Content-Type: application/json" \
  -d '{"rewardId": "<500-point-reward-id>"}'

# Result: Redemption succeeds. User balance goes negative.
# MongoDB User document: { points: -450 }

This is a critical integrity flaw in a gamification platform —
the entire value proposition depends on points being a scarce,
verifiable resource.

Proposed Fix

Add balance validation in server/controllers/rewardController.js:

// rewardController.js — redeem handler
export const redeemReward = async (req, res) => {
  const { rewardId } = req.body;
  const userId = req.user.id; // from authMiddleware

  const [user, reward] = await Promise.all([
    User.findById(userId),
    Reward.findById(rewardId),
  ]);

  if (!reward) {
    return res.status(404).json({ success: false, message: 'Reward not found' });
  }

  // ✅ Server-side balance check — cannot be bypassed by client
  if (user.points < reward.cost) {
    return res.status(400).json({
      success: false,
      message: `Insufficient points. Required: ${reward.cost}, Available: ${user.points}`,
    });
  }

  // Atomic deduction — prevents race condition on concurrent redemptions
  const updatedUser = await User.findOneAndUpdate(
    { _id: userId, points: { $gte: reward.cost } }, // atomic check
    { $inc: { points: -reward.cost } },
    { new: true }
  );

  if (!updatedUser) {
    return res.status(400).json({
      success: false,
      message: 'Redemption failed — concurrent balance change detected',
    });
  }

  // Record redemption...
};

Note: The $gte condition in findOneAndUpdate makes the balance check
atomic — preventing a race condition where two simultaneous redemptions
both pass the check before either deducts points.

Acceptance Criteria

• rewardController.js validates user.points >= reward.cost
  server-side before any redemption
• Atomic findOneAndUpdate with $gte guard prevents race conditions
• API returns structured error with required and available fields
• Unit test: attempt redemption with insufficient points → 400 response

Labels: bug, security, backend, level: intermediate

[github-actions]

Thank you for raising this issue!

We'll review it as soon as possible. We truly appreciate your contributions! ✨

Meanwhile make sure you've visited the README.md, CONTRIBUTING.md, and CODE_OF_CONDUCT.md before creating a PR for this. Also, please do NOT create a PR until this issue has been assigned to you. 😊

[divyanshim27]

Hey @DeadIndian ,
I have deeply gone through the project repo and understood and analysed the project through local running & testing , based on which I found this as major lagging/point of enhancement .
Based on my skill-set and problem understanding , I would want to work on the issue and contribute to the repo.
Please assign it to me.

[Keshavsspppp]

Hi @DeadIndian,could you assign this issue to me?