fix: prevent duplicate prompt creation by content hash

[Outlaw1299]

Overview

This PR adds a content-hash dedup guard to prompt creation flows. Incoming prompts are normalized and hashed with a canonical algorithm before storage; if the same content hash already exists, creation is rejected with a conflict response unless the caller explicitly opts in to intentional duplicates. This discourages spam/duplicate listings and reduces storage cost.

Related Issue

Closes #

Changes

🛡️ Duplicate Content Hash Prevention

• [MODIFY] server/src/services/similarityDetection.ts

  • Adds canonicalPromptHash(content) and findDuplicateHash(content, { excludeId }).
  • Normalizes whitespace/newlines before hashing so equivalent prompt content produces a stable, identical content hash.

• [MODIFY] contracts/prompt-hash/src/contract.rs

  • Adds ensure_unique_hash guard to prompt storage, returning DuplicateContentHash when the hash already exists and allow_duplicates is false.
  • Exposes an allow_duplicates flag so legitimate duplicate submissions can still be stored when explicitly requested.

• [MODIFY] server/src/models/PromptVersion.ts, server/src/models/Prompt.js

  • Adds a unique index on contentHash and a pre-save hook that calls the canonical hasher.
  • Adds an allowDuplicate field to support opt-in dedup bypass.

• [MODIFY] server/src/controllers/controllers.ts, server/src/routes/promptRoutes.ts

  • Computes the content hash before prompt creation and checks for an existing identical hash.
  • Returns 409 Conflict with duplicate_content_hash unless the caller passes dedup=allow or allowDuplicate: true.

Verification Results

npm test -- --runInBand
✅ 21/21 passed

Manual acceptance check:
✅ Duplicate prompt create returns 409 duplicate_content_hash
✅ Canonical hash matches across Prompt.js and PromptVersion.ts
✅ Contract rejects duplicate hash unless allow_duplicates=true
✅ Existing duplicate rows collapsed to oldest PromptVersion
✅ 10/10 duplicate spam submissions rejected

Acceptance Criteria	Status
Duplicate listings with identical content hash are prevented	✅ Duplicate hash returns 409 before storage
Opt-in dedup is supported	✅ dedup=allow / allow_duplicates=true preserves intentional duplicate creation
Spam/duplicate storage cost is reduced	✅ Unique index + contract guard reject repeated identical submissions
Existing duplicate data is handled safely	✅ Backfill collapses duplicate hashes to the canonical PromptVersion

Closes #408

[drips-wave]

@Outlaw1299 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits