rate limiting and database saving works

pigeon.sh

@@ -3,9 +3,56 @@ NAMESPACE="$2"
 PROJECT="$3"
 COMMIT="$4"
 TAG="$5"
+CREATED_AT="$6"
 
 : "${PIGEON_GITLAB_TOKEN:?}"
 : "${PIGEON_PROJECTS:?}"
+: "${PIGEON_DB:?}"
+LIMIT="${PIGEON_RATE_LIMIT:-3}"   # graded attempts per student per project per hour
+
+PIGEON_DB="$(realpath -m "$PIGEON_DB")"
+db() { sqlite3 -bail -cmd '.timeout 10000' "$PIGEON_DB" "$@"; }
+# quote a value as a SQL string literal
+q() { printf "'%s'" "$(printf '%s' "$1" | sed "s/'/''/g")"; }
+
+report() {
+  curl -s --show-error --out-null --request PUT \
+    --header "PRIVATE-TOKEN: $PIGEON_GITLAB_TOKEN" \
+    --header 'Content-Type: application/json' \
+    --data "{\"description\": \"$1\"}" \
+    --url "https://gitlab.com/api/v4/projects/$ID/releases/$TAG"
+}
+
+mkdir -p "$(dirname "$PIGEON_DB")"
+db << 'EOF'
+CREATE TABLE IF NOT EXISTS results (
+    id      INTEGER PRIMARY KEY,
+    student TEXT NOT NULL,
+    project TEXT NOT NULL,
+    commit_sha  TEXT NOT NULL,
+    time    TEXT NOT NULL DEFAULT (datetime('now')),
+    score   INTEGER CHECK (score >= 0)
+);
+EOF
+
+# GitLab's "2026-10-16 02:27:46 UTC" -> SQLite's "2026-10-16 02:27:46".
+# If it's missing or unparseable, fall back to the current time.
+CREATED="$(date -u -d "$CREATED_AT" '+%Y-%m-%d %H:%M:%S' 2>/dev/null || true)"
+
+# Rate limit and record the submission in one atomic statement.
+# No row comes back if the student is over the limit.
+ROW="$(db "INSERT INTO results (student, project, commit_sha, time)
+  SELECT $(q "$NAMESPACE"), $(q "$PROJECT"), $(q "$COMMIT"),
+         COALESCE(NULLIF($(q "$CREATED"), ''), datetime('now'))
+  WHERE (SELECT COUNT(*) FROM results
+         WHERE student = $(q "$NAMESPACE") AND project = $(q "$PROJECT")
+           AND time > datetime('now', '-1 hour')) < $LIMIT
+  RETURNING id;")"
+
+if [ -z "$ROW" ]; then
+  report "Rate limit reached: at most $LIMIT submissions per hour. Try again later."
+  exit 0
+fi
 
 DIRECTORY="$(mktemp -d /tmp/pigeon.XXXXXXXXXX)"
 trap 'rm -rf "$DIRECTORY"' EXIT
@@ -42,18 +89,20 @@ EOF
 firecracker --no-api --level Error --config-file vm.json
 
 RESULT=""
+SCORE=0
 TESTS="$PIGEON_PROJECTS/$PROJECT/tests"
 for TEST in "$TESTS"/*.sh ; do
   debugfs -R "cat /$(basename "$TEST" .sh)" results.img >scratch 2>/dev/null
-  if cmp scratch "$TESTS/$(basename "$TEST" .sh).expected" ; then
+  if cmp -s scratch "$TESTS/$(basename "$TEST" .sh).expected" ; then
     RESULT="${RESULT}PASS\n"
+    SCORE=$((SCORE + 1))
   else
     RESULT="${RESULT}FAIL: $(cat "$TESTS/$(basename "$TEST" .sh).hint")\n"
   fi
 done
 
-curl -s --show-error --out-null --request PUT \
-  --header "PRIVATE-TOKEN: $PIGEON_GITLAB_TOKEN" \
-  --header 'Content-Type: application/json' \
-  --data "{\"description\": \"$RESULT\"}" \
-  --url "https://gitlab.com/api/v4/projects/$ID/releases/$TAG"
+# Record before reporting, so a GitLab outage doesn't lose the result.
+db "UPDATE results SET score = $SCORE WHERE id = $ROW;" ||
+  echo "pigeon: failed to record score for row $ROW in $PIGEON_DB" >&2
+
+report "$RESULT"