fix: phase 2 hardening - added meta collection to store last updated …

[Devx2107]

fix: hardening — cron health visibility, admin rate limiting, CodeChef fallback

What

Three reliability improvements: surface cron health on /api/health, rate-limit the admin update endpoint, and stop zeroing out CodeChef stats on a transient scrape failure.

Why

This project runs on a single self-hosted machine. There's currently no way to tell if the daily cron actually ran, the admin update endpoint can be spammed with no limit, and a temporary CodeChef scrape failure wipes a student's stats to zero instead of just keeping the last known good data.

Changes

New file — backend/models/Meta.js

Minimal key-value collection (key, value, updatedAt) for system metadata that doesn't belong on the Student or Snapshot schemas. Used here for lastCronRun, but generic enough to reuse later.

backend/cron/updateData.js

• On successful completion of updateAllStudents(), upserts { key: 'lastCronRun', value: new Date() } into the Meta collection
• For CodeChef specifically: when fetchStats returns null (non-404 failure, i.e. likely a transient scrape break), the existing stats are now preserved instead of being left at their schema default. A new codechef.lastFetchFailed boolean is set to true so the failure is visible without losing data. On a successful fetch, the flag is reset to false.

backend/platforms/codechef.js

No functional change — fetchStats already correctly returns null on failure. The handling of that null moved to the cron layer since that's where the existing stats live.

backend/models/Student.js

• Added codechef.lastFetchFailed: { type: Boolean, default: false }

backend/app.js

• GET /api/health now also returns lastCronRun (read from the Meta collection) alongside the existing status and timestamp

New file — backend/middlewares/adminLimiter.js

Strict rate limiter using express-rate-limit (already a dependency): 3 requests per 15 minutes, scoped only to /api/admin. Kept separate from any general API rate limiting so student-facing routes are unaffected.

backend/routes/admin.js

• Applied adminLimiter to the /update route

Testing

• Ran the cron manually via node backend/scripts/runUpdate.js — confirmed Meta collection gets a lastCronRun entry and /api/health reflects it
• Simulated a CodeChef scrape failure (temporarily pointed the request at a bad URL) — confirmed existing stats persist and lastFetchFailed flips to true; reverted and confirmed a successful run resets it to false
• Hit /api/admin/update 4 times within 15 minutes — 4th request correctly returns 429

Notes

• lastCronRun is intentionally minimal — no per-platform breakdown in this PR, just a single "did the cron run today" signal. Frontend can build a "last updated" badge off this without further backend work.
• lastFetchFailed is added only for CodeChef in this PR since it's the only scraped (vs. API-based) platform and therefore the most failure-prone. Can be extended to other platforms in a follow-up if needed.
• No changes to LeetCode, Codeforces, or GitHub fetch logic — scope kept to the three items above.

[vercel]

@Devx2107 is attempting to deploy a commit to the my-projects Team on Vercel.

A member of the Team first needs to authorize it.