fix: add authentication to evaluation submission endpoint

Author: eureka0928

crates/platform-server/src/api/evaluations.rs

@@ -1,5 +1,6 @@
 //! Evaluations API handlers
 
+use crate::api::auth::verify_signature;
 use crate::db::queries;
 use crate::models::*;
 use crate::state::AppState;
@@ -9,12 +10,56 @@ use axum::{
     Json,
 };
 use std::sync::Arc;
-use tracing::info;
+use tracing::{info, warn};
 
 pub async fn submit_evaluation(
     State(state): State<Arc<AppState>>,
     Json(req): Json<SubmitEvaluationRequest>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, Json<serde_json::Value>)> {
+    // Verify signature - message format: "evaluation:{validator_hotkey}:{submission_id}:{agent_hash}"
+    let message = format!(
+        "evaluation:{}:{}:{}",
+        req.validator_hotkey, req.submission_id, req.agent_hash
+    );
+
+    if !verify_signature(&req.validator_hotkey, &message, &req.signature) {
+        warn!(
+            "Invalid signature for evaluation submission from {}",
+            &req.validator_hotkey[..16.min(req.validator_hotkey.len())]
+        );
+        return Err((
+            StatusCode::UNAUTHORIZED,
+            Json(serde_json::json!({
+                "success": false,
+                "error": "Invalid signature"
+            })),
+        ));
+    }
+
+    // Verify validator is registered
+    let validator = queries::get_validator(&state.db, &req.validator_hotkey)
+        .await
+        .map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                Json(serde_json::json!({ "success": false, "error": e.to_string() })),
+            )
+        })?;
+
+    if validator.is_none() {
+        warn!(
+            "Evaluation submission from unregistered validator: {}",
+            &req.validator_hotkey[..16.min(req.validator_hotkey.len())]
+        );
+        return Err((
+            StatusCode::UNAUTHORIZED,
+            Json(serde_json::json!({
+                "success": false,
+                "error": "Not a registered validator"
+            })),
+        ));
+    }
+
     let evaluation = queries::create_evaluation(&state.db, &req)
         .await
         .map_err(|e| {