[BUG]: Directly posting to API creates unvalid races

Description

I've encountered a bug in the web application that you can create new finished races to show up in dashboard with same snippet id by posting to 'https://code-racer-eight.vercel.app/race/practice' directly. This allows users to create multiple races by using the same snippet id.

Also system only checks if the cpm is less than or equal 10k and accuracy is less than or equal to 100. Other than that there is no validation to check the cpm and accuracy of races that have been posted. Any post using same headers allows users to create races with fake results. Steps i followed to be able to post any cpm and accuracy ratings:

1. Copy the valid request from the network panel of devtools by playing a random race.
2. Find the snippet id by refreshing the page after the snippet is loaded. (It is in the last script tag which contains self.__next_f)
3. Send request after changing the snippetId value to the new snippet id.

(optional) What browsers are you seeing the problem on?

No response

Code of Conduct

• I agree to follow this project's Code of Conduct