Handle authenticated room instance takeover

app/Http/Middleware/EnsureRoomParticipant.php

@@ -3,6 +3,8 @@
 namespace App\Http\Middleware;
 
 use App\Models\Room;
+use App\Services\Rooms\RoomParticipationService;
+use App\Services\Rooms\RoomPlayerInstanceService;
 use Closure;
 use Illuminate\Http\Request;
 use Inertia\Inertia;
@@ -10,6 +12,11 @@ use Symfony\Component\HttpFoundation\Response;
 
 class EnsureRoomParticipant
 {
+    public function __construct(
+        private readonly RoomParticipationService $roomParticipation,
+        private readonly RoomPlayerInstanceService $playerInstances,
+    ) {}
+
     /**
      * Handle an incoming request.
      *
@@ -44,13 +51,43 @@ class EnsureRoomParticipant
         }
 
         $playerId = $request->session()->get($sessionKey);
+        $hasSessionPlayer = is_numeric($playerId);
+        $instanceId = $this->playerInstances->for($request);
 
-        $player = is_numeric($playerId)
+        $player = $hasSessionPlayer
             ? $room->players()->find((int) $playerId)
             : null;
 
-        if ($player === null && $playerId) {
+        if ($player === null && $hasSessionPlayer) {
             $request->session()->forget($sessionKey);
+
+            return to_route('room.join', [
+                'join_code' => $room->join_code,
+            ])->withErrors([
+                'join_code' => 'Diese Spieler-Instanz ist nicht mehr aktiv.',
+            ]);
+        }
+
+        if (
+            $player !== null
+            && $player->active_instance_id !== null
+            && $player->active_instance_id !== $instanceId
+        ) {
+            $request->session()->forget($sessionKey);
+
+            return to_route('room.join', [
+                'join_code' => $room->join_code,
+            ])->withErrors([
+                'join_code' => 'Dein Account ist diesem Raum in einer anderen Instanz beigetreten.',
+            ]);
+        }
+
+        if ($player !== null) {
+            $player = $this->roomParticipation->activateInstance(
+                $room,
+                $player,
+                $instanceId,
+            );
         }
 
         if ($player === null && $request->user() !== null) {
@@ -59,6 +96,11 @@ class EnsureRoomParticipant
                 ->first();
 
             if ($player !== null) {
+                $player = $this->roomParticipation->activateInstance(
+                    $room,
+                    $player,
+                    $instanceId,
+                );
                 $request->session()->put($sessionKey, $player->id);
             }
         }