allow anyone controll room option

app/Http/Controllers/RoomPermissionController.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\UpdateRoomPermissionsRequest;
+use App\Models\Room;
+use App\Services\Rooms\RoomPermissionService;
+use Illuminate\Http\Response;
+
+class RoomPermissionController extends Controller
+{
+    public function __construct(
+        private readonly RoomPermissionService $roomPermissions,
+    ) {}
+
+    public function __invoke(UpdateRoomPermissionsRequest $request, Room $room): Response
+    {
+        $this->roomPermissions->updateParticipantControls(
+            $room,
+            (bool) $request->validated('allow_participant_controls'),
+        );
+
+        return response()->noContent();
+    }
+}

app/Http/Controllers/RoundController.php

@@ -16,7 +16,7 @@ class RoundController extends Controller
 
     public function reset(Request $request, Room $room): Response
     {
-        $this->ensureModerator($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->reset($room);
 
         return response()->noContent();
@@ -24,7 +24,7 @@ class RoundController extends Controller
 
     public function reveal(Request $request, Room $room): Response
     {
-        $this->ensureModerator($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->reveal($room);
 
         return response()->noContent();
@@ -32,20 +32,20 @@ class RoundController extends Controller
 
     public function nextRound(Request $request, Room $room): Response
     {
-        $this->ensureModerator($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->startNext($room);
 
         return response()->noContent();
     }
 
-    private function ensureModerator(Request $request, Room $room): void
+    private function ensureCanControlRound(Request $request, Room $room): void
     {
         $player = $request->attributes->get('currentPlayer');
 
         abort_unless(
             $player instanceof Player
             && $player->room_id === $room->id
-            && $player->is_moderator,
+            && ($player->is_moderator || $room->allow_participant_controls),
             403,
         );
     }

app/Http/Requests/UpdateRoomPermissionsRequest.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Models\Player;
+use App\Models\Room;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateRoomPermissionsRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        $room = $this->route('room');
+        $player = $this->attributes->get('currentPlayer');
+
+        return $room instanceof Room
+            && $player instanceof Player
+            && $player->room_id === $room->id
+            && $player->is_moderator;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'allow_participant_controls' => ['required', 'boolean:strict'],
+        ];
+    }
+}

app/Http/Resources/RoomResource.php

@@ -26,6 +26,7 @@ class RoomResource extends JsonResource
             'current_round' => $room->current_round,
             'revealed' => $room->revealed_at !== null,
             'state_version' => $room->state_version,
+            'allow_participant_controls' => $room->allow_participant_controls,
             'statistics' => $pageData->statistics,
             'deck' => (new RoomDeckResource($room->deck_config))->resolve($request),
             'players' => $room->players