allow anyone controll room option

tests/Feature/RoomBroadcastingTest.php

@@ -69,6 +69,12 @@ test('voting and round actions broadcast their state changes', function () {
     ]);
     $session = ["room_players.{$room->id}" => $moderator->id];
 
+    $this->withSession($session)
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertNoContent();
+
     $this->withSession($session)
         ->post(route('room.vote.store', $room), ['value' => '5'])
         ->assertNoContent();
@@ -94,6 +100,7 @@ test('voting and round actions broadcast their state changes', function () {
         RoomStateChange::CardsRevealed,
         RoomStateChange::NextRound,
         RoomStateChange::VotesReset,
+        RoomStateChange::PermissionsUpdated,
     ] as $change) {
         Event::assertDispatched(
             RoomStateChanged::class,
@@ -130,7 +137,14 @@ test('voting and round actions broadcast their state changes', function () {
         },
     );
 
-    Event::assertDispatchedTimes(RoomStateChanged::class, 5);
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        fn (RoomStateChanged $event): bool => $event->change === RoomStateChange::PermissionsUpdated
+            && $event->state !== null
+            && $event->state['allow_participant_controls'] === true,
+    );
+
+    Event::assertDispatchedTimes(RoomStateChanged::class, 6);
 });
 
 test('failed room actions do not broadcast updates', function () {

tests/Feature/RoomVotingTest.php

@@ -102,16 +102,96 @@ test('other votes stay hidden until the moderator reveals the round', function (
             ->where('room.players.1.vote', '8'));
 });
 
-test('only the moderator may reveal cards', function () {
+test('round controls remain moderator-only by default', function () {
     [$room, , $player] = createVotingRoom();
+    $session = ["room_players.{$room->id}" => $player->id];
 
-    $this->withSession(["room_players.{$room->id}" => $player->id])
+    $this->withSession($session)
         ->post(route('room.reveal', $room))
         ->assertForbidden();
 
+    $this->withSession($session)
+        ->post(route('room.next-round', $room))
+        ->assertForbidden();
+
+    $this->withSession($session)
+        ->post(route('room.reset', $room))
+        ->assertForbidden();
+
     expect($room->fresh()->revealed_at)->toBeNull();
 });
 
+test('the moderator can allow every participant to control the round', function () {
+    [$room, $moderator, $player] = createVotingRoom();
+    $room->refresh();
+    $initialStateVersion = $room->state_version;
+
+    $this->withSession(["room_players.{$room->id}" => $moderator->id])
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertNoContent();
+
+    $room->refresh();
+
+    expect($room->allow_participant_controls)->toBeTrue()
+        ->and($room->state_version)->toBe($initialStateVersion + 1);
+
+    $session = ["room_players.{$room->id}" => $player->id];
+
+    $this->withSession($session)
+        ->get(route('room.show', $room))
+        ->assertInertia(fn (Assert $page) => $page
+            ->where('room.allow_participant_controls', true));
+
+    $this->withSession($session)
+        ->post(route('room.reveal', $room))
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.next-round', $room))
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.vote.store', $room), ['value' => '5'])
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.reset', $room))
+        ->assertNoContent();
+
+    expect($room->fresh()->current_round)->toBe(2);
+
+    $this->assertDatabaseMissing('votes', [
+        'room_id' => $room->id,
+        'round' => 2,
+    ]);
+});
+
+test('participants cannot change room permissions', function () {
+    [$room, , $player] = createVotingRoom();
+
+    $this->withSession(["room_players.{$room->id}" => $player->id])
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertForbidden();
+
+    expect($room->fresh()->allow_participant_controls)->toBeFalse();
+});
+
+test('room permissions require a strict boolean value', function () {
+    [$room, $moderator] = createVotingRoom();
+
+    $this->withSession(["room_players.{$room->id}" => $moderator->id])
+        ->patchJson(route('room.permissions.update', $room), [
+            'allow_participant_controls' => 'true',
+        ])
+        ->assertJsonValidationErrors('allow_participant_controls');
+
+    expect($room->fresh()->allow_participant_controls)->toBeFalse();
+});
+
 test('starting the next round clears the revealed state', function () {
     [$room, $moderator] = createVotingRoom();