Merge pull request #5 from ericasch6/allow-other-control

allow anyone controll room option

app/Enums/RoomStateChange.php

@@ -9,6 +9,7 @@ enum RoomStateChange: string
     case CardsRevealed = 'cards_revealed';
     case VotesReset = 'votes_reset';
     case NextRound = 'next_round';
+    case PermissionsUpdated = 'permissions_updated';
     case RoomReopened = 'room_reopened';
     case RoomClosed = 'room_closed';
     case RoomDeleted = 'room_deleted';

app/Http/Controllers/RoomPermissionController.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\UpdateRoomPermissionsRequest;
+use App\Models\Room;
+use App\Services\Rooms\RoomPermissionService;
+use Illuminate\Http\Response;
+
+class RoomPermissionController extends Controller
+{
+    public function __construct(
+        private readonly RoomPermissionService $roomPermissions,
+    ) {}
+
+    public function __invoke(UpdateRoomPermissionsRequest $request, Room $room): Response
+    {
+        $this->roomPermissions->updateParticipantControls(
+            $room,
+            (bool) $request->validated('allow_participant_controls'),
+        );
+
+        return response()->noContent();
+    }
+}

app/Http/Controllers/RoundController.php

@@ -16,7 +16,7 @@ class RoundController extends Controller
 
     public function reset(Request $request, Room $room): Response
     {
-        $this->ensureModerator($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->reset($room);
 
         return response()->noContent();
@@ -24,7 +24,7 @@ class RoundController extends Controller
 
     public function reveal(Request $request, Room $room): Response
     {
-        $this->ensureModerator($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->reveal($room);
 
         return response()->noContent();
@@ -32,20 +32,20 @@ class RoundController extends Controller
 
     public function nextRound(Request $request, Room $room): Response
     {
-        $this->ensureModerator($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->startNext($room);
 
         return response()->noContent();
     }
 
-    private function ensureModerator(Request $request, Room $room): void
+    private function ensureCanControlRound(Request $request, Room $room): void
     {
         $player = $request->attributes->get('currentPlayer');
 
         abort_unless(
             $player instanceof Player
             && $player->room_id === $room->id
-            && $player->is_moderator,
+            && ($player->is_moderator || $room->allow_participant_controls),
             403,
         );
     }

app/Http/Requests/UpdateRoomPermissionsRequest.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Models\Player;
+use App\Models\Room;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateRoomPermissionsRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        $room = $this->route('room');
+        $player = $this->attributes->get('currentPlayer');
+
+        return $room instanceof Room
+            && $player instanceof Player
+            && $player->room_id === $room->id
+            && $player->is_moderator;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'allow_participant_controls' => ['required', 'boolean:strict'],
+        ];
+    }
+}

app/Http/Resources/RoomResource.php

@@ -26,6 +26,7 @@ class RoomResource extends JsonResource
             'current_round' => $room->current_round,
             'revealed' => $room->revealed_at !== null,
             'state_version' => $room->state_version,
+            'allow_participant_controls' => $room->allow_participant_controls,
             'statistics' => $pageData->statistics,
             'deck' => (new RoomDeckResource($room->deck_config))->resolve($request),
             'players' => $room->players

app/Models/Room.php

@@ -19,6 +19,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
  * @property int $current_round
  * @property CarbonImmutable|null $revealed_at
  * @property int $state_version
+ * @property bool $allow_participant_controls
  * @property CarbonImmutable|null $last_activity_at
  * @property CarbonImmutable|null $closed_at
  * @property CarbonImmutable|null $deleted_at
@@ -35,6 +36,7 @@ class Room extends Model
         'deck_config',
         'revealed_at',
         'state_version',
+        'allow_participant_controls',
         'last_activity_at',
         'closed_at',
     ];
@@ -44,6 +46,7 @@ class Room extends Model
         return [
             'current_round' => 'integer',
             'state_version' => 'integer',
+            'allow_participant_controls' => 'boolean',
             'revealed_at' => 'immutable_datetime',
             'last_activity_at' => 'immutable_datetime',
             'closed_at' => 'immutable_datetime',
@@ -51,6 +54,10 @@ class Room extends Model
         ];
     }
 
+    protected $attributes = [
+        'allow_participant_controls' => false,
+    ];
+
     protected static function booted(): void
     {
         static::creating(function (Room $room) {

app/Services/Rooms/RoomPermissionService.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Services\Rooms;
+
+use App\Enums\RoomStateChange;
+use App\Events\RoomStateChanged;
+use App\Models\Room;
+use Illuminate\Support\Facades\DB;
+
+class RoomPermissionService
+{
+    public function __construct(
+        private readonly RoomRealtimeStateService $realtimeState,
+    ) {}
+
+    public function updateParticipantControls(Room $room, bool $allowParticipantControls): void
+    {
+        [$stateVersion, $wasChanged] = DB::transaction(function () use ($room, $allowParticipantControls): array {
+            $lockedRoom = Room::query()
+                ->lockForUpdate()
+                ->findOrFail($room->id);
+
+            if ($lockedRoom->allow_participant_controls === $allowParticipantControls) {
+                return [$lockedRoom->state_version, false];
+            }
+
+            $lockedRoom->update([
+                'allow_participant_controls' => $allowParticipantControls,
+                'last_activity_at' => now(),
+                'state_version' => $lockedRoom->state_version + 1,
+            ]);
+
+            return [$lockedRoom->state_version, true];
+        });
+
+        if (! $wasChanged) {
+            return;
+        }
+
+        RoomStateChanged::dispatch(
+            $room->id,
+            $stateVersion,
+            RoomStateChange::PermissionsUpdated,
+            $this->realtimeState->for($room),
+        );
+    }
+}

app/Services/Rooms/RoomRealtimeStateService.php

@@ -15,6 +15,7 @@ class RoomRealtimeStateService
      *     current_round: int,
      *     revealed: bool,
      *     state_version: int,
+     *     allow_participant_controls: bool,
      *     statistics: array{average: string|null, median: string|null}|null,
      *     players: array<int, array{
      *         id: int,
@@ -44,6 +45,7 @@ class RoomRealtimeStateService
             'current_round' => $room->current_round,
             'revealed' => $room->revealed_at !== null,
             'state_version' => $room->state_version,
+            'allow_participant_controls' => $room->allow_participant_controls,
             'statistics' => $this->statistics->currentRound($room),
             'players' => $room->players
                 ->map(function ($player) use ($room): array {

database/migrations/2026_08_27_133231_add_allow_participant_controls_to_rooms_table.php

@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('rooms', function (Blueprint $table) {
+            $table->boolean('allow_participant_controls')
+                ->default(false)
+                ->after('state_version');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('rooms', function (Blueprint $table) {
+            $table->dropColumn('allow_participant_controls');
+        });
+    }
+};

resources/js/components/rooms/RoomHeader.vue

@@ -1,16 +1,32 @@
 <script setup lang="ts">
-import { Link } from '@inertiajs/vue3';
+import { Link, useHttp } from '@inertiajs/vue3';
 import { Check, Copy } from '@lucide/vue';
-import { ref } from 'vue';
+import { ref, watch } from 'vue';
 
 import { Checkbox } from '@/components/ui/checkbox';
 import { favorite } from '@/routes/room';
+import { update as updatePermissions } from '@/routes/room/permissions';
 import type { RoomHeaderEmits, RoomHeaderProps } from '@/types/room';
 
 const props = defineProps<RoomHeaderProps>();
 const emit = defineEmits<RoomHeaderEmits>();
 
 const copied = ref(false);
+const allowParticipantControls = ref(props.allowParticipantControls);
+const permissionRequest = useHttp(() => updatePermissions(props.id), {
+    allow_participant_controls: props.allowParticipantControls,
+});
+
+watch(
+    () => props.allowParticipantControls,
+    (value) => {
+        allowParticipantControls.value = value;
+
+        if (!permissionRequest.processing) {
+            permissionRequest.allow_participant_controls = value;
+        }
+    },
+);
 
 async function copyInviteLink(): Promise<void> {
     const inviteUrl = new URL('/room/join', window.location.origin);
@@ -22,6 +38,24 @@ async function copyInviteLink(): Promise<void> {
         copied.value = false;
     }, 1_800);
 }
+
+function updateParticipantControls(value: boolean): void {
+    if (permissionRequest.processing) {
+        return;
+    }
+
+    const previousValue = allowParticipantControls.value;
+
+    allowParticipantControls.value = value;
+    permissionRequest.allow_participant_controls = value;
+
+    void permissionRequest.submit({
+        onError: () => {
+            allowParticipantControls.value = previousValue;
+            permissionRequest.allow_participant_controls = previousValue;
+        },
+    });
+}
 </script>
 
 <template>
@@ -67,6 +101,30 @@ async function copyInviteLink(): Promise<void> {
                 <Copy v-else class="size-5 text-slate-300" />
             </button>
 
+            <label
+                v-if="isModerator"
+                for="participant-controls"
+                class="flex cursor-pointer items-center gap-2 text-sm text-slate-300"
+            >
+                <Checkbox
+                    id="participant-controls"
+                    :model-value="allowParticipantControls"
+                    :disabled="permissionRequest.processing"
+                    @update:model-value="
+                        updateParticipantControls($event === true)
+                    "
+                />
+                <span>Alle dürfen die Runde steuern</span>
+            </label>
+
+            <p
+                v-if="permissionRequest.errors.allow_participant_controls"
+                class="max-w-xs text-right text-sm text-rose-300"
+                role="alert"
+            >
+                {{ permissionRequest.errors.allow_participant_controls }}
+            </p>
+
             <label
                 for="presenter-mode"
                 class="flex cursor-pointer items-center gap-2 text-sm text-slate-300"

resources/js/components/rooms/RoomTable.vue

@@ -120,7 +120,10 @@ const voteCount = computed(
             />
 
             <RoomModeratorControls
-                v-if="currentPlayer.is_moderator"
+                v-if="
+                    currentPlayer.is_moderator ||
+                    room.allow_participant_controls
+                "
                 :room-id="room.id"
                 :revealed="room.revealed"
                 :has-votes="voteCount > 0"

resources/js/pages/rooms/Show.vue

@@ -42,6 +42,10 @@ const {
             :join_code="realtimeRoom.join_code"
             :is_favorite="realtimeRoom.is_favorite"
             :can-favorite="canFavorite"
+            :is-moderator="realtimeCurrentPlayer.is_moderator"
+            :allow-participant-controls="
+                realtimeRoom.allow_participant_controls
+            "
             v-model:presenter-mode="presenterMode"
         />
 

resources/js/types/room.ts

@@ -44,6 +44,7 @@ export type PokerRoom = {
     current_round: number;
     revealed: boolean;
     state_version: number;
+    allow_participant_controls: boolean;
     statistics: RoomStatistics | null;
     deck: RoomDeck;
     players: RoomPlayer[];
@@ -94,6 +95,8 @@ export type RoomHeaderProps = Pick<
     'id' | 'title' | 'join_code' | 'is_favorite'
 > & {
     canFavorite: boolean;
+    isModerator: boolean;
+    allowParticipantControls: boolean;
     presenterMode: boolean;
 };
 
@@ -142,6 +145,7 @@ export type RoomStateChange =
     | 'cards_revealed'
     | 'votes_reset'
     | 'next_round'
+    | 'permissions_updated'
     | 'room_reopened'
     | 'room_closed'
     | 'room_deleted';
@@ -157,6 +161,7 @@ export type RoomRealtimeState = Pick<
     | 'current_round'
     | 'revealed'
     | 'state_version'
+    | 'allow_participant_controls'
     | 'statistics'
     | 'players'
 >;

routes/room.php

@@ -5,6 +5,7 @@ use App\Http\Controllers\RoomController;
 use App\Http\Controllers\RoomEmoteController;
 use App\Http\Controllers\RoomJoinController;
 use App\Http\Controllers\RoomLifecycleController;
+use App\Http\Controllers\RoomPermissionController;
 use App\Http\Controllers\RoomPlayerController;
 use App\Http\Controllers\RoundController;
 use App\Http\Controllers\VoteController;
@@ -42,4 +43,6 @@ Route::middleware('room.player')->group(function () {
         ->name('room.reset');
     Route::post('/rooms/{room}/next-round', [RoundController::class, 'nextRound'])
         ->name('room.next-round');
+    Route::patch('/rooms/{room}/permissions', RoomPermissionController::class)
+        ->name('room.permissions.update');
 });

tests/Feature/RoomBroadcastingTest.php

@@ -69,6 +69,12 @@ test('voting and round actions broadcast their state changes', function () {
     ]);
     $session = ["room_players.{$room->id}" => $moderator->id];
 
+    $this->withSession($session)
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertNoContent();
+
     $this->withSession($session)
         ->post(route('room.vote.store', $room), ['value' => '5'])
         ->assertNoContent();
@@ -94,6 +100,7 @@ test('voting and round actions broadcast their state changes', function () {
         RoomStateChange::CardsRevealed,
         RoomStateChange::NextRound,
         RoomStateChange::VotesReset,
+        RoomStateChange::PermissionsUpdated,
     ] as $change) {
         Event::assertDispatched(
             RoomStateChanged::class,
@@ -130,7 +137,14 @@ test('voting and round actions broadcast their state changes', function () {
         },
     );
 
-    Event::assertDispatchedTimes(RoomStateChanged::class, 5);
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        fn (RoomStateChanged $event): bool => $event->change === RoomStateChange::PermissionsUpdated
+            && $event->state !== null
+            && $event->state['allow_participant_controls'] === true,
+    );
+
+    Event::assertDispatchedTimes(RoomStateChanged::class, 6);
 });
 
 test('failed room actions do not broadcast updates', function () {

tests/Feature/RoomVotingTest.php

@@ -102,16 +102,96 @@ test('other votes stay hidden until the moderator reveals the round', function (
             ->where('room.players.1.vote', '8'));
 });
 
-test('only the moderator may reveal cards', function () {
+test('round controls remain moderator-only by default', function () {
     [$room, , $player] = createVotingRoom();
+    $session = ["room_players.{$room->id}" => $player->id];
 
-    $this->withSession(["room_players.{$room->id}" => $player->id])
+    $this->withSession($session)
         ->post(route('room.reveal', $room))
         ->assertForbidden();
 
+    $this->withSession($session)
+        ->post(route('room.next-round', $room))
+        ->assertForbidden();
+
+    $this->withSession($session)
+        ->post(route('room.reset', $room))
+        ->assertForbidden();
+
     expect($room->fresh()->revealed_at)->toBeNull();
 });
 
+test('the moderator can allow every participant to control the round', function () {
+    [$room, $moderator, $player] = createVotingRoom();
+    $room->refresh();
+    $initialStateVersion = $room->state_version;
+
+    $this->withSession(["room_players.{$room->id}" => $moderator->id])
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertNoContent();
+
+    $room->refresh();
+
+    expect($room->allow_participant_controls)->toBeTrue()
+        ->and($room->state_version)->toBe($initialStateVersion + 1);
+
+    $session = ["room_players.{$room->id}" => $player->id];
+
+    $this->withSession($session)
+        ->get(route('room.show', $room))
+        ->assertInertia(fn (Assert $page) => $page
+            ->where('room.allow_participant_controls', true));
+
+    $this->withSession($session)
+        ->post(route('room.reveal', $room))
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.next-round', $room))
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.vote.store', $room), ['value' => '5'])
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.reset', $room))
+        ->assertNoContent();
+
+    expect($room->fresh()->current_round)->toBe(2);
+
+    $this->assertDatabaseMissing('votes', [
+        'room_id' => $room->id,
+        'round' => 2,
+    ]);
+});
+
+test('participants cannot change room permissions', function () {
+    [$room, , $player] = createVotingRoom();
+
+    $this->withSession(["room_players.{$room->id}" => $player->id])
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertForbidden();
+
+    expect($room->fresh()->allow_participant_controls)->toBeFalse();
+});
+
+test('room permissions require a strict boolean value', function () {
+    [$room, $moderator] = createVotingRoom();
+
+    $this->withSession(["room_players.{$room->id}" => $moderator->id])
+        ->patchJson(route('room.permissions.update', $room), [
+            'allow_participant_controls' => 'true',
+        ])
+        ->assertJsonValidationErrors('allow_participant_controls');
+
+    expect($room->fresh()->allow_participant_controls)->toBeFalse();
+});
+
 test('starting the next round clears the revealed state', function () {
     [$room, $moderator] = createVotingRoom();