Merge pull request #5 from ericasch6/allow-other-control

allow anyone controll room option

.ai/rules/index.md

@@ -0,0 +1,7 @@
+# Project Rules Index
+
+Before planning or editing, find the row whose globs match the file's path and read that rule file.
+
+| Applies to | Rule file |
+| --- | --- |
+| {app/Events/**,app/Services/Rooms/**,resources/js/composables/**} | .ai/rules/js-composables.md |

.ai/rules/js-composables.md

@@ -0,0 +1,9 @@
+---
+paths:
+  - '{app/Events/**,app/Services/Rooms/**,resources/js/composables/**}'
+---
+
+# Js Composables
+
+## Never broadcast hidden room votes
+Room table updates are delivered as synchronous WebSocket state payloads without polling or Inertia reloads. Before a round is revealed, broadcast only has_voted and keep every player's vote null; actual vote values may enter the shared payload only after reveal. State-changing commands remain server-authorized HTTP requests.

.env.example

@@ -66,6 +66,7 @@ AWS_BUCKET=
 AWS_USE_PATH_STYLE_ENDPOINT=false
 
 VITE_APP_NAME="${APP_NAME}"
+VITE_APP_VERSION=local
 
 REVERB_APP_ID=local
 REVERB_APP_KEY=local-key

.github/workflows/ci_cd.yml

@@ -49,6 +49,7 @@ jobs:
               printf -v run_attempt '%03d' "${GITHUB_RUN_ATTEMPT}"
               tag="main-${GITHUB_RUN_NUMBER}-${run_attempt}-${GITHUB_SHA:0:12}"
               environment="staging"
+              vite_app_version="staging-${GITHUB_SHA:0:12}"
               vite_reverb_app_key="1af96b48d2ef78983e4ef281eed3a48b"
               vite_reverb_host="scrum-poker.twyco-staging.de"
               ;;
@@ -68,6 +69,7 @@ jobs:
               fi
 
               environment="production"
+              vite_app_version="${tag}"
               vite_reverb_app_key="cfd9d925ff339374c04997beb90fbc32"
               vite_reverb_host="scrum-poker.petsch-studios.de"
               ;;
@@ -81,6 +83,7 @@ jobs:
             echo "image=${image}"
             echo "tag=${tag}"
             echo "environment=${environment}"
+            echo "vite_app_version=${vite_app_version}"
             echo "vite_reverb_app_key=${vite_reverb_app_key}"
             echo "vite_reverb_host=${vite_reverb_host}"
           } >> "${GITHUB_OUTPUT}"
@@ -110,6 +113,7 @@ jobs:
           IMAGE: ${{ steps.image.outputs.image }}
           IMAGE_TAG: ${{ steps.image.outputs.tag }}
           DEPLOYMENT_ENVIRONMENT: ${{ steps.image.outputs.environment }}
+          VITE_APP_VERSION: ${{ steps.image.outputs.vite_app_version }}
           VITE_REVERB_APP_KEY: ${{ steps.image.outputs.vite_reverb_app_key }}
           VITE_REVERB_HOST: ${{ steps.image.outputs.vite_reverb_host }}
           VITE_REVERB_PORT: "443"
@@ -126,6 +130,7 @@ jobs:
           docker buildx build \
             --file Dockerfile \
             --target runtime \
+            --build-arg "VITE_APP_VERSION=${VITE_APP_VERSION}" \
             --build-arg "VITE_REVERB_APP_KEY=${VITE_REVERB_APP_KEY}" \
             --build-arg "VITE_REVERB_HOST=${VITE_REVERB_HOST}" \
             --build-arg "VITE_REVERB_PORT=${VITE_REVERB_PORT}" \

Dockerfile

@@ -51,12 +51,14 @@ WORKDIR /var/www
 
 FROM php_base AS build
 
+ARG VITE_APP_VERSION=local
 ARG VITE_REVERB_APP_KEY
 ARG VITE_REVERB_HOST
 ARG VITE_REVERB_PORT
 ARG VITE_REVERB_SCHEME
 
-ENV VITE_REVERB_APP_KEY=${VITE_REVERB_APP_KEY} \
+ENV VITE_APP_VERSION=${VITE_APP_VERSION} \
+    VITE_REVERB_APP_KEY=${VITE_REVERB_APP_KEY} \
     VITE_REVERB_HOST=${VITE_REVERB_HOST} \
     VITE_REVERB_PORT=${VITE_REVERB_PORT} \
     VITE_REVERB_SCHEME=${VITE_REVERB_SCHEME}

app/Enums/RoomStateChange.php

@@ -9,6 +9,7 @@ enum RoomStateChange: string
     case CardsRevealed = 'cards_revealed';
     case VotesReset = 'votes_reset';
     case NextRound = 'next_round';
+    case PermissionsUpdated = 'permissions_updated';
     case RoomReopened = 'room_reopened';
     case RoomClosed = 'room_closed';
     case RoomDeleted = 'room_deleted';

app/Events/RoomStateChanged.php

@@ -5,18 +5,22 @@ namespace App\Events;
 use App\Enums\RoomStateChange;
 use Illuminate\Broadcasting\Channel;
 use Illuminate\Broadcasting\InteractsWithSockets;
-use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
 use Illuminate\Foundation\Events\Dispatchable;
 use Illuminate\Queue\SerializesModels;
 
-class RoomStateChanged implements ShouldBroadcast
+class RoomStateChanged implements ShouldBroadcastNow
 {
     use Dispatchable, InteractsWithSockets, SerializesModels;
 
+    /**
+     * @param  array<string, mixed>|null  $state
+     */
     public function __construct(
         public readonly string $roomId,
         public readonly int $version,
         public readonly RoomStateChange $change,
+        public readonly ?array $state = null,
     ) {}
 
     public function broadcastOn(): Channel
@@ -30,13 +34,14 @@ class RoomStateChanged implements ShouldBroadcast
     }
 
     /**
-     * @return array{version: int, change: string}
+     * @return array{version: int, change: string, state: array<string, mixed>|null}
      */
     public function broadcastWith(): array
     {
         return [
             'version' => $this->version,
             'change' => $this->change->value,
+            'state' => $this->state,
         ];
     }
 }

app/Http/Controllers/RoomPermissionController.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\UpdateRoomPermissionsRequest;
+use App\Models\Room;
+use App\Services\Rooms\RoomPermissionService;
+use Illuminate\Http\Response;
+
+class RoomPermissionController extends Controller
+{
+    public function __construct(
+        private readonly RoomPermissionService $roomPermissions,
+    ) {}
+
+    public function __invoke(UpdateRoomPermissionsRequest $request, Room $room): Response
+    {
+        $this->roomPermissions->updateParticipantControls(
+            $room,
+            (bool) $request->validated('allow_participant_controls'),
+        );
+
+        return response()->noContent();
+    }
+}

app/Http/Controllers/RoundController.php

@@ -5,8 +5,8 @@ namespace App\Http\Controllers;
 use App\Models\Player;
 use App\Models\Room;
 use App\Services\Rooms\RoundService;
-use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class RoundController extends Controller
 {
@@ -14,38 +14,38 @@ class RoundController extends Controller
         private readonly RoundService $rounds,
     ) {}
 
-    public function reset(Request $request, Room $room): RedirectResponse
+    public function reset(Request $request, Room $room): Response
     {
-        $this->ensureModerator($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->reset($room);
 
-        return back();
+        return response()->noContent();
     }
 
-    public function reveal(Request $request, Room $room): RedirectResponse
+    public function reveal(Request $request, Room $room): Response
     {
-        $this->ensureModerator($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->reveal($room);
 
-        return back();
+        return response()->noContent();
     }
 
-    public function nextRound(Request $request, Room $room): RedirectResponse
+    public function nextRound(Request $request, Room $room): Response
     {
-        $this->ensureModerator($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->startNext($room);
 
-        return back();
+        return response()->noContent();
     }
 
-    private function ensureModerator(Request $request, Room $room): void
+    private function ensureCanControlRound(Request $request, Room $room): void
     {
         $player = $request->attributes->get('currentPlayer');
 
         abort_unless(
             $player instanceof Player
             && $player->room_id === $room->id
-            && $player->is_moderator,
+            && ($player->is_moderator || $room->allow_participant_controls),
             403,
         );
     }

app/Http/Controllers/VoteController.php

@@ -6,7 +6,7 @@ use App\Http\Requests\SubmitVoteRequest;
 use App\Models\Player;
 use App\Models\Room;
 use App\Services\Rooms\VoteService;
-use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Response;
 
 class VoteController extends Controller
 {
@@ -17,7 +17,7 @@ class VoteController extends Controller
     public function store(
         SubmitVoteRequest $request,
         Room $room,
-    ): RedirectResponse {
+    ): Response {
         $player = $request->attributes->get('currentPlayer');
 
         abort_unless(
@@ -32,6 +32,6 @@ class VoteController extends Controller
             $request->validated('value'),
         );
 
-        return back();
+        return response()->noContent();
     }
 }

app/Http/Requests/UpdateRoomPermissionsRequest.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Models\Player;
+use App\Models\Room;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateRoomPermissionsRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        $room = $this->route('room');
+        $player = $this->attributes->get('currentPlayer');
+
+        return $room instanceof Room
+            && $player instanceof Player
+            && $player->room_id === $room->id
+            && $player->is_moderator;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'allow_participant_controls' => ['required', 'boolean:strict'],
+        ];
+    }
+}

app/Http/Resources/RoomResource.php

@@ -26,6 +26,7 @@ class RoomResource extends JsonResource
             'current_round' => $room->current_round,
             'revealed' => $room->revealed_at !== null,
             'state_version' => $room->state_version,
+            'allow_participant_controls' => $room->allow_participant_controls,
             'statistics' => $pageData->statistics,
             'deck' => (new RoomDeckResource($room->deck_config))->resolve($request),
             'players' => $room->players

app/Models/Room.php

@@ -19,6 +19,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
  * @property int $current_round
  * @property CarbonImmutable|null $revealed_at
  * @property int $state_version
+ * @property bool $allow_participant_controls
  * @property CarbonImmutable|null $last_activity_at
  * @property CarbonImmutable|null $closed_at
  * @property CarbonImmutable|null $deleted_at
@@ -35,6 +36,7 @@ class Room extends Model
         'deck_config',
         'revealed_at',
         'state_version',
+        'allow_participant_controls',
         'last_activity_at',
         'closed_at',
     ];
@@ -44,6 +46,7 @@ class Room extends Model
         return [
             'current_round' => 'integer',
             'state_version' => 'integer',
+            'allow_participant_controls' => 'boolean',
             'revealed_at' => 'immutable_datetime',
             'last_activity_at' => 'immutable_datetime',
             'closed_at' => 'immutable_datetime',
@@ -51,6 +54,10 @@ class Room extends Model
         ];
     }
 
+    protected $attributes = [
+        'allow_participant_controls' => false,
+    ];
+
     protected static function booted(): void
     {
         static::creating(function (Room $room) {

app/Services/Rooms/RoomLifecycleService.php

@@ -11,6 +11,10 @@ use Illuminate\Support\Facades\DB;
 
 class RoomLifecycleService
 {
+    public function __construct(
+        private readonly RoomRealtimeStateService $realtimeState,
+    ) {}
+
     /**
      * @return array{player: Player, was_reopened: bool}
      */
@@ -49,6 +53,7 @@ class RoomLifecycleService
                 $room->id,
                 $stateVersion,
                 RoomStateChange::RoomReopened,
+                $this->realtimeState->for($room),
             );
         }
 

app/Services/Rooms/RoomParticipationService.php

@@ -12,6 +12,10 @@ use Illuminate\Validation\ValidationException;
 
 class RoomParticipationService
 {
+    public function __construct(
+        private readonly RoomRealtimeStateService $realtimeState,
+    ) {}
+
     public function findByJoinCode(string $joinCode): ?Room
     {
         if ($joinCode === '') {
@@ -92,6 +96,7 @@ class RoomParticipationService
             $room->id,
             $room->state_version,
             RoomStateChange::PlayerJoined,
+            $this->realtimeState->for($room),
         );
 
         return [$room, $player];

app/Services/Rooms/RoomPermissionService.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Services\Rooms;
+
+use App\Enums\RoomStateChange;
+use App\Events\RoomStateChanged;
+use App\Models\Room;
+use Illuminate\Support\Facades\DB;
+
+class RoomPermissionService
+{
+    public function __construct(
+        private readonly RoomRealtimeStateService $realtimeState,
+    ) {}
+
+    public function updateParticipantControls(Room $room, bool $allowParticipantControls): void
+    {
+        [$stateVersion, $wasChanged] = DB::transaction(function () use ($room, $allowParticipantControls): array {
+            $lockedRoom = Room::query()
+                ->lockForUpdate()
+                ->findOrFail($room->id);
+
+            if ($lockedRoom->allow_participant_controls === $allowParticipantControls) {
+                return [$lockedRoom->state_version, false];
+            }
+
+            $lockedRoom->update([
+                'allow_participant_controls' => $allowParticipantControls,
+                'last_activity_at' => now(),
+                'state_version' => $lockedRoom->state_version + 1,
+            ]);
+
+            return [$lockedRoom->state_version, true];
+        });
+
+        if (! $wasChanged) {
+            return;
+        }
+
+        RoomStateChanged::dispatch(
+            $room->id,
+            $stateVersion,
+            RoomStateChange::PermissionsUpdated,
+            $this->realtimeState->for($room),
+        );
+    }
+}

app/Services/Rooms/RoomRealtimeStateService.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Services\Rooms;
+
+use App\Models\Room;
+
+class RoomRealtimeStateService
+{
+    public function __construct(
+        private readonly RoomStatisticsService $statistics,
+    ) {}
+
+    /**
+     * @return array{
+     *     current_round: int,
+     *     revealed: bool,
+     *     state_version: int,
+     *     allow_participant_controls: bool,
+     *     statistics: array{average: string|null, median: string|null}|null,
+     *     players: array<int, array{
+     *         id: int,
+     *         name: string,
+     *         is_moderator: bool,
+     *         is_owner: bool,
+     *         has_voted: bool,
+     *         vote: string|null
+     *     }>
+     * }
+     */
+    public function for(Room $room): array
+    {
+        $room->refresh();
+        $room->load([
+            'players' => fn ($query) => $query
+                ->active()
+                ->select(['id', 'room_id', 'user_id', 'name', 'is_moderator', 'created_at'])
+                ->orderByDesc('is_moderator')
+                ->orderBy('created_at'),
+            'players.votes' => fn ($query) => $query
+                ->where('room_id', $room->id)
+                ->where('round', $room->current_round),
+        ]);
+
+        return [
+            'current_round' => $room->current_round,
+            'revealed' => $room->revealed_at !== null,
+            'state_version' => $room->state_version,
+            'allow_participant_controls' => $room->allow_participant_controls,
+            'statistics' => $this->statistics->currentRound($room),
+            'players' => $room->players
+                ->map(function ($player) use ($room): array {
+                    $vote = $player->votes->first();
+
+                    return [
+                        'id' => $player->id,
+                        'name' => $player->name,
+                        'is_moderator' => $player->is_moderator,
+                        'is_owner' => $player->user_id === $room->owner_id,
+                        'has_voted' => $vote !== null,
+                        'vote' => $room->revealed_at !== null ? $vote?->value : null,
+                    ];
+                })
+                ->all(),
+        ];
+    }
+}

app/Services/Rooms/RoundService.php

@@ -11,6 +11,10 @@ use Illuminate\Validation\ValidationException;
 
 class RoundService
 {
+    public function __construct(
+        private readonly RoomRealtimeStateService $realtimeState,
+    ) {}
+
     public function reset(Room $room): void
     {
         $stateVersion = DB::transaction(function () use ($room): int {
@@ -38,6 +42,7 @@ class RoundService
             $room->id,
             $stateVersion,
             RoomStateChange::VotesReset,
+            $this->realtimeState->for($room),
         );
     }
 
@@ -69,6 +74,7 @@ class RoundService
             $room->id,
             $stateVersion,
             RoomStateChange::CardsRevealed,
+            $this->realtimeState->for($room),
         );
     }
 
@@ -101,6 +107,7 @@ class RoundService
             $room->id,
             $stateVersion,
             RoomStateChange::NextRound,
+            $this->realtimeState->for($room),
         );
     }
 

app/Services/Rooms/VoteService.php

@@ -12,6 +12,10 @@ use Illuminate\Validation\ValidationException;
 
 class VoteService
 {
+    public function __construct(
+        private readonly RoomRealtimeStateService $realtimeState,
+    ) {}
+
     public function submit(Room $room, Player $player, string $value): void
     {
         $stateVersion = DB::transaction(function () use ($room, $player, $value): int {
@@ -52,6 +56,7 @@ class VoteService
             $room->id,
             $stateVersion,
             RoomStateChange::VoteChanged,
+            $this->realtimeState->for($room),
         );
     }
 }

database/migrations/2026_08_27_133231_add_allow_participant_controls_to_rooms_table.php

@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('rooms', function (Blueprint $table) {
+            $table->boolean('allow_participant_controls')
+                ->default(false)
+                ->after('state_version');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('rooms', function (Blueprint $table) {
+            $table->dropColumn('allow_participant_controls');
+        });
+    }
+};

resources/js/components/AppVersion.vue

@@ -0,0 +1,12 @@
+<script setup lang="ts">
+const appVersion = import.meta.env.VITE_APP_VERSION?.trim() || 'local';
+</script>
+
+<template>
+    <span
+        class="pointer-events-none fixed bottom-2 left-2 z-50 font-mono text-[10px] text-slate-400/70 select-none"
+        :aria-label="`Version ${appVersion}`"
+    >
+        {{ appVersion }}
+    </span>
+</template>

resources/js/components/rooms/RoomHeader.vue

@@ -1,14 +1,32 @@
 <script setup lang="ts">
-import { Link } from '@inertiajs/vue3';
+import { Link, useHttp } from '@inertiajs/vue3';
 import { Check, Copy } from '@lucide/vue';
-import { ref } from 'vue';
+import { ref, watch } from 'vue';
 
+import { Checkbox } from '@/components/ui/checkbox';
 import { favorite } from '@/routes/room';
-import type { RoomHeaderProps } from '@/types/room';
+import { update as updatePermissions } from '@/routes/room/permissions';
+import type { RoomHeaderEmits, RoomHeaderProps } from '@/types/room';
 
 const props = defineProps<RoomHeaderProps>();
+const emit = defineEmits<RoomHeaderEmits>();
 
 const copied = ref(false);
+const allowParticipantControls = ref(props.allowParticipantControls);
+const permissionRequest = useHttp(() => updatePermissions(props.id), {
+    allow_participant_controls: props.allowParticipantControls,
+});
+
+watch(
+    () => props.allowParticipantControls,
+    (value) => {
+        allowParticipantControls.value = value;
+
+        if (!permissionRequest.processing) {
+            permissionRequest.allow_participant_controls = value;
+        }
+    },
+);
 
 async function copyInviteLink(): Promise<void> {
     const inviteUrl = new URL('/room/join', window.location.origin);
@@ -20,11 +38,29 @@ async function copyInviteLink(): Promise<void> {
         copied.value = false;
     }, 1_800);
 }
+
+function updateParticipantControls(value: boolean): void {
+    if (permissionRequest.processing) {
+        return;
+    }
+
+    const previousValue = allowParticipantControls.value;
+
+    allowParticipantControls.value = value;
+    permissionRequest.allow_participant_controls = value;
+
+    void permissionRequest.submit({
+        onError: () => {
+            allowParticipantControls.value = previousValue;
+            permissionRequest.allow_participant_controls = previousValue;
+        },
+    });
+}
 </script>
 
 <template>
     <header
-        class="mx-auto flex max-w-6xl flex-col gap-4 sm:flex-row sm:items-center sm:justify-between"
+        class="mx-auto flex w-full max-w-6xl flex-col gap-4 sm:flex-row sm:items-center sm:justify-between"
     >
         <div>
             <h1 class="text-2xl font-bold sm:text-3xl">
@@ -45,21 +81,63 @@ async function copyInviteLink(): Promise<void> {
             </Link>
         </div>
 
-        <button
+        <div class="flex flex-col items-end gap-2">
-            type="button"
+            <button
-            class="flex w-fit items-center gap-3 rounded-xl border border-slate-700 bg-slate-800 px-4 py-2.5 text-left transition hover:bg-slate-700"
+                type="button"
-            @click="copyInviteLink"
+                class="flex w-fit items-center gap-3 rounded-xl border border-slate-700 bg-slate-800 px-4 py-2.5 text-left transition hover:bg-slate-700 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-cyan-300"
-        >
+                @click="copyInviteLink"
-            <span>
+            >
-                <span class="block text-sm tracking-[0.18em] text-slate-400">
+                <span>
-                    Raumcode
+                    <span
+                        class="block text-sm tracking-[0.18em] text-slate-400"
+                    >
+                        Raumcode
+                    </span>
+                    <strong class="font-mono text-lg tracking-[0.2em]">
+                        {{ join_code }}
+                    </strong>
                 </span>
-                <strong class="font-mono text-lg tracking-[0.2em]">
+                <Check v-if="copied" class="size-5 text-emerald-300" />
-                    {{ join_code }}
+                <Copy v-else class="size-5 text-slate-300" />
-                </strong>
+            </button>
-            </span>
+
-            <Check v-if="copied" class="size-5 text-emerald-300" />
+            <label
-            <Copy v-else class="size-5 text-slate-300" />
+                v-if="isModerator"
-        </button>
+                for="participant-controls"
+                class="flex cursor-pointer items-center gap-2 text-sm text-slate-300"
+            >
+                <Checkbox
+                    id="participant-controls"
+                    :model-value="allowParticipantControls"
+                    :disabled="permissionRequest.processing"
+                    @update:model-value="
+                        updateParticipantControls($event === true)
+                    "
+                />
+                <span>Alle dürfen die Runde steuern</span>
+            </label>
+
+            <p
+                v-if="permissionRequest.errors.allow_participant_controls"
+                class="max-w-xs text-right text-sm text-rose-300"
+                role="alert"
+            >
+                {{ permissionRequest.errors.allow_participant_controls }}
+            </p>
+
+            <label
+                for="presenter-mode"
+                class="flex cursor-pointer items-center gap-2 text-sm text-slate-300"
+            >
+                <Checkbox
+                    id="presenter-mode"
+                    :model-value="presenterMode"
+                    @update:model-value="
+                        emit('update:presenterMode', $event === true)
+                    "
+                />
+                <span>Präsentatormodus</span>
+            </label>
+        </div>
     </header>
 </template>

resources/js/components/rooms/RoomModeratorControls.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { useForm } from '@inertiajs/vue3';
+import { useHttp } from '@inertiajs/vue3';
 import { Eye, RotateCcw, Trash2 } from '@lucide/vue';
 
 import { nextRound, reset as resetRound, reveal } from '@/routes/room';
@@ -7,26 +7,29 @@ import type { RoomModeratorControlsProps } from '@/types/room';
 
 const props = defineProps<RoomModeratorControlsProps>();
 
-const revealForm = useForm<{ room?: string }>({});
+const revealRequest = useHttp<{ room?: string }>(
-const nextRoundForm = useForm<{ room?: string }>({});
+    () => reveal(props.roomId),
-const resetForm = useForm<{ room?: string }>({});
+    {},
+);
+const nextRoundRequest = useHttp<{ room?: string }>(
+    () => nextRound(props.roomId),
+    {},
+);
+const resetRequest = useHttp<{ room?: string }>(
+    () => resetRound(props.roomId),
+    {},
+);
 
 function revealCards(): void {
-    revealForm.submit(reveal(props.roomId), {
+    void revealRequest.submit();
-        preserveScroll: true,
-    });
 }
 
 function startNextRound(): void {
-    nextRoundForm.submit(nextRound(props.roomId), {
+    void nextRoundRequest.submit();
-        preserveScroll: true,
-    });
 }
 
 function resetVotes(): void {
-    resetForm.submit(resetRound(props.roomId), {
+    void resetRequest.submit();
-        preserveScroll: true,
-    });
 }
 </script>
 
@@ -35,7 +38,7 @@ function resetVotes(): void {
         <button
             type="button"
             class="inline-flex items-center gap-2 rounded-xl border border-slate-600 bg-slate-800 px-4 py-2.5 font-semibold text-slate-200 transition hover:bg-slate-700 disabled:cursor-not-allowed disabled:opacity-40"
-            :disabled="resetForm.processing || !hasVotes"
+            :disabled="resetRequest.processing || !hasVotes"
             @click="resetVotes"
         >
             <Trash2 class="size-4" />
@@ -45,18 +48,18 @@ function resetVotes(): void {
 
     <div class="moderator-controls">
         <p
-            v-if="revealForm.errors.room || nextRoundForm.errors.room"
+            v-if="revealRequest.errors.room || nextRoundRequest.errors.room"
             class="max-w-64 rounded-lg bg-rose-950/90 px-3 py-2 text-right text-sm text-rose-200 shadow-lg"
             role="alert"
         >
-            {{ revealForm.errors.room ?? nextRoundForm.errors.room }}
+            {{ revealRequest.errors.room ?? nextRoundRequest.errors.room }}
         </p>
 
         <button
             v-if="!revealed"
             type="button"
             class="inline-flex items-center gap-2 rounded-xl border border-slate-300 bg-slate-100 px-5 py-2.5 font-semibold text-slate-900 transition hover:bg-white disabled:opacity-50"
-            :disabled="revealForm.processing"
+            :disabled="revealRequest.processing"
             @click="revealCards"
         >
             <Eye class="size-4" />
@@ -67,7 +70,7 @@ function resetVotes(): void {
             v-else
             type="button"
             class="inline-flex items-center gap-2 rounded-xl border border-slate-300 bg-slate-100 px-5 py-2.5 font-semibold text-slate-900 transition hover:bg-white disabled:opacity-50"
-            :disabled="nextRoundForm.processing"
+            :disabled="nextRoundRequest.processing"
             @click="startNextRound"
         >
             <RotateCcw class="size-4" />
@@ -106,4 +109,24 @@ function resetVotes(): void {
         left: 1rem;
     }
 }
+
+@media (min-width: 768px) and (max-height: 800px) {
+    .moderator-controls,
+    .reset-controls {
+        bottom: 0.75rem;
+    }
+
+    .moderator-controls {
+        right: 0.75rem;
+    }
+
+    .reset-controls {
+        left: 0.75rem;
+    }
+
+    button {
+        padding: 0.5rem 0.75rem;
+        font-size: 0.875rem;
+    }
+}
 </style>

resources/js/components/rooms/RoomSeat.vue

@@ -39,7 +39,7 @@ function playerVote(): string | null {
             :aria-label="`${player.name} hat eine Karte gewählt`"
         >
             <div
-                v-if="isCurrentPlayer()"
+                v-if="isCurrentPlayer() && !presenterMode"
                 class="own-vote-card"
                 :class="{ 'is-revealed': revealed }"
             >
@@ -313,6 +313,27 @@ function playerVote(): string | null {
     }
 }
 
+@media (min-width: 768px) and (max-height: 800px) {
+    .player-seat {
+        width: 7rem;
+    }
+
+    .player-details {
+        margin-top: 0.25rem;
+    }
+
+    .seat-card {
+        top: 1.5rem;
+        width: 2.75rem;
+        height: 3.8rem;
+    }
+
+    .own-vote-card,
+    .flip-card-face {
+        font-size: 1rem;
+    }
+}
+
 @media (prefers-reduced-motion: reduce) {
     .flip-card-inner {
         transition: none;

resources/js/components/rooms/RoomTable.vue

@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import { useMediaQuery } from '@vueuse/core';
 import { computed, ref } from 'vue';
 
 import RoomModeratorControls from '@/components/rooms/RoomModeratorControls.vue';
@@ -11,6 +12,9 @@ import type {
 } from '@/types/room';
 
 const props = defineProps<RoomTableProps>();
+const hasCompactHeight = useMediaQuery(
+    '(min-width: 768px) and (max-height: 800px)',
+);
 
 const gameBoard = ref<HTMLElement | null>(null);
 const { activePaperBalls, hitPlayerIds, throwingAtPlayerId, throwPaperBall } =
@@ -36,8 +40,8 @@ const positionedPlayers = computed<PositionedRoomPlayer[]>(() => {
     return orderedPlayers.map((player, index) => {
         const angle = Math.PI / 2 + (index * Math.PI * 2) / playerCount;
         const horizontalRadius = 39;
-        const verticalRadius = 40;
+        const verticalRadius = hasCompactHeight.value ? 34 : 40;
-        const cardDistance = 96;
+        const cardDistance = hasCompactHeight.value ? 72 : 96;
 
         return {
             ...player,
@@ -58,7 +62,7 @@ const voteCount = computed(
 </script>
 
 <template>
-    <section class="mt-5 w-full">
+    <section class="mt-5 w-full md:mt-3 md:min-h-0 md:flex-1">
         <div ref="gameBoard" class="game-board" aria-label="Scrum-Poker-Tisch">
             <div class="poker-table" aria-hidden="true">
                 <div class="table-highlight"></div>
@@ -109,13 +113,17 @@ const voteCount = computed(
                 :current-vote="currentPlayer.current_vote"
                 :cards="room.deck.cards"
                 :revealed="room.revealed"
+                :presenter-mode="presenterMode"
                 :is-paper-ball-hit="hitPlayerIds.includes(player.id)"
                 :throw-disabled="throwingAtPlayerId !== null"
                 @throw-paper-ball="throwPaperBall"
             />
 
             <RoomModeratorControls
-                v-if="currentPlayer.is_moderator"
+                v-if="
+                    currentPlayer.is_moderator ||
+                    room.allow_participant_controls
+                "
                 :room-id="room.id"
                 :revealed="room.revealed"
                 :has-votes="voteCount > 0"
@@ -132,6 +140,13 @@ const voteCount = computed(
     isolation: isolate;
 }
 
+@media (min-width: 768px) {
+    .game-board {
+        height: 100%;
+        min-height: 0;
+    }
+}
+
 .poker-table {
     position: absolute;
     inset: 20% 15% 21%;

resources/js/components/rooms/RoomVoteDeck.vue

@@ -1,42 +1,106 @@
 <script setup lang="ts">
-import { useForm } from '@inertiajs/vue3';
+import { useHttp } from '@inertiajs/vue3';
+import { Keyboard } from '@lucide/vue';
+import { useEventListener } from '@vueuse/core';
 import { watch } from 'vue';
 
 import { store as storeVote } from '@/routes/room/vote';
-import type { RoomVoteDeckProps } from '@/types/room';
+import type { RoomVoteDeckEmits, RoomVoteDeckProps } from '@/types/room';
 
 const props = defineProps<RoomVoteDeckProps>();
+const emit = defineEmits<RoomVoteDeckEmits>();
 
-const voteForm = useForm({
+const cardShortcuts = [
+    '1',
+    '2',
+    '3',
+    '4',
+    '5',
+    '6',
+    '7',
+    '8',
+    '9',
+    '0',
+    ...Array.from({ length: 24 }, (_, index) =>
+        String.fromCharCode('a'.charCodeAt(0) + index),
+    ),
+];
+
+const voteRequest = useHttp(() => storeVote(props.roomId), {
     value: props.currentVote ?? '',
 });
 
 watch(
     () => props.currentVote,
     (value) => {
-        if (!voteForm.processing) {
+        if (!voteRequest.processing) {
-            voteForm.value = value ?? '';
+            voteRequest.value = value ?? '';
         }
     },
 );
 
 function submitVote(value: string): void {
-    if (props.revealed || voteForm.processing) {
+    if (props.revealed || voteRequest.processing) {
         return;
     }
 
-    voteForm.value = value;
+    const previousVote = props.currentVote;
-    voteForm.submit(storeVote(props.roomId), {
+
-        preserveScroll: true,
+    voteRequest.value = value;
+    emit('vote-changed', value);
+    void voteRequest.submit({
         onError: () => {
-            voteForm.value = props.currentVote ?? '';
+            voteRequest.value = previousVote ?? '';
+            emit('vote-changed', previousVote);
         },
     });
 }
+
+function shortcutForCard(index: number): string | null {
+    return cardShortcuts[index] ?? null;
+}
+
+function isEditableTarget(target: EventTarget | null): boolean {
+    if (!(target instanceof HTMLElement)) {
+        return false;
+    }
+
+    return (
+        target.isContentEditable ||
+        ['INPUT', 'SELECT', 'TEXTAREA'].includes(target.tagName)
+    );
+}
+
+function handleKeyboardVote(event: KeyboardEvent): void {
+    if (
+        !props.presenterMode ||
+        props.revealed ||
+        voteRequest.processing ||
+        event.repeat ||
+        event.altKey ||
+        event.ctrlKey ||
+        event.metaKey ||
+        isEditableTarget(event.target)
+    ) {
+        return;
+    }
+
+    const cardIndex = cardShortcuts.indexOf(event.key.toLowerCase());
+    const card = props.cards[cardIndex];
+
+    if (card === undefined) {
+        return;
+    }
+
+    event.preventDefault();
+    submitVote(card.key);
+}
+
+useEventListener('keydown', handleKeyboardVote);
 </script>
 
 <template>
-    <section class="mx-auto mt-6 max-w-4xl text-center">
+    <section class="mx-auto mt-6 max-w-4xl text-center md:mt-3 md:shrink-0">
         <div class="mb-3 flex items-center justify-center gap-3">
             <span class="h-px w-10 bg-white/10"></span>
             <h2
@@ -52,32 +116,44 @@ function submitVote(value: string): void {
             class="flex flex-wrap justify-center gap-2.5 sm:gap-3"
         >
             <button
-                v-for="card in cards"
+                v-for="(card, index) in cards"
                 :key="card.key"
                 type="button"
                 class="deck-card"
-                :class="{ 'is-selected': voteForm.value === card.key }"
+                :class="{
-                :disabled="voteForm.processing"
+                    'is-selected':
-                :aria-pressed="voteForm.value === card.key"
+                        !presenterMode && voteRequest.value === card.key,
+                }"
+                :disabled="voteRequest.processing"
+                :aria-pressed="voteRequest.value === card.key"
                 :aria-label="`Karte ${card.label} wählen`"
                 @click="submitVote(card.key)"
             >
-                <span>{{ card.label }}</span>
+                <span class="card-label">{{ card.label }}</span>
+                <span
+                    v-if="presenterMode && shortcutForCard(index)"
+                    class="card-shortcut"
+                    aria-hidden="true"
+                >
+                    <Keyboard class="size-3" />
+                    <kbd>{{ shortcutForCard(index) }}</kbd>
+                </span>
             </button>
         </div>
 
         <p
-            v-if="voteForm.errors.value"
+            v-if="voteRequest.errors.value"
             class="mt-3 text-sm text-rose-300"
             role="alert"
         >
-            {{ voteForm.errors.value }}
+            {{ voteRequest.errors.value }}
         </p>
     </section>
 </template>
 
 <style scoped>
 .deck-card {
+    position: relative;
     display: grid;
     width: 3.75rem;
     aspect-ratio: 3 / 4;
@@ -94,11 +170,30 @@ function submitVote(value: string): void {
         box-shadow 160ms ease;
 }
 
-.deck-card span {
+.deck-card > .card-label {
     font-size: 1.2rem;
     font-weight: 800;
 }
 
+.card-shortcut {
+    position: absolute;
+    bottom: 0.25rem;
+    left: 50%;
+    display: flex;
+    align-items: center;
+    gap: 0.2rem;
+    color: #64748b;
+    font-size: 0.6rem;
+    font-weight: 700;
+    line-height: 1;
+    transform: translateX(-50%);
+}
+
+.card-shortcut kbd {
+    font: inherit;
+    text-transform: uppercase;
+}
+
 .deck-card:hover:not(:disabled) {
     transform: translateY(-0.35rem);
     border-color: rgb(103 232 249 / 80%);
@@ -122,6 +217,12 @@ function submitVote(value: string): void {
     }
 }
 
+@media (min-width: 768px) and (max-height: 800px) {
+    .deck-card {
+        width: 3.25rem;
+    }
+}
+
 @media (prefers-reduced-motion: reduce) {
     .deck-card {
         transition: none;

resources/js/composables/useRoomRealtime.ts

@@ -1,72 +1,73 @@
 import { router } from '@inertiajs/vue3';
-import { onScopeDispose, watch } from 'vue';
+import { onScopeDispose, ref, shallowReadonly, watch } from 'vue';
 
 import { getEcho } from '@/lib/echo';
-import type { RoomStateChangedPayload } from '@/types/room';
+import { home } from '@/routes';
+import { join } from '@/routes/room';
+import type {
+    CurrentRoomPlayer,
+    PokerRoom,
+    RoomStateChangedPayload,
+} from '@/types/room';
 
 const ROOM_EVENT = '.room.state.changed';
 
 export function useRoomRealtime(
-    roomId: () => string,
+    initialRoom: () => PokerRoom,
-    stateVersion: () => number,
+    initialCurrentPlayer: () => CurrentRoomPlayer,
-): void {
+) {
-    let reloadInProgress = false;
+    const room = ref<PokerRoom>({ ...initialRoom() });
-    let pendingVersion = 0;
+    const currentPlayer = ref<CurrentRoomPlayer>({ ...initialCurrentPlayer() });
-    let disposed = false;
-
-    function reloadRoom(): void {
-        if (reloadInProgress || disposed) {
-            return;
-        }
-
-        reloadInProgress = true;
-
-        router.reload({
-            only: ['room', 'currentPlayer'],
-            onFinish: () => {
-                reloadInProgress = false;
-
-                if (disposed) {
-                    return;
-                }
-
-                if (pendingVersion > stateVersion()) {
-                    reloadRoom();
-
-                    return;
-                }
-
-                pendingVersion = stateVersion();
-            },
-        });
-    }
 
     function handleRoomChange(payload: RoomStateChangedPayload): void {
         if (
             typeof payload.version !== 'number' ||
-            payload.version <= Math.max(stateVersion(), pendingVersion)
+            payload.version <= room.value.state_version
         ) {
             return;
         }
 
-        pendingVersion = payload.version;
-
         if (payload.change === 'room_deleted') {
-            router.visit('/', { replace: true });
+            router.visit(home().url, { replace: true });
 
             return;
         }
 
-        reloadRoom();
+        if (payload.change === 'room_closed') {
+            router.visit(
+                join({ query: { join_code: room.value.join_code } }).url,
+                { replace: true },
+            );
+
+            return;
+        }
+
+        if (payload.state === null || payload.state === undefined) {
+            return;
+        }
+
+        room.value = {
+            ...room.value,
+            ...payload.state,
+        };
+
+        if (
+            payload.change === 'votes_reset' ||
+            payload.change === 'next_round'
+        ) {
+            currentPlayer.value = {
+                ...currentPlayer.value,
+                current_vote: null,
+            };
+        }
     }
 
     const stopWatchingRoom = watch(
-        roomId,
+        () => initialRoom().id,
         (nextRoomId, _previousRoomId, onCleanup) => {
             const echo = getEcho();
             const channelName = `rooms.${nextRoomId}`;
 
-            pendingVersion = stateVersion();
             echo.channel(channelName).listen(ROOM_EVENT, handleRoomChange);
 
             onCleanup(() => {
@@ -76,19 +77,30 @@ export function useRoomRealtime(
         { immediate: true },
     );
 
-    const stopWatchingVersion = watch(
+    const stopWatchingInitialState = watch(
-        stateVersion,
+        [initialRoom, initialCurrentPlayer],
-        (version) => {
+        ([nextRoom, nextCurrentPlayer]) => {
-            if (!reloadInProgress) {
+            room.value = { ...nextRoom };
-                pendingVersion = Math.max(pendingVersion, version);
+            currentPlayer.value = { ...nextCurrentPlayer };
-            }
         },
-        { flush: 'sync' },
+        { deep: true },
     );
 
     onScopeDispose(() => {
-        disposed = true;
         stopWatchingRoom();
-        stopWatchingVersion();
+        stopWatchingInitialState();
     });
+
+    function setCurrentVote(value: string | null): void {
+        currentPlayer.value = {
+            ...currentPlayer.value,
+            current_vote: value,
+        };
+    }
+
+    return {
+        room: shallowReadonly(room),
+        currentPlayer: shallowReadonly(currentPlayer),
+        setCurrentVote,
+    };
 }

resources/js/layouts/PublicLayout.vue

@@ -1,6 +1,8 @@
 <script setup lang="ts">
 import { Link, usePage } from '@inertiajs/vue3';
 import { computed } from 'vue';
+
+import AppVersion from '@/components/AppVersion.vue';
 import { dashboard, home, login, logout, register } from '@/routes';
 
 const page = usePage();
@@ -57,5 +59,7 @@ const user = computed(() => page.props.auth.user);
         <main class="p-6">
             <slot />
         </main>
+
+        <AppVersion />
     </div>
 </template>

resources/js/pages/rooms/Show.vue

@@ -1,6 +1,6 @@
 <script setup lang="ts">
-import { Head, usePage, usePoll } from '@inertiajs/vue3';
+import { Head, usePage } from '@inertiajs/vue3';
-import { computed } from 'vue';
+import { computed, ref } from 'vue';
 
 import RoomHeader from '@/components/rooms/RoomHeader.vue';
 import RoomRetentionNotice from '@/components/rooms/RoomRetentionNotice.vue';
@@ -12,44 +12,56 @@ import type { RoomPageProps } from '@/types/room';
 const props = defineProps<RoomPageProps>();
 
 const page = usePage();
+const presenterMode = ref(false);
 const roomNotice = computed(() => page.props.roomNotice);
 const canFavorite = computed(
     () => page.props.auth.user?.id != props.room.owner_id,
 );
 
-useRoomRealtime(
+const {
-    () => props.room.id,
+    room: realtimeRoom,
-    () => props.room.state_version,
+    currentPlayer: realtimeCurrentPlayer,
+    setCurrentVote,
+} = useRoomRealtime(
+    () => props.room,
+    () => props.currentPlayer,
 );
-
-usePoll(30_000, {
-    only: ['room', 'currentPlayer'],
-});
 </script>
 
 <template>
-    <Head :title="room.title ?? 'Scrum Poker'" />
+    <Head :title="realtimeRoom.title ?? 'Scrum Poker'" />
 
     <main
-        class="-m-6 min-h-[calc(100svh-4rem)] bg-slate-900 px-3 py-6 text-white sm:px-6 lg:px-10"
+        class="-m-6 min-h-[calc(100svh-4rem)] bg-slate-900 px-3 py-6 text-white sm:px-6 md:flex md:h-[calc(100dvh-4rem-1px)] md:min-h-0 md:flex-col md:overflow-hidden lg:px-10"
     >
         <RoomRetentionNotice v-if="roomNotice" :notice="roomNotice" />
 
         <RoomHeader
-            :id="room.id"
+            :id="realtimeRoom.id"
-            :title="room.title"
+            :title="realtimeRoom.title"
-            :join_code="room.join_code"
+            :join_code="realtimeRoom.join_code"
-            :is_favorite="room.is_favorite"
+            :is_favorite="realtimeRoom.is_favorite"
             :can-favorite="canFavorite"
+            :is-moderator="realtimeCurrentPlayer.is_moderator"
+            :allow-participant-controls="
+                realtimeRoom.allow_participant_controls
+            "
+            v-model:presenter-mode="presenterMode"
         />
 
-        <RoomTable :room="room" :current-player="currentPlayer" />
+        <RoomTable
+            :room="realtimeRoom"
+            :current-player="realtimeCurrentPlayer"
+            :presenter-mode="presenterMode"
+        />
 
         <RoomVoteDeck
-            :room-id="room.id"
+            :room-id="realtimeRoom.id"
-            :revealed="room.revealed"
+            :revealed="realtimeRoom.revealed"
-            :cards="room.deck.cards"
+            :cards="realtimeRoom.deck.cards"
-            :current-vote="currentPlayer.current_vote"
+            :current-vote="realtimeCurrentPlayer.current_vote"
+            :presenter-mode="presenterMode"
+            @vote-changed="setCurrentVote"
         />
     </main>
 </template>

resources/js/types/global.d.ts

@@ -5,6 +5,7 @@ import type { RoomNotice } from '@/types/room';
 declare module 'vite/client' {
     interface ImportMetaEnv {
         readonly VITE_APP_NAME: string;
+        readonly VITE_APP_VERSION?: string;
         [key: string]: string | boolean | undefined;
     }
 

resources/js/types/room.ts

@@ -44,6 +44,7 @@ export type PokerRoom = {
     current_round: number;
     revealed: boolean;
     state_version: number;
+    allow_participant_controls: boolean;
     statistics: RoomStatistics | null;
     deck: RoomDeck;
     players: RoomPlayer[];
@@ -94,11 +95,19 @@ export type RoomHeaderProps = Pick<
     'id' | 'title' | 'join_code' | 'is_favorite'
 > & {
     canFavorite: boolean;
+    isModerator: boolean;
+    allowParticipantControls: boolean;
+    presenterMode: boolean;
+};
+
+export type RoomHeaderEmits = {
+    'update:presenterMode': [value: boolean];
 };
 
 export type RoomTableProps = {
     room: PokerRoom;
     currentPlayer: CurrentRoomPlayer;
+    presenterMode: boolean;
 };
 
 export type RoomSeatProps = {
@@ -107,6 +116,7 @@ export type RoomSeatProps = {
     currentVote: string | null;
     cards: PokerCard[];
     revealed: boolean;
+    presenterMode: boolean;
     isPaperBallHit: boolean;
     throwDisabled: boolean;
 };
@@ -122,6 +132,11 @@ export type RoomVoteDeckProps = {
     revealed: boolean;
     cards: PokerCard[];
     currentVote: string | null;
+    presenterMode: boolean;
+};
+
+export type RoomVoteDeckEmits = {
+    'vote-changed': [value: string | null];
 };
 
 export type RoomStateChange =
@@ -130,6 +145,7 @@ export type RoomStateChange =
     | 'cards_revealed'
     | 'votes_reset'
     | 'next_round'
+    | 'permissions_updated'
     | 'room_reopened'
     | 'room_closed'
     | 'room_deleted';
@@ -137,4 +153,15 @@ export type RoomStateChange =
 export type RoomStateChangedPayload = {
     version: number;
     change: RoomStateChange;
+    state: RoomRealtimeState | null;
 };
+
+export type RoomRealtimeState = Pick<
+    PokerRoom,
+    | 'current_round'
+    | 'revealed'
+    | 'state_version'
+    | 'allow_participant_controls'
+    | 'statistics'
+    | 'players'
+>;

routes/room.php

@@ -5,6 +5,7 @@ use App\Http\Controllers\RoomController;
 use App\Http\Controllers\RoomEmoteController;
 use App\Http\Controllers\RoomJoinController;
 use App\Http\Controllers\RoomLifecycleController;
+use App\Http\Controllers\RoomPermissionController;
 use App\Http\Controllers\RoomPlayerController;
 use App\Http\Controllers\RoundController;
 use App\Http\Controllers\VoteController;
@@ -42,4 +43,6 @@ Route::middleware('room.player')->group(function () {
         ->name('room.reset');
     Route::post('/rooms/{room}/next-round', [RoundController::class, 'nextRound'])
         ->name('room.next-round');
+    Route::patch('/rooms/{room}/permissions', RoomPermissionController::class)
+        ->name('room.permissions.update');
 });

tests/Feature/RoomBroadcastingTest.php

@@ -5,6 +5,7 @@ use App\Events\RoomStateChanged;
 use App\Jobs\CloseInactiveRooms;
 use App\Models\Room;
 use App\Models\User;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Event;
 
@@ -23,18 +24,20 @@ function createBroadcastRoom(array $attributes = []): Room
     ]);
 }
 
-test('room state broadcasts expose only invalidation metadata', function () {
+test('room state broadcasts synchronously expose sanitized state', function () {
     $event = new RoomStateChanged(
         '019b8f80-37c4-71a3-b415-5f2697332c16',
         7,
         RoomStateChange::VoteChanged,
     );
 
-    expect($event->broadcastAs())->toBe('room.state.changed')
+    expect($event)->toBeInstanceOf(ShouldBroadcastNow::class)
+        ->and($event->broadcastAs())->toBe('room.state.changed')
         ->and($event->broadcastOn()->name)->toBe('rooms.019b8f80-37c4-71a3-b415-5f2697332c16')
         ->and($event->broadcastWith())->toBe([
             'version' => 7,
             'change' => 'vote_changed',
+            'state' => null,
         ])
         ->and($event->broadcastWith())->not->toHaveKeys([
             'player_name',
@@ -66,31 +69,38 @@ test('voting and round actions broadcast their state changes', function () {
     ]);
     $session = ["room_players.{$room->id}" => $moderator->id];
 
+    $this->withSession($session)
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertNoContent();
+
     $this->withSession($session)
         ->post(route('room.vote.store', $room), ['value' => '5'])
-        ->assertRedirect();
+        ->assertNoContent();
 
     $this->withSession($session)
         ->post(route('room.reveal', $room))
-        ->assertRedirect();
+        ->assertNoContent();
 
     $this->withSession($session)
         ->post(route('room.next-round', $room))
-        ->assertRedirect();
+        ->assertNoContent();
 
     $this->withSession($session)
         ->post(route('room.vote.store', $room), ['value' => '3'])
-        ->assertRedirect();
+        ->assertNoContent();
 
     $this->withSession($session)
         ->post(route('room.reset', $room))
-        ->assertRedirect();
+        ->assertNoContent();
 
     foreach ([
         RoomStateChange::VoteChanged,
         RoomStateChange::CardsRevealed,
         RoomStateChange::NextRound,
         RoomStateChange::VotesReset,
+        RoomStateChange::PermissionsUpdated,
     ] as $change) {
         Event::assertDispatched(
             RoomStateChanged::class,
@@ -98,7 +108,43 @@ test('voting and round actions broadcast their state changes', function () {
         );
     }
 
-    Event::assertDispatchedTimes(RoomStateChanged::class, 5);
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        function (RoomStateChanged $event) use ($moderator): bool {
+            if ($event->change !== RoomStateChange::VoteChanged || $event->state === null) {
+                return false;
+            }
+
+            $player = collect($event->state['players'])->firstWhere('id', $moderator->id);
+
+            return $event->state['revealed'] === false
+                && $player['has_voted'] === true
+                && $player['vote'] === null;
+        },
+    );
+
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        function (RoomStateChanged $event) use ($moderator): bool {
+            if ($event->change !== RoomStateChange::CardsRevealed || $event->state === null) {
+                return false;
+            }
+
+            $player = collect($event->state['players'])->firstWhere('id', $moderator->id);
+
+            return $event->state['revealed'] === true
+                && $player['vote'] === '5';
+        },
+    );
+
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        fn (RoomStateChanged $event): bool => $event->change === RoomStateChange::PermissionsUpdated
+            && $event->state !== null
+            && $event->state['allow_participant_controls'] === true,
+    );
+
+    Event::assertDispatchedTimes(RoomStateChanged::class, 6);
 });
 
 test('failed room actions do not broadcast updates', function () {

tests/Feature/RoomLifecycleTest.php

@@ -238,7 +238,7 @@ test('meaningful game actions update the explicit activity timestamp', function
 
     $this->withSession(["room_players.{$room->id}" => $moderator->id])
         ->post(route('room.vote.store', $room), ['value' => '5'])
-        ->assertRedirect();
+        ->assertNoContent();
 
     expect($room->fresh()->last_activity_at->equalTo(now()))->toBeTrue();
 });

tests/Feature/RoomVotingTest.php

@@ -40,7 +40,7 @@ test('a participant can vote and change their vote in the current round', functi
 
     $this->withSession($session)
         ->post(route('room.vote.store', $room), ['value' => '5'])
-        ->assertRedirect();
+        ->assertNoContent();
 
     $this->assertDatabaseHas('votes', [
         'room_id' => $room->id,
@@ -51,7 +51,7 @@ test('a participant can vote and change their vote in the current round', functi
 
     $this->withSession($session)
         ->post(route('room.vote.store', $room), ['value' => '8'])
-        ->assertRedirect();
+        ->assertNoContent();
 
     expect(Vote::query()->count())->toBe(1);
     expect(Vote::query()->value('value'))->toBe('8')
@@ -91,7 +91,7 @@ test('other votes stay hidden until the moderator reveals the round', function (
 
     $this->withSession($session)
         ->post(route('room.reveal', $room))
-        ->assertRedirect();
+        ->assertNoContent();
 
     expect($room->fresh()->last_activity_at->greaterThan($previousActivity))->toBeTrue();
 
@@ -102,16 +102,96 @@ test('other votes stay hidden until the moderator reveals the round', function (
             ->where('room.players.1.vote', '8'));
 });
 
-test('only the moderator may reveal cards', function () {
+test('round controls remain moderator-only by default', function () {
     [$room, , $player] = createVotingRoom();
+    $session = ["room_players.{$room->id}" => $player->id];
 
-    $this->withSession(["room_players.{$room->id}" => $player->id])
+    $this->withSession($session)
         ->post(route('room.reveal', $room))
         ->assertForbidden();
 
+    $this->withSession($session)
+        ->post(route('room.next-round', $room))
+        ->assertForbidden();
+
+    $this->withSession($session)
+        ->post(route('room.reset', $room))
+        ->assertForbidden();
+
     expect($room->fresh()->revealed_at)->toBeNull();
 });
 
+test('the moderator can allow every participant to control the round', function () {
+    [$room, $moderator, $player] = createVotingRoom();
+    $room->refresh();
+    $initialStateVersion = $room->state_version;
+
+    $this->withSession(["room_players.{$room->id}" => $moderator->id])
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertNoContent();
+
+    $room->refresh();
+
+    expect($room->allow_participant_controls)->toBeTrue()
+        ->and($room->state_version)->toBe($initialStateVersion + 1);
+
+    $session = ["room_players.{$room->id}" => $player->id];
+
+    $this->withSession($session)
+        ->get(route('room.show', $room))
+        ->assertInertia(fn (Assert $page) => $page
+            ->where('room.allow_participant_controls', true));
+
+    $this->withSession($session)
+        ->post(route('room.reveal', $room))
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.next-round', $room))
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.vote.store', $room), ['value' => '5'])
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.reset', $room))
+        ->assertNoContent();
+
+    expect($room->fresh()->current_round)->toBe(2);
+
+    $this->assertDatabaseMissing('votes', [
+        'room_id' => $room->id,
+        'round' => 2,
+    ]);
+});
+
+test('participants cannot change room permissions', function () {
+    [$room, , $player] = createVotingRoom();
+
+    $this->withSession(["room_players.{$room->id}" => $player->id])
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertForbidden();
+
+    expect($room->fresh()->allow_participant_controls)->toBeFalse();
+});
+
+test('room permissions require a strict boolean value', function () {
+    [$room, $moderator] = createVotingRoom();
+
+    $this->withSession(["room_players.{$room->id}" => $moderator->id])
+        ->patchJson(route('room.permissions.update', $room), [
+            'allow_participant_controls' => 'true',
+        ])
+        ->assertJsonValidationErrors('allow_participant_controls');
+
+    expect($room->fresh()->allow_participant_controls)->toBeFalse();
+});
+
 test('starting the next round clears the revealed state', function () {
     [$room, $moderator] = createVotingRoom();
 
@@ -123,7 +203,7 @@ test('starting the next round clears the revealed state', function () {
 
     $this->withSession(["room_players.{$room->id}" => $moderator->id])
         ->post(route('room.next-round', $room))
-        ->assertRedirect();
+        ->assertNoContent();
 
     $room->refresh();
 
@@ -156,7 +236,7 @@ test('the moderator can reset only the votes from the current round', function (
 
     $this->withSession(["room_players.{$room->id}" => $moderator->id])
         ->post(route('room.reset', $room))
-        ->assertRedirect();
+        ->assertNoContent();
 
     $this->assertDatabaseHas('votes', [
         'room_id' => $room->id,