Merge pull request #5 from ericasch6/allow-other-control

allow anyone controll room option

.ai/rules/index.md

@@ -0,0 +1,7 @@
+# Project Rules Index
+
+Before planning or editing, find the row whose globs match the file's path and read that rule file.
+
+| Applies to | Rule file |
+| --- | --- |
+| {app/Events/**,app/Services/Rooms/**,resources/js/composables/**} | .ai/rules/js-composables.md |

.ai/rules/js-composables.md

@@ -0,0 +1,9 @@
+---
+paths:
+  - '{app/Events/**,app/Services/Rooms/**,resources/js/composables/**}'
+---
+
+# Js Composables
+
+## Never broadcast hidden room votes
+Room table updates are delivered as synchronous WebSocket state payloads without polling or Inertia reloads. Before a round is revealed, broadcast only has_voted and keep every player's vote null; actual vote values may enter the shared payload only after reveal. State-changing commands remain server-authorized HTTP requests.

app/Enums/RoomStateChange.php

@@ -9,6 +9,7 @@ enum RoomStateChange: string
     case CardsRevealed = 'cards_revealed';
     case VotesReset = 'votes_reset';
     case NextRound = 'next_round';
+    case PermissionsUpdated = 'permissions_updated';
     case RoomReopened = 'room_reopened';
     case RoomClosed = 'room_closed';
     case RoomDeleted = 'room_deleted';

app/Events/RoomStateChanged.php

@@ -5,18 +5,22 @@ namespace App\Events;
 use App\Enums\RoomStateChange;
 use Illuminate\Broadcasting\Channel;
 use Illuminate\Broadcasting\InteractsWithSockets;
-use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
 use Illuminate\Foundation\Events\Dispatchable;
 use Illuminate\Queue\SerializesModels;
 
-class RoomStateChanged implements ShouldBroadcast
+class RoomStateChanged implements ShouldBroadcastNow
 {
     use Dispatchable, InteractsWithSockets, SerializesModels;
 
+    /**
+     * @param  array<string, mixed>|null  $state
+     */
     public function __construct(
         public readonly string $roomId,
         public readonly int $version,
         public readonly RoomStateChange $change,
+        public readonly ?array $state = null,
     ) {}
 
     public function broadcastOn(): Channel
@@ -30,13 +34,14 @@ class RoomStateChanged implements ShouldBroadcast
     }
 
     /**
-     * @return array{version: int, change: string}
+     * @return array{version: int, change: string, state: array<string, mixed>|null}
      */
     public function broadcastWith(): array
     {
         return [
             'version' => $this->version,
             'change' => $this->change->value,
+            'state' => $this->state,
         ];
     }
 }

app/Http/Controllers/RoomPermissionController.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\UpdateRoomPermissionsRequest;
+use App\Models\Room;
+use App\Services\Rooms\RoomPermissionService;
+use Illuminate\Http\Response;
+
+class RoomPermissionController extends Controller
+{
+    public function __construct(
+        private readonly RoomPermissionService $roomPermissions,
+    ) {}
+
+    public function __invoke(UpdateRoomPermissionsRequest $request, Room $room): Response
+    {
+        $this->roomPermissions->updateParticipantControls(
+            $room,
+            (bool) $request->validated('allow_participant_controls'),
+        );
+
+        return response()->noContent();
+    }
+}

app/Http/Controllers/RoundController.php

@@ -5,8 +5,8 @@ namespace App\Http\Controllers;
 use App\Models\Player;
 use App\Models\Room;
 use App\Services\Rooms\RoundService;
-use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class RoundController extends Controller
 {
@@ -14,38 +14,38 @@ class RoundController extends Controller
         private readonly RoundService $rounds,
     ) {}
 
-    public function reset(Request $request, Room $room): RedirectResponse
+    public function reset(Request $request, Room $room): Response
     {
-        $this->ensureModerator($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->reset($room);
 
-        return back();
+        return response()->noContent();
     }
 
-    public function reveal(Request $request, Room $room): RedirectResponse
+    public function reveal(Request $request, Room $room): Response
     {
-        $this->ensureModerator($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->reveal($room);
 
-        return back();
+        return response()->noContent();
     }
 
-    public function nextRound(Request $request, Room $room): RedirectResponse
+    public function nextRound(Request $request, Room $room): Response
     {
-        $this->ensureModerator($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->startNext($room);
 
-        return back();
+        return response()->noContent();
     }
 
-    private function ensureModerator(Request $request, Room $room): void
+    private function ensureCanControlRound(Request $request, Room $room): void
     {
         $player = $request->attributes->get('currentPlayer');
 
         abort_unless(
             $player instanceof Player
             && $player->room_id === $room->id
-            && $player->is_moderator,
+            && ($player->is_moderator || $room->allow_participant_controls),
             403,
         );
     }

app/Http/Controllers/VoteController.php

@@ -6,7 +6,7 @@ use App\Http\Requests\SubmitVoteRequest;
 use App\Models\Player;
 use App\Models\Room;
 use App\Services\Rooms\VoteService;
-use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Response;
 
 class VoteController extends Controller
 {
@@ -17,7 +17,7 @@ class VoteController extends Controller
     public function store(
         SubmitVoteRequest $request,
         Room $room,
-    ): RedirectResponse {
+    ): Response {
         $player = $request->attributes->get('currentPlayer');
 
         abort_unless(
@@ -32,6 +32,6 @@ class VoteController extends Controller
             $request->validated('value'),
         );
 
-        return back();
+        return response()->noContent();
     }
 }

app/Http/Requests/UpdateRoomPermissionsRequest.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Models\Player;
+use App\Models\Room;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateRoomPermissionsRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        $room = $this->route('room');
+        $player = $this->attributes->get('currentPlayer');
+
+        return $room instanceof Room
+            && $player instanceof Player
+            && $player->room_id === $room->id
+            && $player->is_moderator;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'allow_participant_controls' => ['required', 'boolean:strict'],
+        ];
+    }
+}

app/Http/Resources/RoomResource.php

@@ -26,6 +26,7 @@ class RoomResource extends JsonResource
             'current_round' => $room->current_round,
             'revealed' => $room->revealed_at !== null,
             'state_version' => $room->state_version,
+            'allow_participant_controls' => $room->allow_participant_controls,
             'statistics' => $pageData->statistics,
             'deck' => (new RoomDeckResource($room->deck_config))->resolve($request),
             'players' => $room->players

app/Models/Room.php

@@ -19,6 +19,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
  * @property int $current_round
  * @property CarbonImmutable|null $revealed_at
  * @property int $state_version
+ * @property bool $allow_participant_controls
  * @property CarbonImmutable|null $last_activity_at
  * @property CarbonImmutable|null $closed_at
  * @property CarbonImmutable|null $deleted_at
@@ -35,6 +36,7 @@ class Room extends Model
         'deck_config',
         'revealed_at',
         'state_version',
+        'allow_participant_controls',
         'last_activity_at',
         'closed_at',
     ];
@@ -44,6 +46,7 @@ class Room extends Model
         return [
             'current_round' => 'integer',
             'state_version' => 'integer',
+            'allow_participant_controls' => 'boolean',
             'revealed_at' => 'immutable_datetime',
             'last_activity_at' => 'immutable_datetime',
             'closed_at' => 'immutable_datetime',
@@ -51,6 +54,10 @@ class Room extends Model
         ];
     }
 
+    protected $attributes = [
+        'allow_participant_controls' => false,
+    ];
+
     protected static function booted(): void
     {
         static::creating(function (Room $room) {

app/Services/Rooms/RoomLifecycleService.php

@@ -11,6 +11,10 @@ use Illuminate\Support\Facades\DB;
 
 class RoomLifecycleService
 {
+    public function __construct(
+        private readonly RoomRealtimeStateService $realtimeState,
+    ) {}
+
     /**
      * @return array{player: Player, was_reopened: bool}
      */
@@ -49,6 +53,7 @@ class RoomLifecycleService
                 $room->id,
                 $stateVersion,
                 RoomStateChange::RoomReopened,
+                $this->realtimeState->for($room),
             );
         }
 

app/Services/Rooms/RoomParticipationService.php

@@ -12,6 +12,10 @@ use Illuminate\Validation\ValidationException;
 
 class RoomParticipationService
 {
+    public function __construct(
+        private readonly RoomRealtimeStateService $realtimeState,
+    ) {}
+
     public function findByJoinCode(string $joinCode): ?Room
     {
         if ($joinCode === '') {
@@ -92,6 +96,7 @@ class RoomParticipationService
             $room->id,
             $room->state_version,
             RoomStateChange::PlayerJoined,
+            $this->realtimeState->for($room),
         );
 
         return [$room, $player];

app/Services/Rooms/RoomPermissionService.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Services\Rooms;
+
+use App\Enums\RoomStateChange;
+use App\Events\RoomStateChanged;
+use App\Models\Room;
+use Illuminate\Support\Facades\DB;
+
+class RoomPermissionService
+{
+    public function __construct(
+        private readonly RoomRealtimeStateService $realtimeState,
+    ) {}
+
+    public function updateParticipantControls(Room $room, bool $allowParticipantControls): void
+    {
+        [$stateVersion, $wasChanged] = DB::transaction(function () use ($room, $allowParticipantControls): array {
+            $lockedRoom = Room::query()
+                ->lockForUpdate()
+                ->findOrFail($room->id);
+
+            if ($lockedRoom->allow_participant_controls === $allowParticipantControls) {
+                return [$lockedRoom->state_version, false];
+            }
+
+            $lockedRoom->update([
+                'allow_participant_controls' => $allowParticipantControls,
+                'last_activity_at' => now(),
+                'state_version' => $lockedRoom->state_version + 1,
+            ]);
+
+            return [$lockedRoom->state_version, true];
+        });
+
+        if (! $wasChanged) {
+            return;
+        }
+
+        RoomStateChanged::dispatch(
+            $room->id,
+            $stateVersion,
+            RoomStateChange::PermissionsUpdated,
+            $this->realtimeState->for($room),
+        );
+    }
+}

app/Services/Rooms/RoomRealtimeStateService.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Services\Rooms;
+
+use App\Models\Room;
+
+class RoomRealtimeStateService
+{
+    public function __construct(
+        private readonly RoomStatisticsService $statistics,
+    ) {}
+
+    /**
+     * @return array{
+     *     current_round: int,
+     *     revealed: bool,
+     *     state_version: int,
+     *     allow_participant_controls: bool,
+     *     statistics: array{average: string|null, median: string|null}|null,
+     *     players: array<int, array{
+     *         id: int,
+     *         name: string,
+     *         is_moderator: bool,
+     *         is_owner: bool,
+     *         has_voted: bool,
+     *         vote: string|null
+     *     }>
+     * }
+     */
+    public function for(Room $room): array
+    {
+        $room->refresh();
+        $room->load([
+            'players' => fn ($query) => $query
+                ->active()
+                ->select(['id', 'room_id', 'user_id', 'name', 'is_moderator', 'created_at'])
+                ->orderByDesc('is_moderator')
+                ->orderBy('created_at'),
+            'players.votes' => fn ($query) => $query
+                ->where('room_id', $room->id)
+                ->where('round', $room->current_round),
+        ]);
+
+        return [
+            'current_round' => $room->current_round,
+            'revealed' => $room->revealed_at !== null,
+            'state_version' => $room->state_version,
+            'allow_participant_controls' => $room->allow_participant_controls,
+            'statistics' => $this->statistics->currentRound($room),
+            'players' => $room->players
+                ->map(function ($player) use ($room): array {
+                    $vote = $player->votes->first();
+
+                    return [
+                        'id' => $player->id,
+                        'name' => $player->name,
+                        'is_moderator' => $player->is_moderator,
+                        'is_owner' => $player->user_id === $room->owner_id,
+                        'has_voted' => $vote !== null,
+                        'vote' => $room->revealed_at !== null ? $vote?->value : null,
+                    ];
+                })
+                ->all(),
+        ];
+    }
+}

app/Services/Rooms/RoundService.php

@@ -11,6 +11,10 @@ use Illuminate\Validation\ValidationException;
 
 class RoundService
 {
+    public function __construct(
+        private readonly RoomRealtimeStateService $realtimeState,
+    ) {}
+
     public function reset(Room $room): void
     {
         $stateVersion = DB::transaction(function () use ($room): int {
@@ -38,6 +42,7 @@ class RoundService
             $room->id,
             $stateVersion,
             RoomStateChange::VotesReset,
+            $this->realtimeState->for($room),
         );
     }
 
@@ -69,6 +74,7 @@ class RoundService
             $room->id,
             $stateVersion,
             RoomStateChange::CardsRevealed,
+            $this->realtimeState->for($room),
         );
     }
 
@@ -101,6 +107,7 @@ class RoundService
             $room->id,
             $stateVersion,
             RoomStateChange::NextRound,
+            $this->realtimeState->for($room),
         );
     }
 

app/Services/Rooms/VoteService.php

@@ -12,6 +12,10 @@ use Illuminate\Validation\ValidationException;
 
 class VoteService
 {
+    public function __construct(
+        private readonly RoomRealtimeStateService $realtimeState,
+    ) {}
+
     public function submit(Room $room, Player $player, string $value): void
     {
         $stateVersion = DB::transaction(function () use ($room, $player, $value): int {
@@ -52,6 +56,7 @@ class VoteService
             $room->id,
             $stateVersion,
             RoomStateChange::VoteChanged,
+            $this->realtimeState->for($room),
         );
     }
 }

database/migrations/2026_08_27_133231_add_allow_participant_controls_to_rooms_table.php

@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('rooms', function (Blueprint $table) {
+            $table->boolean('allow_participant_controls')
+                ->default(false)
+                ->after('state_version');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('rooms', function (Blueprint $table) {
+            $table->dropColumn('allow_participant_controls');
+        });
+    }
+};

resources/js/components/rooms/RoomHeader.vue

@@ -1,16 +1,32 @@
 <script setup lang="ts">
-import { Link } from '@inertiajs/vue3';
+import { Link, useHttp } from '@inertiajs/vue3';
 import { Check, Copy } from '@lucide/vue';
-import { ref } from 'vue';
+import { ref, watch } from 'vue';
 
 import { Checkbox } from '@/components/ui/checkbox';
 import { favorite } from '@/routes/room';
+import { update as updatePermissions } from '@/routes/room/permissions';
 import type { RoomHeaderEmits, RoomHeaderProps } from '@/types/room';
 
 const props = defineProps<RoomHeaderProps>();
 const emit = defineEmits<RoomHeaderEmits>();
 
 const copied = ref(false);
+const allowParticipantControls = ref(props.allowParticipantControls);
+const permissionRequest = useHttp(() => updatePermissions(props.id), {
+    allow_participant_controls: props.allowParticipantControls,
+});
+
+watch(
+    () => props.allowParticipantControls,
+    (value) => {
+        allowParticipantControls.value = value;
+
+        if (!permissionRequest.processing) {
+            permissionRequest.allow_participant_controls = value;
+        }
+    },
+);
 
 async function copyInviteLink(): Promise<void> {
     const inviteUrl = new URL('/room/join', window.location.origin);
@@ -22,6 +38,24 @@ async function copyInviteLink(): Promise<void> {
         copied.value = false;
     }, 1_800);
 }
+
+function updateParticipantControls(value: boolean): void {
+    if (permissionRequest.processing) {
+        return;
+    }
+
+    const previousValue = allowParticipantControls.value;
+
+    allowParticipantControls.value = value;
+    permissionRequest.allow_participant_controls = value;
+
+    void permissionRequest.submit({
+        onError: () => {
+            allowParticipantControls.value = previousValue;
+            permissionRequest.allow_participant_controls = previousValue;
+        },
+    });
+}
 </script>
 
 <template>
@@ -67,6 +101,30 @@ async function copyInviteLink(): Promise<void> {
                 <Copy v-else class="size-5 text-slate-300" />
             </button>
 
+            <label
+                v-if="isModerator"
+                for="participant-controls"
+                class="flex cursor-pointer items-center gap-2 text-sm text-slate-300"
+            >
+                <Checkbox
+                    id="participant-controls"
+                    :model-value="allowParticipantControls"
+                    :disabled="permissionRequest.processing"
+                    @update:model-value="
+                        updateParticipantControls($event === true)
+                    "
+                />
+                <span>Alle dürfen die Runde steuern</span>
+            </label>
+
+            <p
+                v-if="permissionRequest.errors.allow_participant_controls"
+                class="max-w-xs text-right text-sm text-rose-300"
+                role="alert"
+            >
+                {{ permissionRequest.errors.allow_participant_controls }}
+            </p>
+
             <label
                 for="presenter-mode"
                 class="flex cursor-pointer items-center gap-2 text-sm text-slate-300"

resources/js/components/rooms/RoomModeratorControls.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { useForm } from '@inertiajs/vue3';
+import { useHttp } from '@inertiajs/vue3';
 import { Eye, RotateCcw, Trash2 } from '@lucide/vue';
 
 import { nextRound, reset as resetRound, reveal } from '@/routes/room';
@@ -7,26 +7,29 @@ import type { RoomModeratorControlsProps } from '@/types/room';
 
 const props = defineProps<RoomModeratorControlsProps>();
 
-const revealForm = useForm<{ room?: string }>({});
+const revealRequest = useHttp<{ room?: string }>(
-const nextRoundForm = useForm<{ room?: string }>({});
+    () => reveal(props.roomId),
-const resetForm = useForm<{ room?: string }>({});
+    {},
+);
+const nextRoundRequest = useHttp<{ room?: string }>(
+    () => nextRound(props.roomId),
+    {},
+);
+const resetRequest = useHttp<{ room?: string }>(
+    () => resetRound(props.roomId),
+    {},
+);
 
 function revealCards(): void {
-    revealForm.submit(reveal(props.roomId), {
+    void revealRequest.submit();
-        preserveScroll: true,
-    });
 }
 
 function startNextRound(): void {
-    nextRoundForm.submit(nextRound(props.roomId), {
+    void nextRoundRequest.submit();
-        preserveScroll: true,
-    });
 }
 
 function resetVotes(): void {
-    resetForm.submit(resetRound(props.roomId), {
+    void resetRequest.submit();
-        preserveScroll: true,
-    });
 }
 </script>
 
@@ -35,7 +38,7 @@ function resetVotes(): void {
         <button
             type="button"
             class="inline-flex items-center gap-2 rounded-xl border border-slate-600 bg-slate-800 px-4 py-2.5 font-semibold text-slate-200 transition hover:bg-slate-700 disabled:cursor-not-allowed disabled:opacity-40"
-            :disabled="resetForm.processing || !hasVotes"
+            :disabled="resetRequest.processing || !hasVotes"
             @click="resetVotes"
         >
             <Trash2 class="size-4" />
@@ -45,18 +48,18 @@ function resetVotes(): void {
 
     <div class="moderator-controls">
         <p
-            v-if="revealForm.errors.room || nextRoundForm.errors.room"
+            v-if="revealRequest.errors.room || nextRoundRequest.errors.room"
             class="max-w-64 rounded-lg bg-rose-950/90 px-3 py-2 text-right text-sm text-rose-200 shadow-lg"
             role="alert"
         >
-            {{ revealForm.errors.room ?? nextRoundForm.errors.room }}
+            {{ revealRequest.errors.room ?? nextRoundRequest.errors.room }}
         </p>
 
         <button
             v-if="!revealed"
             type="button"
             class="inline-flex items-center gap-2 rounded-xl border border-slate-300 bg-slate-100 px-5 py-2.5 font-semibold text-slate-900 transition hover:bg-white disabled:opacity-50"
-            :disabled="revealForm.processing"
+            :disabled="revealRequest.processing"
             @click="revealCards"
         >
             <Eye class="size-4" />
@@ -67,7 +70,7 @@ function resetVotes(): void {
             v-else
             type="button"
             class="inline-flex items-center gap-2 rounded-xl border border-slate-300 bg-slate-100 px-5 py-2.5 font-semibold text-slate-900 transition hover:bg-white disabled:opacity-50"
-            :disabled="nextRoundForm.processing"
+            :disabled="nextRoundRequest.processing"
             @click="startNextRound"
         >
             <RotateCcw class="size-4" />

resources/js/components/rooms/RoomTable.vue

@@ -120,7 +120,10 @@ const voteCount = computed(
             />
 
             <RoomModeratorControls
-                v-if="currentPlayer.is_moderator"
+                v-if="
+                    currentPlayer.is_moderator ||
+                    room.allow_participant_controls
+                "
                 :room-id="room.id"
                 :revealed="room.revealed"
                 :has-votes="voteCount > 0"

resources/js/components/rooms/RoomVoteDeck.vue

@@ -1,13 +1,14 @@
 <script setup lang="ts">
-import { useForm } from '@inertiajs/vue3';
+import { useHttp } from '@inertiajs/vue3';
 import { Keyboard } from '@lucide/vue';
 import { useEventListener } from '@vueuse/core';
 import { watch } from 'vue';
 
 import { store as storeVote } from '@/routes/room/vote';
-import type { RoomVoteDeckProps } from '@/types/room';
+import type { RoomVoteDeckEmits, RoomVoteDeckProps } from '@/types/room';
 
 const props = defineProps<RoomVoteDeckProps>();
+const emit = defineEmits<RoomVoteDeckEmits>();
 
 const cardShortcuts = [
     '1',
@@ -25,29 +26,32 @@ const cardShortcuts = [
     ),
 ];
 
-const voteForm = useForm({
+const voteRequest = useHttp(() => storeVote(props.roomId), {
     value: props.currentVote ?? '',
 });
 
 watch(
     () => props.currentVote,
     (value) => {
-        if (!voteForm.processing) {
+        if (!voteRequest.processing) {
-            voteForm.value = value ?? '';
+            voteRequest.value = value ?? '';
         }
     },
 );
 
 function submitVote(value: string): void {
-    if (props.revealed || voteForm.processing) {
+    if (props.revealed || voteRequest.processing) {
         return;
     }
 
-    voteForm.value = value;
+    const previousVote = props.currentVote;
-    voteForm.submit(storeVote(props.roomId), {
+
-        preserveScroll: true,
+    voteRequest.value = value;
+    emit('vote-changed', value);
+    void voteRequest.submit({
         onError: () => {
-            voteForm.value = props.currentVote ?? '';
+            voteRequest.value = previousVote ?? '';
+            emit('vote-changed', previousVote);
         },
     });
 }
@@ -71,7 +75,7 @@ function handleKeyboardVote(event: KeyboardEvent): void {
     if (
         !props.presenterMode ||
         props.revealed ||
-        voteForm.processing ||
+        voteRequest.processing ||
         event.repeat ||
         event.altKey ||
         event.ctrlKey ||
@@ -118,10 +122,10 @@ useEventListener('keydown', handleKeyboardVote);
                 class="deck-card"
                 :class="{
                     'is-selected':
-                        !presenterMode && voteForm.value === card.key,
+                        !presenterMode && voteRequest.value === card.key,
                 }"
-                :disabled="voteForm.processing"
+                :disabled="voteRequest.processing"
-                :aria-pressed="voteForm.value === card.key"
+                :aria-pressed="voteRequest.value === card.key"
                 :aria-label="`Karte ${card.label} wählen`"
                 @click="submitVote(card.key)"
             >
@@ -138,11 +142,11 @@ useEventListener('keydown', handleKeyboardVote);
         </div>
 
         <p
-            v-if="voteForm.errors.value"
+            v-if="voteRequest.errors.value"
             class="mt-3 text-sm text-rose-300"
             role="alert"
         >
-            {{ voteForm.errors.value }}
+            {{ voteRequest.errors.value }}
         </p>
     </section>
 </template>

resources/js/composables/useRoomRealtime.ts

@@ -1,72 +1,73 @@
 import { router } from '@inertiajs/vue3';
-import { onScopeDispose, watch } from 'vue';
+import { onScopeDispose, ref, shallowReadonly, watch } from 'vue';
 
 import { getEcho } from '@/lib/echo';
-import type { RoomStateChangedPayload } from '@/types/room';
+import { home } from '@/routes';
+import { join } from '@/routes/room';
+import type {
+    CurrentRoomPlayer,
+    PokerRoom,
+    RoomStateChangedPayload,
+} from '@/types/room';
 
 const ROOM_EVENT = '.room.state.changed';
 
 export function useRoomRealtime(
-    roomId: () => string,
+    initialRoom: () => PokerRoom,
-    stateVersion: () => number,
+    initialCurrentPlayer: () => CurrentRoomPlayer,
-): void {
+) {
-    let reloadInProgress = false;
+    const room = ref<PokerRoom>({ ...initialRoom() });
-    let pendingVersion = 0;
+    const currentPlayer = ref<CurrentRoomPlayer>({ ...initialCurrentPlayer() });
-    let disposed = false;
-
-    function reloadRoom(): void {
-        if (reloadInProgress || disposed) {
-            return;
-        }
-
-        reloadInProgress = true;
-
-        router.reload({
-            only: ['room', 'currentPlayer'],
-            onFinish: () => {
-                reloadInProgress = false;
-
-                if (disposed) {
-                    return;
-                }
-
-                if (pendingVersion > stateVersion()) {
-                    reloadRoom();
-
-                    return;
-                }
-
-                pendingVersion = stateVersion();
-            },
-        });
-    }
 
     function handleRoomChange(payload: RoomStateChangedPayload): void {
         if (
             typeof payload.version !== 'number' ||
-            payload.version <= Math.max(stateVersion(), pendingVersion)
+            payload.version <= room.value.state_version
         ) {
             return;
         }
 
-        pendingVersion = payload.version;
-
         if (payload.change === 'room_deleted') {
-            router.visit('/', { replace: true });
+            router.visit(home().url, { replace: true });
 
             return;
         }
 
-        reloadRoom();
+        if (payload.change === 'room_closed') {
+            router.visit(
+                join({ query: { join_code: room.value.join_code } }).url,
+                { replace: true },
+            );
+
+            return;
+        }
+
+        if (payload.state === null || payload.state === undefined) {
+            return;
+        }
+
+        room.value = {
+            ...room.value,
+            ...payload.state,
+        };
+
+        if (
+            payload.change === 'votes_reset' ||
+            payload.change === 'next_round'
+        ) {
+            currentPlayer.value = {
+                ...currentPlayer.value,
+                current_vote: null,
+            };
+        }
     }
 
     const stopWatchingRoom = watch(
-        roomId,
+        () => initialRoom().id,
         (nextRoomId, _previousRoomId, onCleanup) => {
             const echo = getEcho();
             const channelName = `rooms.${nextRoomId}`;
 
-            pendingVersion = stateVersion();
             echo.channel(channelName).listen(ROOM_EVENT, handleRoomChange);
 
             onCleanup(() => {
@@ -76,19 +77,30 @@ export function useRoomRealtime(
         { immediate: true },
     );
 
-    const stopWatchingVersion = watch(
+    const stopWatchingInitialState = watch(
-        stateVersion,
+        [initialRoom, initialCurrentPlayer],
-        (version) => {
+        ([nextRoom, nextCurrentPlayer]) => {
-            if (!reloadInProgress) {
+            room.value = { ...nextRoom };
-                pendingVersion = Math.max(pendingVersion, version);
+            currentPlayer.value = { ...nextCurrentPlayer };
-            }
         },
-        { flush: 'sync' },
+        { deep: true },
     );
 
     onScopeDispose(() => {
-        disposed = true;
         stopWatchingRoom();
-        stopWatchingVersion();
+        stopWatchingInitialState();
     });
+
+    function setCurrentVote(value: string | null): void {
+        currentPlayer.value = {
+            ...currentPlayer.value,
+            current_vote: value,
+        };
+    }
+
+    return {
+        room: shallowReadonly(room),
+        currentPlayer: shallowReadonly(currentPlayer),
+        setCurrentVote,
+    };
 }

resources/js/pages/rooms/Show.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { Head, usePage, usePoll } from '@inertiajs/vue3';
+import { Head, usePage } from '@inertiajs/vue3';
 import { computed, ref } from 'vue';
 
 import RoomHeader from '@/components/rooms/RoomHeader.vue';
@@ -18,18 +18,18 @@ const canFavorite = computed(
     () => page.props.auth.user?.id != props.room.owner_id,
 );
 
-useRoomRealtime(
+const {
-    () => props.room.id,
+    room: realtimeRoom,
-    () => props.room.state_version,
+    currentPlayer: realtimeCurrentPlayer,
+    setCurrentVote,
+} = useRoomRealtime(
+    () => props.room,
+    () => props.currentPlayer,
 );
-
-usePoll(30_000, {
-    only: ['room', 'currentPlayer'],
-});
 </script>
 
 <template>
-    <Head :title="room.title ?? 'Scrum Poker'" />
+    <Head :title="realtimeRoom.title ?? 'Scrum Poker'" />
 
     <main
         class="-m-6 min-h-[calc(100svh-4rem)] bg-slate-900 px-3 py-6 text-white sm:px-6 md:flex md:h-[calc(100dvh-4rem-1px)] md:min-h-0 md:flex-col md:overflow-hidden lg:px-10"
@@ -37,26 +37,31 @@ usePoll(30_000, {
         <RoomRetentionNotice v-if="roomNotice" :notice="roomNotice" />
 
         <RoomHeader
-            :id="room.id"
+            :id="realtimeRoom.id"
-            :title="room.title"
+            :title="realtimeRoom.title"
-            :join_code="room.join_code"
+            :join_code="realtimeRoom.join_code"
-            :is_favorite="room.is_favorite"
+            :is_favorite="realtimeRoom.is_favorite"
             :can-favorite="canFavorite"
+            :is-moderator="realtimeCurrentPlayer.is_moderator"
+            :allow-participant-controls="
+                realtimeRoom.allow_participant_controls
+            "
             v-model:presenter-mode="presenterMode"
         />
 
         <RoomTable
-            :room="room"
+            :room="realtimeRoom"
-            :current-player="currentPlayer"
+            :current-player="realtimeCurrentPlayer"
             :presenter-mode="presenterMode"
         />
 
         <RoomVoteDeck
-            :room-id="room.id"
+            :room-id="realtimeRoom.id"
-            :revealed="room.revealed"
+            :revealed="realtimeRoom.revealed"
-            :cards="room.deck.cards"
+            :cards="realtimeRoom.deck.cards"
-            :current-vote="currentPlayer.current_vote"
+            :current-vote="realtimeCurrentPlayer.current_vote"
             :presenter-mode="presenterMode"
+            @vote-changed="setCurrentVote"
         />
     </main>
 </template>

resources/js/types/room.ts

@@ -44,6 +44,7 @@ export type PokerRoom = {
     current_round: number;
     revealed: boolean;
     state_version: number;
+    allow_participant_controls: boolean;
     statistics: RoomStatistics | null;
     deck: RoomDeck;
     players: RoomPlayer[];
@@ -94,6 +95,8 @@ export type RoomHeaderProps = Pick<
     'id' | 'title' | 'join_code' | 'is_favorite'
 > & {
     canFavorite: boolean;
+    isModerator: boolean;
+    allowParticipantControls: boolean;
     presenterMode: boolean;
 };
 
@@ -132,12 +135,17 @@ export type RoomVoteDeckProps = {
     presenterMode: boolean;
 };
 
+export type RoomVoteDeckEmits = {
+    'vote-changed': [value: string | null];
+};
+
 export type RoomStateChange =
     | 'player_joined'
     | 'vote_changed'
     | 'cards_revealed'
     | 'votes_reset'
     | 'next_round'
+    | 'permissions_updated'
     | 'room_reopened'
     | 'room_closed'
     | 'room_deleted';
@@ -145,4 +153,15 @@ export type RoomStateChange =
 export type RoomStateChangedPayload = {
     version: number;
     change: RoomStateChange;
+    state: RoomRealtimeState | null;
 };
+
+export type RoomRealtimeState = Pick<
+    PokerRoom,
+    | 'current_round'
+    | 'revealed'
+    | 'state_version'
+    | 'allow_participant_controls'
+    | 'statistics'
+    | 'players'
+>;

routes/room.php

@@ -5,6 +5,7 @@ use App\Http\Controllers\RoomController;
 use App\Http\Controllers\RoomEmoteController;
 use App\Http\Controllers\RoomJoinController;
 use App\Http\Controllers\RoomLifecycleController;
+use App\Http\Controllers\RoomPermissionController;
 use App\Http\Controllers\RoomPlayerController;
 use App\Http\Controllers\RoundController;
 use App\Http\Controllers\VoteController;
@@ -42,4 +43,6 @@ Route::middleware('room.player')->group(function () {
         ->name('room.reset');
     Route::post('/rooms/{room}/next-round', [RoundController::class, 'nextRound'])
         ->name('room.next-round');
+    Route::patch('/rooms/{room}/permissions', RoomPermissionController::class)
+        ->name('room.permissions.update');
 });

tests/Feature/RoomBroadcastingTest.php

@@ -5,6 +5,7 @@ use App\Events\RoomStateChanged;
 use App\Jobs\CloseInactiveRooms;
 use App\Models\Room;
 use App\Models\User;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Event;
 
@@ -23,18 +24,20 @@ function createBroadcastRoom(array $attributes = []): Room
     ]);
 }
 
-test('room state broadcasts expose only invalidation metadata', function () {
+test('room state broadcasts synchronously expose sanitized state', function () {
     $event = new RoomStateChanged(
         '019b8f80-37c4-71a3-b415-5f2697332c16',
         7,
         RoomStateChange::VoteChanged,
     );
 
-    expect($event->broadcastAs())->toBe('room.state.changed')
+    expect($event)->toBeInstanceOf(ShouldBroadcastNow::class)
+        ->and($event->broadcastAs())->toBe('room.state.changed')
         ->and($event->broadcastOn()->name)->toBe('rooms.019b8f80-37c4-71a3-b415-5f2697332c16')
         ->and($event->broadcastWith())->toBe([
             'version' => 7,
             'change' => 'vote_changed',
+            'state' => null,
         ])
         ->and($event->broadcastWith())->not->toHaveKeys([
             'player_name',
@@ -66,31 +69,38 @@ test('voting and round actions broadcast their state changes', function () {
     ]);
     $session = ["room_players.{$room->id}" => $moderator->id];
 
+    $this->withSession($session)
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertNoContent();
+
     $this->withSession($session)
         ->post(route('room.vote.store', $room), ['value' => '5'])
-        ->assertRedirect();
+        ->assertNoContent();
 
     $this->withSession($session)
         ->post(route('room.reveal', $room))
-        ->assertRedirect();
+        ->assertNoContent();
 
     $this->withSession($session)
         ->post(route('room.next-round', $room))
-        ->assertRedirect();
+        ->assertNoContent();
 
     $this->withSession($session)
         ->post(route('room.vote.store', $room), ['value' => '3'])
-        ->assertRedirect();
+        ->assertNoContent();
 
     $this->withSession($session)
         ->post(route('room.reset', $room))
-        ->assertRedirect();
+        ->assertNoContent();
 
     foreach ([
         RoomStateChange::VoteChanged,
         RoomStateChange::CardsRevealed,
         RoomStateChange::NextRound,
         RoomStateChange::VotesReset,
+        RoomStateChange::PermissionsUpdated,
     ] as $change) {
         Event::assertDispatched(
             RoomStateChanged::class,
@@ -98,7 +108,43 @@ test('voting and round actions broadcast their state changes', function () {
         );
     }
 
-    Event::assertDispatchedTimes(RoomStateChanged::class, 5);
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        function (RoomStateChanged $event) use ($moderator): bool {
+            if ($event->change !== RoomStateChange::VoteChanged || $event->state === null) {
+                return false;
+            }
+
+            $player = collect($event->state['players'])->firstWhere('id', $moderator->id);
+
+            return $event->state['revealed'] === false
+                && $player['has_voted'] === true
+                && $player['vote'] === null;
+        },
+    );
+
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        function (RoomStateChanged $event) use ($moderator): bool {
+            if ($event->change !== RoomStateChange::CardsRevealed || $event->state === null) {
+                return false;
+            }
+
+            $player = collect($event->state['players'])->firstWhere('id', $moderator->id);
+
+            return $event->state['revealed'] === true
+                && $player['vote'] === '5';
+        },
+    );
+
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        fn (RoomStateChanged $event): bool => $event->change === RoomStateChange::PermissionsUpdated
+            && $event->state !== null
+            && $event->state['allow_participant_controls'] === true,
+    );
+
+    Event::assertDispatchedTimes(RoomStateChanged::class, 6);
 });
 
 test('failed room actions do not broadcast updates', function () {

tests/Feature/RoomLifecycleTest.php

@@ -238,7 +238,7 @@ test('meaningful game actions update the explicit activity timestamp', function
 
     $this->withSession(["room_players.{$room->id}" => $moderator->id])
         ->post(route('room.vote.store', $room), ['value' => '5'])
-        ->assertRedirect();
+        ->assertNoContent();
 
     expect($room->fresh()->last_activity_at->equalTo(now()))->toBeTrue();
 });

tests/Feature/RoomVotingTest.php

@@ -40,7 +40,7 @@ test('a participant can vote and change their vote in the current round', functi
 
     $this->withSession($session)
         ->post(route('room.vote.store', $room), ['value' => '5'])
-        ->assertRedirect();
+        ->assertNoContent();
 
     $this->assertDatabaseHas('votes', [
         'room_id' => $room->id,
@@ -51,7 +51,7 @@ test('a participant can vote and change their vote in the current round', functi
 
     $this->withSession($session)
         ->post(route('room.vote.store', $room), ['value' => '8'])
-        ->assertRedirect();
+        ->assertNoContent();
 
     expect(Vote::query()->count())->toBe(1);
     expect(Vote::query()->value('value'))->toBe('8')
@@ -91,7 +91,7 @@ test('other votes stay hidden until the moderator reveals the round', function (
 
     $this->withSession($session)
         ->post(route('room.reveal', $room))
-        ->assertRedirect();
+        ->assertNoContent();
 
     expect($room->fresh()->last_activity_at->greaterThan($previousActivity))->toBeTrue();
 
@@ -102,16 +102,96 @@ test('other votes stay hidden until the moderator reveals the round', function (
             ->where('room.players.1.vote', '8'));
 });
 
-test('only the moderator may reveal cards', function () {
+test('round controls remain moderator-only by default', function () {
     [$room, , $player] = createVotingRoom();
+    $session = ["room_players.{$room->id}" => $player->id];
 
-    $this->withSession(["room_players.{$room->id}" => $player->id])
+    $this->withSession($session)
         ->post(route('room.reveal', $room))
         ->assertForbidden();
 
+    $this->withSession($session)
+        ->post(route('room.next-round', $room))
+        ->assertForbidden();
+
+    $this->withSession($session)
+        ->post(route('room.reset', $room))
+        ->assertForbidden();
+
     expect($room->fresh()->revealed_at)->toBeNull();
 });
 
+test('the moderator can allow every participant to control the round', function () {
+    [$room, $moderator, $player] = createVotingRoom();
+    $room->refresh();
+    $initialStateVersion = $room->state_version;
+
+    $this->withSession(["room_players.{$room->id}" => $moderator->id])
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertNoContent();
+
+    $room->refresh();
+
+    expect($room->allow_participant_controls)->toBeTrue()
+        ->and($room->state_version)->toBe($initialStateVersion + 1);
+
+    $session = ["room_players.{$room->id}" => $player->id];
+
+    $this->withSession($session)
+        ->get(route('room.show', $room))
+        ->assertInertia(fn (Assert $page) => $page
+            ->where('room.allow_participant_controls', true));
+
+    $this->withSession($session)
+        ->post(route('room.reveal', $room))
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.next-round', $room))
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.vote.store', $room), ['value' => '5'])
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.reset', $room))
+        ->assertNoContent();
+
+    expect($room->fresh()->current_round)->toBe(2);
+
+    $this->assertDatabaseMissing('votes', [
+        'room_id' => $room->id,
+        'round' => 2,
+    ]);
+});
+
+test('participants cannot change room permissions', function () {
+    [$room, , $player] = createVotingRoom();
+
+    $this->withSession(["room_players.{$room->id}" => $player->id])
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertForbidden();
+
+    expect($room->fresh()->allow_participant_controls)->toBeFalse();
+});
+
+test('room permissions require a strict boolean value', function () {
+    [$room, $moderator] = createVotingRoom();
+
+    $this->withSession(["room_players.{$room->id}" => $moderator->id])
+        ->patchJson(route('room.permissions.update', $room), [
+            'allow_participant_controls' => 'true',
+        ])
+        ->assertJsonValidationErrors('allow_participant_controls');
+
+    expect($room->fresh()->allow_participant_controls)->toBeFalse();
+});
+
 test('starting the next round clears the revealed state', function () {
     [$room, $moderator] = createVotingRoom();
 
@@ -123,7 +203,7 @@ test('starting the next round clears the revealed state', function () {
 
     $this->withSession(["room_players.{$room->id}" => $moderator->id])
         ->post(route('room.next-round', $room))
-        ->assertRedirect();
+        ->assertNoContent();
 
     $room->refresh();
 
@@ -156,7 +236,7 @@ test('the moderator can reset only the votes from the current round', function (
 
     $this->withSession(["room_players.{$room->id}" => $moderator->id])
         ->post(route('room.reset', $room))
-        ->assertRedirect();
+        ->assertNoContent();
 
     $this->assertDatabaseHas('votes', [
         'room_id' => $room->id,