Keep guest rooms moderated and restore owner moderation

feat: added settings in room to kick

.github/workflows/ci_cd.yml

@@ -49,7 +49,7 @@ jobs:
               printf -v run_attempt '%03d' "${GITHUB_RUN_ATTEMPT}"
               tag="main-${GITHUB_RUN_NUMBER}-${run_attempt}-${GITHUB_SHA:0:12}"
               environment="staging"
-              vite_app_version="staging-${GITHUB_SHA:0:12}"
+              vite_app_version="main-${GITHUB_SHA:0:12}"
               vite_reverb_app_key="1af96b48d2ef78983e4ef281eed3a48b"
               vite_reverb_host="scrum-poker.twyco-staging.de"
               ;;

README.md

@@ -1,3 +1,4 @@
 # Scrumpoker without AD's
 
 trigger workflow
+

app/Enums/RoomStateChange.php

@@ -7,6 +7,7 @@ enum RoomStateChange: string
     case PlayerJoined = 'player_joined';
     case PlayerUpdated = 'player_updated';
     case PlayerKicked = 'player_kicked';
+    case PlayerInstanceReplaced = 'player_instance_replaced';
     case VoteChanged = 'vote_changed';
     case CardsRevealed = 'cards_revealed';
     case VotesReset = 'votes_reset';

app/Events/RoomStateChanged.php

@@ -22,6 +22,7 @@ class RoomStateChanged implements ShouldBroadcastNow
         public readonly RoomStateChange $change,
         public readonly ?array $state = null,
         public readonly ?int $affectedPlayerId = null,
+        public readonly ?string $affectedInstanceId = null,
     ) {}
 
     public function broadcastOn(): Channel
@@ -35,7 +36,7 @@ class RoomStateChanged implements ShouldBroadcastNow
     }
 
     /**
-     * @return array{version: int, change: string, state: array<string, mixed>|null, affected_player_id?: int}
+     * @return array{version: int, change: string, state: array<string, mixed>|null, affected_player_id?: int, affected_instance_id?: string}
      */
     public function broadcastWith(): array
     {
@@ -49,6 +50,10 @@ class RoomStateChanged implements ShouldBroadcastNow
             $payload['affected_player_id'] = $this->affectedPlayerId;
         }
 
+        if ($this->affectedInstanceId !== null) {
+            $payload['affected_instance_id'] = $this->affectedInstanceId;
+        }
+
         return $payload;
     }
 }

app/Http/Controllers/EmbeddedLogoutController.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Controllers;
 
+use App\Models\Room;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
@@ -15,11 +16,27 @@ class EmbeddedLogoutController extends Controller
     {
         $joinCode = $request->string('join_code')->trim()->upper()->toString();
         $playerName = $request->string('player_name')->trim()->toString();
+        $room = Room::query()->where('join_code', $joinCode)->first();
+        $playerId = null;
+
+        if ($room !== null) {
+            $sessionPlayerId = $request->session()->get("room_players.{$room->id}");
+
+            if (is_numeric($sessionPlayerId)) {
+                $playerId = $room->players()
+                    ->whereKey((int) $sessionPlayerId)
+                    ->value('id');
+            }
+        }
 
         Auth::guard('web')->logout();
         $request->session()->invalidate();
         $request->session()->regenerateToken();
 
+        if ($room !== null && is_numeric($playerId)) {
+            $request->session()->put("room_players.{$room->id}", (int) $playerId);
+        }
+
         return to_route('embedded.room', [
             'join_code' => $joinCode,
             'player_name' => $playerName,

app/Http/Controllers/EmbeddedRoomController.php

@@ -6,9 +6,9 @@ use App\Http\Requests\ShowEmbeddedRoomRequest;
 use App\Http\Resources\CurrentPlayerResource;
 use App\Http\Resources\RoomResource;
 use App\Models\Room;
-use App\Models\User;
 use App\Services\Rooms\RoomPageService;
 use App\Services\Rooms\RoomParticipationService;
+use App\Services\Rooms\RoomPlayerInstanceService;
 use Inertia\Inertia;
 use Inertia\Response;
 
@@ -17,6 +17,7 @@ class EmbeddedRoomController extends Controller
     public function __construct(
         private readonly RoomParticipationService $roomParticipation,
         private readonly RoomPageService $roomPage,
+        private readonly RoomPlayerInstanceService $playerInstances,
     ) {}
 
     public function __invoke(ShowEmbeddedRoomRequest $request): Response
@@ -25,8 +26,6 @@ class EmbeddedRoomController extends Controller
         $validated = $request->validated();
         $user = $request->user();
 
-        abort_unless($user instanceof User, 403);
-
         $room = Room::query()
             ->where('join_code', $validated['join_code'])
             ->firstOrFail();
@@ -34,10 +33,15 @@ class EmbeddedRoomController extends Controller
             $room,
             $user,
             $validated['player_name'],
+            $request->session()->get("room_players.{$room->id}"),
+        );
+        $player = $this->roomParticipation->activateInstance(
+            $room,
+            $player,
+            $this->playerInstances->for($request),
         );
 
         $request->session()->put("room_players.{$room->id}", $player->id);
-        $request->session()->forget('embedded_login');
 
         $pageData = $this->roomPage->prepare($room, $player, $user);
 

app/Http/Controllers/RoomController.php

@@ -10,6 +10,7 @@ use App\Models\Player;
 use App\Models\Room;
 use App\Services\Rooms\RoomCreationService;
 use App\Services\Rooms\RoomPageService;
+use App\Services\Rooms\RoomPlayerInstanceService;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Inertia\Inertia;
@@ -20,6 +21,7 @@ class RoomController extends Controller
     public function __construct(
         private readonly RoomCreationService $roomCreation,
         private readonly RoomPageService $roomPage,
+        private readonly RoomPlayerInstanceService $playerInstances,
     ) {}
 
     public function create(Request $request): Response
@@ -40,6 +42,9 @@ class RoomController extends Controller
             $validated,
             $request->user(),
         );
+        $player->update([
+            'active_instance_id' => $this->playerInstances->for($request),
+        ]);
 
         $request->session()->put(
             "room_players.{$room->id}",

app/Http/Controllers/RoomJoinController.php

@@ -32,7 +32,6 @@ class RoomJoinController extends Controller
             $room !== null
             && ! $room->isClosed()
             && $existingPlayer instanceof Player
-            && $existingPlayer->inactive_at === null
         ) {
             return to_route('room.show', $room);
         }

app/Http/Controllers/RoomPlayerController.php

@@ -4,12 +4,14 @@ namespace App\Http\Controllers;
 
 use App\Http\Requests\JoinRoomRequest;
 use App\Services\Rooms\RoomParticipationService;
+use App\Services\Rooms\RoomPlayerInstanceService;
 use Illuminate\Http\RedirectResponse;
 
 class RoomPlayerController extends Controller
 {
     public function __construct(
         private readonly RoomParticipationService $roomParticipation,
+        private readonly RoomPlayerInstanceService $playerInstances,
     ) {}
 
     public function join(JoinRoomRequest $request): RedirectResponse
@@ -23,6 +25,11 @@ class RoomPlayerController extends Controller
             $request->user(),
             is_array($sessionPlayerIds) ? $sessionPlayerIds : [],
         );
+        $player = $this->roomParticipation->activateInstance(
+            $room,
+            $player,
+            $this->playerInstances->for($request),
+        );
 
         $request->session()->put(
             "room_players.{$room->id}",

app/Http/Controllers/RoomPlayerKickController.php

@@ -5,7 +5,6 @@ namespace App\Http\Controllers;
 use App\Http\Requests\KickRoomPlayerRequest;
 use App\Models\Player;
 use App\Models\Room;
-use App\Models\User;
 use App\Services\Rooms\RoomParticipationService;
 use Illuminate\Http\RedirectResponse;
 use Inertia\Inertia;
@@ -18,11 +17,12 @@ class RoomPlayerKickController extends Controller
 
     public function __invoke(KickRoomPlayerRequest $request, Room $room, Player $player): RedirectResponse
     {
-        $user = $request->user();
+        $this->roomParticipation->kick(
-
+            $room,
-        abort_unless($user instanceof User, 403);
+            $player,
-
+            $request->user(),
-        $this->roomParticipation->kick($room, $player, $user);
+            $request->currentPlayer($room),
+        );
 
         Inertia::flash('toast', [
             'type' => 'success',

app/Http/Middleware/EnsureRoomParticipant.php

@@ -3,6 +3,8 @@
 namespace App\Http\Middleware;
 
 use App\Models\Room;
+use App\Services\Rooms\RoomParticipationService;
+use App\Services\Rooms\RoomPlayerInstanceService;
 use Closure;
 use Illuminate\Http\Request;
 use Inertia\Inertia;
@@ -10,6 +12,11 @@ use Symfony\Component\HttpFoundation\Response;
 
 class EnsureRoomParticipant
 {
+    public function __construct(
+        private readonly RoomParticipationService $roomParticipation,
+        private readonly RoomPlayerInstanceService $playerInstances,
+    ) {}
+
     /**
      * Handle an incoming request.
      *
@@ -44,13 +51,43 @@ class EnsureRoomParticipant
         }
 
         $playerId = $request->session()->get($sessionKey);
+        $hasSessionPlayer = is_numeric($playerId);
+        $instanceId = $this->playerInstances->for($request);
 
-        $player = is_numeric($playerId)
+        $player = $hasSessionPlayer
             ? $room->players()->find((int) $playerId)
             : null;
 
-        if ($player === null && $playerId) {
+        if ($player === null && $hasSessionPlayer) {
             $request->session()->forget($sessionKey);
+
+            return to_route('room.join', [
+                'join_code' => $room->join_code,
+            ])->withErrors([
+                'join_code' => 'Diese Spieler-Instanz ist nicht mehr aktiv.',
+            ]);
+        }
+
+        if (
+            $player !== null
+            && $player->active_instance_id !== null
+            && $player->active_instance_id !== $instanceId
+        ) {
+            $request->session()->forget($sessionKey);
+
+            return to_route('room.join', [
+                'join_code' => $room->join_code,
+            ])->withErrors([
+                'join_code' => 'Dein Account ist diesem Raum in einer anderen Instanz beigetreten.',
+            ]);
+        }
+
+        if ($player !== null) {
+            $player = $this->roomParticipation->activateInstance(
+                $room,
+                $player,
+                $instanceId,
+            );
         }
 
         if ($player === null && $request->user() !== null) {
@@ -59,6 +96,11 @@ class EnsureRoomParticipant
                 ->first();
 
             if ($player !== null) {
+                $player = $this->roomParticipation->activateInstance(
+                    $room,
+                    $player,
+                    $instanceId,
+                );
                 $request->session()->put($sessionKey, $player->id);
             }
         }
@@ -71,12 +113,6 @@ class EnsureRoomParticipant
             ]);
         }
 
-        if ($player->inactive_at !== null) {
-            return to_route('room.join', [
-                'join_code' => $room->join_code,
-            ]);
-        }
-
         $player->markAsSeen();
         $request->attributes->set('currentPlayer', $player);
 

app/Http/Requests/KickRoomPlayerRequest.php

@@ -14,13 +14,41 @@ class KickRoomPlayerRequest extends FormRequest
     public function authorize(): bool
     {
         $room = $this->route('room');
-        $player = $this->route('player');
+        $targetPlayer = $this->route('player');
 
-        return $room instanceof Room
+        if (
-            && $player instanceof Player
+            ! $room instanceof Room
-            && $this->user()?->id === $room->owner_id
+            || ! $targetPlayer instanceof Player
-            && $player->room_id === $room->id
+            || $targetPlayer->room_id !== $room->id
-            && $player->user_id !== $room->owner_id;
+            || $targetPlayer->is_moderator
+            || ($room->owner_id !== null && $targetPlayer->user_id === $room->owner_id)
+        ) {
+            return false;
+        }
+
+        $user = $this->user();
+
+        if ($user !== null && $user->id === $room->owner_id) {
+            return true;
+        }
+
+        $currentPlayer = $this->currentPlayer($room);
+
+        return ! $room->isClosed()
+            && $currentPlayer !== null
+            && $currentPlayer->id !== $targetPlayer->id
+            && ($currentPlayer->is_moderator || $room->allow_participants_to_manage_rounds);
+    }
+
+    public function currentPlayer(Room $room): ?Player
+    {
+        $playerId = $this->session()->get("room_players.{$room->id}");
+
+        if (! is_numeric($playerId)) {
+            return null;
+        }
+
+        return $room->players()->find((int) $playerId);
     }
 
     /**

app/Http/Requests/ShowEmbeddedRoomRequest.php

@@ -13,12 +13,14 @@ use Inertia\Inertia;
 
 class ShowEmbeddedRoomRequest extends FormRequest
 {
+    private const string PLAYER_NAME_TAKEN_MESSAGE = 'Dieser Anzeigename ist in dem Raum bereits vorhanden.';
+
     /**
      * Determine if the user is authorized to make this request.
      */
     public function authorize(): bool
     {
-        return $this->user() !== null;
+        return true;
     }
 
     protected function prepareForValidation(): void
@@ -67,23 +69,36 @@ class ShowEmbeddedRoomRequest extends FormRequest
                     return;
                 }
 
-                if ($room === null || $this->user() === null) {
+                if ($room === null) {
                     return;
                 }
 
+                $sessionPlayerId = $this->session()->get("room_players.{$room->id}");
+                $existingPlayer = null;
+
+                if ($this->user() !== null) {
+                    $existingPlayer = $room->players()
+                        ->where('user_id', $this->user()->id)
+                        ->first();
+                }
+
+                if ($existingPlayer === null && is_numeric($sessionPlayerId)) {
+                    $existingPlayer = $room->players()->find((int) $sessionPlayerId);
+                }
+
                 $nameIsTaken = Player::query()
                     ->where('room_id', $room->id)
                     ->where('name', $this->input('player_name'))
-                    ->where(function ($query): void {
+                    ->when(
-                        $query->whereNull('user_id')
+                        $existingPlayer !== null,
-                            ->orWhere('user_id', '!=', $this->user()->id);
+                        fn ($query) => $query->whereKeyNot($existingPlayer->id),
-                    })
+                    )
                     ->exists();
 
                 if ($nameIsTaken) {
                     $validator->errors()->add(
                         'player_name',
-                        'Dieser Anzeigename ist in dem Raum bereits vorhanden.',
+                        self::PLAYER_NAME_TAKEN_MESSAGE,
                     );
                 }
             },
@@ -101,9 +116,18 @@ class ShowEmbeddedRoomRequest extends FormRequest
 
     protected function failedValidation(Validator $validator): never
     {
+        $message = $validator->errors()->first();
+        $showLoginAction = $this->user() === null
+            && $message === self::PLAYER_NAME_TAKEN_MESSAGE;
+
+        if ($showLoginAction) {
+            $this->session()->put('url.intended', $this->fullUrl());
+        }
+
         throw new HttpResponseException(
             Inertia::render('embedded/Error', [
-                'message' => $validator->errors()->first(),
+                'message' => $message,
+                'showLoginAction' => $showLoginAction,
             ])->toResponse($this)->setStatusCode(422),
         );
     }

app/Http/Resources/CurrentPlayerResource.php

@@ -19,6 +19,7 @@ class CurrentPlayerResource extends JsonResource
 
         return [
             'id' => $player->id,
+            'instance_id' => $player->active_instance_id,
             'name' => $player->name,
             'is_moderator' => $player->is_moderator,
             'current_vote' => $pageData->currentVote,

app/Http/Resources/DashboardRoomResource.php

@@ -18,9 +18,8 @@ class DashboardRoomResource extends JsonResource
             'join_code' => $this->resource->join_code,
             'current_round' => $this->resource->current_round,
             'players_count' => $this->resource->players_count,
-            'active_player_count' => $this->resource->active_player_count,
+            'players' => $this->resource->relationLoaded('players')
-            'players' => $this->resource->relationLoaded('activePlayers')
+                ? $this->resource->players
-                ? $this->resource->activePlayers
                     ->map(fn ($player): array => [
                         'id' => $player->id,
                         'name' => $player->name,

app/Jobs/MarkInactivePlayers.php

@@ -1,22 +0,0 @@
-<?php
-
-namespace App\Jobs;
-
-use App\Models\Player;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Foundation\Queue\Queueable;
-
-class MarkInactivePlayers implements ShouldQueue
-{
-    use Queueable;
-
-    public function handle(): void
-    {
-        Player::query()
-            ->whereNull('inactive_at')
-            ->where('last_seen_at', '<=', now()->subHour())
-            ->update([
-                'inactive_at' => now(),
-            ]);
-    }
-}

app/Jobs/RemoveAbsentPlayers.php

@@ -0,0 +1,111 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Enums\RoomStateChange;
+use App\Events\RoomStateChanged;
+use App\Models\Player;
+use App\Models\Room;
+use App\Services\Rooms\RoomRealtimeStateService;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Queue\Queueable;
+use Illuminate\Support\Facades\DB;
+
+class RemoveAbsentPlayers implements ShouldQueue
+{
+    use Queueable;
+
+    public function handle(RoomRealtimeStateService $realtimeState): void
+    {
+        $cutoff = now()->subHour();
+
+        Player::query()
+            ->where(function ($query) use ($cutoff): void {
+                $query->where('last_seen_at', '<=', $cutoff)
+                    ->orWhere(function ($query) use ($cutoff): void {
+                        $query->whereNull('last_seen_at')
+                            ->where('created_at', '<=', $cutoff);
+                    });
+            })
+            ->select(['id', 'room_id'])
+            ->chunkById(100, function ($players) use ($cutoff, $realtimeState): void {
+                foreach ($players as $player) {
+                    $result = DB::transaction(function () use ($player, $cutoff): ?array {
+                        $room = Room::withTrashed()
+                            ->lockForUpdate()
+                            ->find($player->room_id);
+
+                        if ($room === null) {
+                            return null;
+                        }
+
+                        $currentPlayer = $room->players()
+                            ->lockForUpdate()
+                            ->find($player->id);
+
+                        if ($currentPlayer === null) {
+                            return null;
+                        }
+
+                        $lastActivity = $currentPlayer->last_seen_at ?? $currentPlayer->created_at;
+
+                        if ($lastActivity === null || $lastActivity->greaterThan($cutoff)) {
+                            return null;
+                        }
+
+                        $currentPlayer->delete();
+                        $roomDeleted = false;
+
+                        if ($room->owner_id === null && ! $room->trashed()) {
+                            if (! $room->players()->exists()) {
+                                $room->delete();
+                                $roomDeleted = true;
+                            } elseif (! $room->players()->where('is_moderator', true)->exists()) {
+                                $successor = $room->players()
+                                    ->where(function ($query) use ($cutoff): void {
+                                        $query->where('last_seen_at', '>', $cutoff)
+                                            ->orWhere(function ($query) use ($cutoff): void {
+                                                $query->whereNull('last_seen_at')
+                                                    ->where('created_at', '>', $cutoff);
+                                            });
+                                    })
+                                    ->orderBy('created_at')
+                                    ->orderBy('id')
+                                    ->first();
+
+                                $successor?->update(['is_moderator' => true]);
+                            }
+                        }
+
+                        $room->update([
+                            'state_version' => $room->state_version + 1,
+                        ]);
+
+                        return [$room, $roomDeleted];
+                    });
+
+                    if ($result === null) {
+                        continue;
+                    }
+
+                    [$room, $roomDeleted] = $result;
+
+                    if ($roomDeleted) {
+                        RoomStateChanged::dispatch(
+                            $room->id,
+                            $room->state_version,
+                            RoomStateChange::RoomDeleted,
+                        );
+                    } elseif (! $room->trashed()) {
+                        RoomStateChanged::dispatch(
+                            $room->id,
+                            $room->state_version,
+                            RoomStateChange::PlayerKicked,
+                            $realtimeState->for($room),
+                            $player->id,
+                        );
+                    }
+                }
+            });
+    }
+}

app/Models/Player.php

@@ -2,7 +2,6 @@
 
 namespace App\Models;
 
-use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
@@ -12,10 +11,10 @@ use Illuminate\Support\Carbon;
  * @property int $id
  * @property string $room_id
  * @property int|null $user_id
+ * @property string|null $active_instance_id
  * @property string $name
  * @property bool $is_moderator
  * @property Carbon|null $last_seen_at
- * @property Carbon|null $inactive_at
  * @property Carbon|null $created_at
  * @property Carbon|null $updated_at
  * @property-read Room $room
@@ -25,10 +24,10 @@ class Player extends Model
     protected $fillable = [
         'room_id',
         'user_id',
+        'active_instance_id',
         'name',
         'is_moderator',
         'last_seen_at',
-        'inactive_at',
     ];
 
     protected function casts(): array
@@ -36,7 +35,6 @@ class Player extends Model
         return [
             'is_moderator' => 'boolean',
             'last_seen_at' => 'datetime',
-            'inactive_at' => 'datetime',
         ];
     }
 
@@ -83,14 +81,4 @@ class Player extends Model
             'last_seen_at' => now(),
         ]);
     }
-
-    /**
-     * @param  Builder<Player>  $query
-     * @return Builder<Player>
-     */
-    public function scopeActive(Builder $query): Builder
-    {
-        return $query->whereNull('inactive_at');
-
-    }
 }

app/Models/Room.php

@@ -93,12 +93,6 @@ class Room extends Model
 
     }
 
-    /** @return HasMany<Player, $this> */
-    public function activePlayers(): HasMany
-    {
-        return $this->hasMany(Player::class)->whereNull('inactive_at');
-    }
-
     /** @return BelongsTo<User, $this> */
     public function owner(): BelongsTo
     {

app/Providers/FortifyServiceProvider.php

@@ -51,7 +51,6 @@ class FortifyServiceProvider extends ServiceProvider
         Fortify::loginView(fn (Request $request) => Inertia::render('auth/Login', [
             'canResetPassword' => Features::enabled(Features::resetPasswords()),
             'status' => $request->session()->get('status'),
-            'rememberByDefault' => $request->session()->get('embedded_login', false),
         ]));
 
         Fortify::resetPasswordView(fn (Request $request) => Inertia::render('auth/ResetPassword', [

app/Services/Rooms/DashboardRoomService.php

@@ -16,13 +16,12 @@ class DashboardRoomService
         $ownedRooms = $user
             ->ownedRooms()
             ->with([
-                'activePlayers' => fn ($query) => $query
+                'players' => fn ($query) => $query
                     ->select(['id', 'room_id', 'user_id', 'name', 'is_moderator', 'created_at'])
                     ->orderByDesc('is_moderator')
                     ->orderBy('created_at'),
             ])
             ->withCount('players')
-            ->withCount(['activePlayers as active_player_count'])
             ->orderByRaw('closed_at IS NOT NULL')
             ->orderByDesc('last_activity_at')
             ->get();
@@ -30,7 +29,6 @@ class DashboardRoomService
         $favoriteRooms = $user
             ->favoriteRooms()
             ->withCount('players')
-            ->withCount(['activePlayers as active_player_count'])
             ->orderByRaw('closed_at IS NOT NULL')
             ->orderByDesc('last_activity_at')
             ->get();

app/Services/Rooms/RoomPageService.php

@@ -20,7 +20,6 @@ class RoomPageService
 
         $room->load([
             'players' => fn ($query) => $query
-                ->active()
                 ->select(['id', 'room_id', 'user_id', 'name', 'is_moderator', 'created_at'])
                 ->orderByDesc('is_moderator')
                 ->orderBy('created_at'),

app/Services/Rooms/RoomParticipationService.php

@@ -69,18 +69,19 @@ class RoomParticipationService
                 $user,
                 $sessionPlayerIds[$room->id] ?? null,
             );
+            $shouldModerate = $this->shouldModerate($room, $user);
 
             if ($player === null) {
                 $player = $room->players()->create([
                     'user_id' => $user?->id,
                     'name' => $data['player_name'],
-                    'is_moderator' => false,
+                    'is_moderator' => $shouldModerate,
                     'last_seen_at' => now(),
                 ]);
             } else {
                 $player->update([
                     'last_seen_at' => now(),
-                    'inactive_at' => null,
+                    'is_moderator' => $player->is_moderator || $shouldModerate,
                 ]);
             }
 
@@ -102,9 +103,13 @@ class RoomParticipationService
         return [$room, $player];
     }
 
-    public function joinEmbedded(Room $room, User $user, string $playerName): Player
+    public function joinEmbedded(
-    {
+        Room $room,
-        [$player, $change, $stateVersion] = DB::transaction(function () use ($room, $user, $playerName): array {
+        ?User $user,
+        string $playerName,
+        mixed $sessionPlayerId,
+    ): Player {
+        [$player, $change, $stateVersion] = DB::transaction(function () use ($room, $user, $playerName, $sessionPlayerId): array {
             $lockedRoom = Room::query()
                 ->lockForUpdate()
                 ->findOrFail($room->id);
@@ -115,12 +120,19 @@ class RoomParticipationService
                 ]);
             }
 
+            $player = $this->findExistingEmbeddedPlayer(
+                $lockedRoom,
+                $user,
+                $sessionPlayerId,
+            );
+            $shouldModerate = $this->shouldModerate($lockedRoom, $user);
+
             $nameIsTaken = $lockedRoom->players()
                 ->where('name', $playerName)
-                ->where(function ($query) use ($user): void {
+                ->when(
-                    $query->whereNull('user_id')
+                    $player !== null,
-                        ->orWhere('user_id', '!=', $user->id);
+                    fn ($query) => $query->whereKeyNot($player->id),
-                })
+                )
                 ->exists();
 
             if ($nameIsTaken) {
@@ -129,31 +141,39 @@ class RoomParticipationService
                 ]);
             }
 
-            $player = $lockedRoom->players()
-                ->where('user_id', $user->id)
-                ->first();
             $change = null;
 
             if ($player === null) {
                 $player = $lockedRoom->players()->create([
-                    'user_id' => $user->id,
+                    'user_id' => $user?->id,
                     'name' => $playerName,
-                    'is_moderator' => false,
+                    'is_moderator' => $shouldModerate,
                     'last_seen_at' => now(),
                 ]);
                 $change = RoomStateChange::PlayerJoined;
             } else {
-                if ($player->inactive_at !== null) {
+                if ($player->name !== $playerName || ($shouldModerate && ! $player->is_moderator)) {
-                    $change = RoomStateChange::PlayerJoined;
-                } elseif ($player->name !== $playerName) {
                     $change = RoomStateChange::PlayerUpdated;
                 }
 
-                $player->update([
+                $updates = [
                     'name' => $playerName,
                     'last_seen_at' => now(),
-                    'inactive_at' => null,
+                    'is_moderator' => $player->is_moderator || $shouldModerate,
-                ]);
+                ];
+
+                if (
+                    $user !== null
+                    && $player->user_id === null
+                    && ! $lockedRoom->players()
+                        ->where('user_id', $user->id)
+                        ->whereKeyNot($player->id)
+                        ->exists()
+                ) {
+                    $updates['user_id'] = $user->id;
+                }
+
+                $player->update($updates);
             }
 
             if ($change === null) {
@@ -180,28 +200,132 @@ class RoomParticipationService
         return $player;
     }
 
-    public function kick(Room $room, Player $player, User $user): void
+    private function shouldModerate(Room $room, ?User $user): bool
     {
-        $stateVersion = DB::transaction(function () use ($room, $player, $user): ?int {
+        if ($user !== null && $room->owner_id === $user->id) {
+            return true;
+        }
+
+        return $room->owner_id === null
+            && ! $room->players()->where('is_moderator', true)->exists();
+    }
+
+    private function findExistingEmbeddedPlayer(
+        Room $room,
+        ?User $user,
+        mixed $sessionPlayerId,
+    ): ?Player {
+        if ($user !== null) {
+            $userPlayer = $room->players()
+                ->where('user_id', $user->id)
+                ->lockForUpdate()
+                ->first();
+
+            if ($userPlayer !== null) {
+                return $userPlayer;
+            }
+        }
+
+        if (is_numeric($sessionPlayerId)) {
+            $sessionPlayer = $room->players()
+                ->whereKey((int) $sessionPlayerId)
+                ->lockForUpdate()
+                ->first();
+
+            if (
+                $sessionPlayer !== null
+                && ($user === null || $sessionPlayer->user_id === null || $sessionPlayer->user_id === $user->id)
+            ) {
+                return $sessionPlayer;
+            }
+        }
+
+        return null;
+    }
+
+    public function activateInstance(Room $room, Player $player, string $instanceId): Player
+    {
+        [$activePlayer, $replacedInstanceId, $stateVersion] = DB::transaction(function () use ($room, $player, $instanceId): array {
+            $lockedRoom = Room::query()
+                ->lockForUpdate()
+                ->findOrFail($room->id);
+            $lockedPlayer = $lockedRoom->players()
+                ->lockForUpdate()
+                ->findOrFail($player->id);
+
+            if ($lockedPlayer->active_instance_id === $instanceId) {
+                return [$lockedPlayer, null, null];
+            }
+
+            $replacedInstanceId = $lockedPlayer->active_instance_id;
+            $lockedPlayer->update([
+                'active_instance_id' => $instanceId,
+                'last_seen_at' => now(),
+            ]);
+
+            if ($replacedInstanceId === null) {
+                return [$lockedPlayer, null, null];
+            }
+
+            $lockedRoom->update([
+                'last_activity_at' => now(),
+                'state_version' => $lockedRoom->state_version + 1,
+            ]);
+
+            return [$lockedPlayer, $replacedInstanceId, $lockedRoom->state_version];
+        });
+
+        if (is_string($replacedInstanceId) && is_int($stateVersion)) {
+            RoomStateChanged::dispatch(
+                $room->id,
+                $stateVersion,
+                RoomStateChange::PlayerInstanceReplaced,
+                $this->realtimeState->for($room),
+                $activePlayer->id,
+                $replacedInstanceId,
+            );
+        }
+
+        return $activePlayer;
+    }
+
+    public function kick(
+        Room $room,
+        Player $player,
+        ?User $user,
+        ?Player $currentPlayer,
+    ): void {
+        $stateVersion = DB::transaction(function () use ($room, $player, $user, $currentPlayer): int {
             $lockedRoom = Room::query()
                 ->lockForUpdate()
                 ->findOrFail($room->id);
 
-            abort_unless($lockedRoom->owner_id === $user->id, 403);
+            $lockedCurrentPlayer = $currentPlayer === null
+                ? null
+                : $lockedRoom->players()
+                    ->lockForUpdate()
+                    ->find($currentPlayer->id);
+            $isOwner = $user !== null && $lockedRoom->owner_id === $user->id;
+            $participantCanManage = ! $lockedRoom->isClosed()
+                && $lockedCurrentPlayer !== null
+                && ($lockedCurrentPlayer->is_moderator
+                    || $lockedRoom->allow_participants_to_manage_rounds);
+
+            abort_unless($isOwner || $participantCanManage, 403);
 
             $lockedPlayer = $lockedRoom->players()
                 ->lockForUpdate()
                 ->findOrFail($player->id);
 
-            abort_if($lockedPlayer->user_id === $lockedRoom->owner_id, 403);
+            abort_if(
+                $lockedPlayer->is_moderator
+                || ($lockedRoom->owner_id !== null
+                    && $lockedPlayer->user_id === $lockedRoom->owner_id)
+                || $lockedCurrentPlayer?->id === $lockedPlayer->id,
+                403,
+            );
 
-            if ($lockedPlayer->inactive_at !== null) {
+            $lockedPlayer->delete();
-                return null;
-            }
-
-            $lockedPlayer->update([
-                'inactive_at' => now(),
-            ]);
             $lockedRoom->update([
                 'last_activity_at' => now(),
                 'state_version' => $lockedRoom->state_version + 1,
@@ -210,10 +334,6 @@ class RoomParticipationService
             return $lockedRoom->state_version;
         });
 
-        if ($stateVersion === null) {
-            return;
-        }
-
         RoomStateChanged::dispatch(
             $room->id,
             $stateVersion,

app/Services/Rooms/RoomPlayerInstanceService.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Services\Rooms;
+
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+
+class RoomPlayerInstanceService
+{
+    private const string SESSION_KEY = 'room_player_instance_id';
+
+    public function for(Request $request): string
+    {
+        $instanceId = $request->session()->get(self::SESSION_KEY);
+
+        if (is_string($instanceId) && Str::isUuid($instanceId)) {
+            return $instanceId;
+        }
+
+        $instanceId = (string) Str::uuid();
+        $request->session()->put(self::SESSION_KEY, $instanceId);
+
+        return $instanceId;
+    }
+}

app/Services/Rooms/RoomRealtimeStateService.php

@@ -32,7 +32,6 @@ class RoomRealtimeStateService
         $room->refresh();
         $room->load([
             'players' => fn ($query) => $query
-                ->active()
                 ->select(['id', 'room_id', 'user_id', 'name', 'is_moderator', 'created_at'])
                 ->orderByDesc('is_moderator')
                 ->orderBy('created_at'),

bootstrap/app.php

@@ -18,13 +18,6 @@ return Application::configure(basePath: dirname(__DIR__))
     )
     ->withMiddleware(function (Middleware $middleware): void {
         $middleware->trustProxies(at: '*');
-        $middleware->redirectGuestsTo(function (Request $request): string {
-            if ($request->isMethod('GET') && $request->is('embedded/scrum-poker')) {
-                $request->session()->put('embedded_login', true);
-            }
-
-            return route('login');
-        });
         $middleware->encryptCookies(except: ['appearance', 'sidebar_state']);
         $middleware->alias([
             'room.player' => EnsureRoomParticipant::class,

database/migrations/2026_09_03_142925_add_active_instance_id_to_players_table.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('players', function (Blueprint $table) {
+            $table->uuid('active_instance_id')->nullable()->after('user_id');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('players', function (Blueprint $table) {
+            $table->dropColumn('active_instance_id');
+        });
+    }
+};

database/migrations/2026_09_24_123048_remove_previously_inactive_players.php

@@ -0,0 +1,42 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        $cutoff = now()->subHour();
+
+        DB::table('players')
+            ->where(function ($query) use ($cutoff): void {
+                $query->whereNotNull('inactive_at')
+                    ->orWhere('last_seen_at', '<=', $cutoff)
+                    ->orWhere(function ($query) use ($cutoff): void {
+                        $query->whereNull('last_seen_at')
+                            ->where('created_at', '<=', $cutoff);
+                    });
+            })
+            ->delete();
+
+        Schema::table('players', function (Blueprint $table): void {
+            $table->dropColumn('inactive_at');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('players', function (Blueprint $table): void {
+            $table->timestamp('inactive_at')->nullable()->after('last_seen_at');
+        });
+    }
+};

database/migrations/2026_09_24_125529_reconcile_guest_rooms_after_player_cleanup.php

@@ -0,0 +1,48 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        DB::table('rooms')
+            ->whereNull('owner_id')
+            ->whereNull('deleted_at')
+            ->whereNotIn('id', DB::table('players')->select('room_id'))
+            ->update(['deleted_at' => now()]);
+
+        DB::table('rooms')
+            ->whereNull('owner_id')
+            ->whereNull('deleted_at')
+            ->whereNotIn('id', DB::table('players')->where('is_moderator', true)->select('room_id'))
+            ->select('id')
+            ->chunkById(100, function ($rooms): void {
+                foreach ($rooms as $room) {
+                    $playerId = DB::table('players')
+                        ->where('room_id', $room->id)
+                        ->orderBy('created_at')
+                        ->orderBy('id')
+                        ->value('id');
+
+                    if ($playerId !== null) {
+                        DB::table('players')
+                            ->where('id', $playerId)
+                            ->update(['is_moderator' => true]);
+                    }
+                }
+            });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        // Deleted rooms and former moderator assignments cannot be reconstructed.
+    }
+};

docker/nginx/nginx.conf.template

@@ -38,6 +38,8 @@ http {
 
         location = /index.php {
             include /etc/nginx/fastcgi_params;
+            fastcgi_buffer_size 32k;
+            fastcgi_buffers 8 32k;
             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
             fastcgi_param HTTP_PROXY '';
             fastcgi_param HTTP_X_FORWARDED_FOR $http_x_forwarded_for;

package-lock.json

@@ -4,6 +4,7 @@
     "requires": true,
     "packages": {
         "": {
+            "name": "scrum-poker-internal",
             "dependencies": {
                 "@inertiajs/vite": "^3.0.0",
                 "@inertiajs/vue3": "^3.0.0",
@@ -4959,9 +4960,9 @@
             }
         },
         "node_modules/js-yaml": {
-            "version": "4.3.1",
+            "version": "4.3.2",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
-            "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+            "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
             "dev": true,
             "funding": [
                 {

resources/js/components/dashboard/DashboardRoomCard.vue

@@ -47,8 +47,7 @@ function formatDate(value: string | null): string {
         <div class="mt-5 grid grid-cols-2 gap-3 text-sm text-muted-foreground">
             <span class="inline-flex items-center gap-2">
                 <Users class="size-4" />
-                {{ room.players_count }} Spieler /
+                {{ room.players_count }} Spieler
-                {{ room.active_player_count }} aktiv
             </span>
             <span>Runde {{ room.current_round }}</span>
             <span class="col-span-2 inline-flex items-center gap-2">

resources/js/components/rooms/RoomExperience.vue

@@ -16,6 +16,7 @@ const props = withDefaults(defineProps<RoomExperienceProps>(), {
 const page = usePage();
 const presenterMode = ref(false);
 const roomNotice = computed(() => page.props.roomNotice);
+const isAuthenticated = computed(() => page.props.auth.user !== null);
 const embeddedBackgroundColor = computed(() => {
     if (!props.embedded) {
         return undefined;
@@ -67,8 +68,14 @@ const {
             :title="realtimeRoom.title"
             :join_code="realtimeRoom.join_code"
             :is_favorite="realtimeRoom.is_favorite"
+            :players="realtimeRoom.players"
             :can-favorite="canFavorite"
-            :embedded="embedded"
+            :can-manage-participants="
+                realtimeCurrentPlayer.is_moderator ||
+                realtimeRoom.allow_participants_to_manage_rounds
+            "
+            :current-player-id="realtimeCurrentPlayer.id"
+            :can-logout="embedded && isAuthenticated"
             :player-name="realtimeCurrentPlayer.name"
             v-model:presenter-mode="presenterMode"
         />

resources/js/components/rooms/RoomHeader.vue

@@ -1,17 +1,65 @@
 <script setup lang="ts">
-import { Link } from '@inertiajs/vue3';
+import { Link, useForm } from '@inertiajs/vue3';
-import { Check, Copy, LogOut } from '@lucide/vue';
+import { Check, Copy, LogOut, Settings, UserMinus, Users } from '@lucide/vue';
 import { ref } from 'vue';
 
 import { Checkbox } from '@/components/ui/checkbox';
+import {
+    Dialog,
+    DialogContent,
+    DialogDescription,
+    DialogFooter,
+    DialogHeader,
+    DialogTitle,
+} from '@/components/ui/dialog';
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuItem,
+    DropdownMenuLabel,
+    DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
 import { logout as embeddedLogout } from '@/routes/embedded';
 import { favorite } from '@/routes/room';
-import type { RoomHeaderEmits, RoomHeaderProps } from '@/types/room';
+import { destroy as kickRoomPlayer } from '@/routes/room/player';
+import type {
+    RoomHeaderEmits,
+    RoomHeaderProps,
+    RoomPlayer,
+} from '@/types/room';
 
 const props = defineProps<RoomHeaderProps>();
 const emit = defineEmits<RoomHeaderEmits>();
 
 const copied = ref(false);
+const participantsDialogOpen = ref(false);
+const selectedPlayer = ref<RoomPlayer | null>(null);
+const kickForm = useForm({});
+
+function kickPlayer(): void {
+    if (selectedPlayer.value === null || kickForm.processing) {
+        return;
+    }
+
+    kickForm.delete(
+        kickRoomPlayer({
+            room: props.id,
+            player: selectedPlayer.value.id,
+        }).url,
+        {
+            preserveScroll: true,
+            onSuccess: () => {
+                selectedPlayer.value = null;
+            },
+        },
+    );
+}
+
+function setKickDialogOpen(open: boolean): void {
+    if (!open && !kickForm.processing) {
+        selectedPlayer.value = null;
+    }
+}
 
 async function copyInviteLink(): Promise<void> {
     const inviteUrl = new URL('/room/join', window.location.origin);
@@ -26,79 +74,225 @@ async function copyInviteLink(): Promise<void> {
 </script>
 
 <template>
-    <header
+    <div class="contents">
-        class="mx-auto flex w-full max-w-6xl flex-col gap-4 sm:flex-row sm:items-center sm:justify-between"
+        <header
-    >
+            class="mx-auto flex w-full max-w-6xl flex-col gap-4 sm:flex-row sm:items-center sm:justify-between"
-        <div>
+        >
-            <h1 class="text-2xl font-bold sm:text-3xl">
+            <div>
-                {{ title ?? 'Scrum Poker' }}
+                <h1 class="text-2xl font-bold sm:text-3xl">
-            </h1>
+                    {{ title ?? 'Scrum Poker' }}
+                </h1>
 
-            <Link
+                <Link
-                v-if="canFavorite"
+                    v-if="canFavorite"
-                :href="favorite(id)"
+                    :href="favorite(id)"
-                method="post"
+                    method="post"
-                as="button"
+                    as="button"
-                class="mt-2 inline-flex items-center gap-2"
+                    class="mt-2 inline-flex items-center gap-2"
-            >
+                >
-                <span>Favorit</span>
+                    <span>Favorit</span>
-                <span class="material-icons" aria-hidden="true">
+                    <span class="material-icons" aria-hidden="true">
-                    {{ is_favorite ? 'favorite' : 'favorite_border' }}
+                        {{ is_favorite ? 'favorite' : 'favorite_border' }}
-                </span>
-            </Link>
-        </div>
-
-        <div class="flex flex-col items-end gap-2">
-            <Link
-                v-if="embedded"
-                :href="
-                    embeddedLogout({
-                        query: {
-                            join_code,
-                            player_name: playerName,
-                        },
-                    })
-                "
-                method="post"
-                as="button"
-                class="inline-flex items-center gap-2 text-sm text-slate-300 transition hover:text-white"
-            >
-                <LogOut class="size-4" />
-                Abmelden
-            </Link>
-
-            <button
-                type="button"
-                class="flex w-fit items-center gap-3 rounded-xl border border-slate-700 bg-slate-800 px-4 py-2.5 text-left transition hover:bg-slate-700 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-cyan-300"
-                @click="copyInviteLink"
-            >
-                <span>
-                    <span
-                        class="block text-sm tracking-[0.18em] text-slate-400"
-                    >
-                        Raumcode
                     </span>
-                    <strong class="font-mono text-lg tracking-[0.2em]">
+                </Link>
-                        {{ join_code }}
+            </div>
-                    </strong>
-                </span>
-                <Check v-if="copied" class="size-5 text-emerald-300" />
-                <Copy v-else class="size-5 text-slate-300" />
-            </button>
 
-            <label
+            <div class="flex flex-col items-end gap-2">
-                for="presenter-mode"
+                <Link
-                class="flex cursor-pointer items-center gap-2 text-sm text-slate-300"
+                    v-if="canLogout"
-            >
+                    :href="
-                <Checkbox
+                        embeddedLogout({
-                    id="presenter-mode"
+                            query: {
-                    :model-value="presenterMode"
+                                join_code,
-                    @update:model-value="
+                                player_name: playerName,
-                        emit('update:presenterMode', $event === true)
+                            },
+                        })
                     "
-                />
+                    method="post"
-                <span>Präsentatormodus</span>
+                    as="button"
-            </label>
+                    class="inline-flex items-center gap-2 text-sm text-slate-300 transition hover:text-white"
-        </div>
+                >
-    </header>
+                    <LogOut class="size-4" />
+                    Abmelden
+                </Link>
+
+                <div class="flex items-center gap-2">
+                    <DropdownMenu v-if="canManageParticipants">
+                        <DropdownMenuTrigger :as-child="true">
+                            <button
+                                type="button"
+                                class="inline-flex size-11 items-center justify-center rounded-xl border border-slate-700 bg-slate-800 text-slate-300 transition hover:bg-slate-700 hover:text-white focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-cyan-300"
+                                aria-label="Raumeinstellungen öffnen"
+                            >
+                                <Settings class="size-5" />
+                            </button>
+                        </DropdownMenuTrigger>
+                        <DropdownMenuContent
+                            align="end"
+                            class="w-52 border-slate-700 bg-slate-800 text-slate-100"
+                        >
+                            <DropdownMenuLabel class="text-slate-400">
+                                Einstellungen
+                            </DropdownMenuLabel>
+                            <DropdownMenuItem
+                                class="focus:bg-slate-700 focus:text-white"
+                                @select="participantsDialogOpen = true"
+                            >
+                                <Users class="size-4" />
+                                Teilnehmer
+                            </DropdownMenuItem>
+                        </DropdownMenuContent>
+                    </DropdownMenu>
+
+                    <button
+                        type="button"
+                        class="flex w-fit items-center gap-3 rounded-xl border border-slate-700 bg-slate-800 px-4 py-2.5 text-left transition hover:bg-slate-700 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-cyan-300"
+                        @click="copyInviteLink"
+                    >
+                        <span>
+                            <span
+                                class="block text-sm tracking-[0.18em] text-slate-400"
+                            >
+                                Raumcode
+                            </span>
+                            <strong class="font-mono text-lg tracking-[0.2em]">
+                                {{ join_code }}
+                            </strong>
+                        </span>
+                        <Check v-if="copied" class="size-5 text-emerald-300" />
+                        <Copy v-else class="size-5 text-slate-300" />
+                    </button>
+                </div>
+
+                <label
+                    for="presenter-mode"
+                    class="flex cursor-pointer items-center gap-2 text-sm text-slate-300"
+                >
+                    <Checkbox
+                        id="presenter-mode"
+                        :model-value="presenterMode"
+                        @update:model-value="
+                            emit('update:presenterMode', $event === true)
+                        "
+                    />
+                    <span>Präsentatormodus</span>
+                </label>
+            </div>
+        </header>
+
+        <Dialog v-model:open="participantsDialogOpen">
+            <DialogContent
+                class="max-h-[calc(100dvh-2rem)] overflow-hidden border-slate-700 bg-slate-800 text-slate-100 sm:max-w-xl"
+                overlay-class="bg-black/70 backdrop-blur-sm"
+            >
+                <DialogHeader>
+                    <DialogTitle>Teilnehmer</DialogTitle>
+                    <DialogDescription class="text-slate-300">
+                        Verwalte die aktiven Teilnehmer in diesem Raum.
+                    </DialogDescription>
+                </DialogHeader>
+
+                <ul
+                    v-if="players.length > 0"
+                    class="flex max-h-[min(60dvh,32rem)] flex-col gap-2 overflow-y-auto pr-1"
+                >
+                    <li
+                        v-for="player in players"
+                        :key="player.id"
+                        class="flex items-center justify-between gap-3 rounded-md bg-slate-900/60 px-3 py-2"
+                    >
+                        <span class="min-w-0">
+                            <span
+                                class="block truncate text-sm"
+                                :class="
+                                    player.is_moderator
+                                        ? 'text-amber-300'
+                                        : 'text-slate-100'
+                                "
+                            >
+                                {{ player.name }}
+                            </span>
+                        </span>
+
+                        <span
+                            v-if="
+                                player.id === currentPlayerId ||
+                                player.is_moderator
+                            "
+                            class="shrink-0 text-xs text-slate-400"
+                        >
+                            {{
+                                player.id === currentPlayerId
+                                    ? player.is_moderator
+                                        ? 'Du · Admin'
+                                        : 'Du'
+                                    : 'Admin'
+                            }}
+                        </span>
+                        <button
+                            v-else
+                            type="button"
+                            class="inline-flex shrink-0 items-center gap-1.5 rounded-md px-2.5 py-1.5 text-xs font-semibold text-rose-300 transition hover:bg-rose-500/20 hover:text-rose-200"
+                            @click="selectedPlayer = player"
+                        >
+                            <UserMinus class="size-3.5" />
+                            Kicken
+                        </button>
+                    </li>
+                </ul>
+
+                <p v-else class="text-sm text-slate-400">
+                    Aktuell sind keine Teilnehmer im Raum.
+                </p>
+
+                <DialogFooter>
+                    <button
+                        type="button"
+                        class="rounded-md border border-slate-600 px-4 py-2 text-sm font-semibold text-slate-200 transition hover:bg-slate-700"
+                        @click="participantsDialogOpen = false"
+                    >
+                        Schließen
+                    </button>
+                </DialogFooter>
+            </DialogContent>
+        </Dialog>
+
+        <Dialog
+            :open="selectedPlayer !== null"
+            @update:open="setKickDialogOpen"
+        >
+            <DialogContent
+                class="border-slate-700 bg-slate-800 text-slate-100 sm:max-w-md"
+                overlay-class="bg-black/70 backdrop-blur-sm"
+            >
+                <DialogHeader>
+                    <DialogTitle>Teilnehmer wirklich kicken?</DialogTitle>
+                    <DialogDescription class="text-slate-300">
+                        {{ selectedPlayer?.name }} wird aus „{{
+                            title ?? 'Scrum Poker'
+                        }}“ entfernt und zur Startseite weitergeleitet.
+                    </DialogDescription>
+                </DialogHeader>
+
+                <DialogFooter class="gap-6 space-x-4 sm:gap-0">
+                    <button
+                        type="button"
+                        class="rounded-md border border-slate-600 px-4 py-2 text-sm font-semibold text-slate-200 transition hover:bg-slate-700"
+                        :disabled="kickForm.processing"
+                        @click="selectedPlayer = null"
+                    >
+                        Abbrechen
+                    </button>
+                    <button
+                        type="button"
+                        class="rounded-md bg-rose-600 px-4 py-2 text-sm font-semibold text-white transition hover:bg-rose-500 disabled:opacity-50"
+                        :disabled="kickForm.processing"
+                        @click="kickPlayer"
+                    >
+                        {{ kickForm.processing ? 'Wird entfernt …' : 'Kicken' }}
+                    </button>
+                </DialogFooter>
+            </DialogContent>
+        </Dialog>
+    </div>
 </template>

resources/js/components/ui/dialog/DialogContent.vue

@@ -16,19 +16,26 @@ defineOptions({
   inheritAttrs: false,
 })
 
-const props = withDefaults(defineProps<DialogContentProps & { class?: HTMLAttributes["class"], showCloseButton?: boolean }>(), {
+const props = withDefaults(
-  showCloseButton: true,
+  defineProps<DialogContentProps & {
-})
+    class?: HTMLAttributes["class"]
+    overlayClass?: HTMLAttributes["class"]
+    showCloseButton?: boolean
+  }>(),
+  {
+    showCloseButton: true,
+  },
+)
 const emits = defineEmits<DialogContentEmits>()
 
-const delegatedProps = reactiveOmit(props, "class")
+const delegatedProps = reactiveOmit(props, "class", "overlayClass", "showCloseButton")
 
 const forwarded = useForwardPropsEmits(delegatedProps, emits)
 </script>
 
 <template>
   <DialogPortal>
-    <DialogOverlay />
+    <DialogOverlay :class="props.overlayClass" />
     <DialogContent
       data-slot="dialog-content"
       v-bind="{ ...$attrs, ...forwarded }"

resources/js/composables/useRoomRealtime.ts

@@ -42,6 +42,16 @@ export function useRoomRealtime(
             return;
         }
 
+        if (
+            payload.change === 'player_instance_replaced' &&
+            payload.affected_player_id === currentPlayer.value.id &&
+            payload.affected_instance_id === currentPlayer.value.instance_id
+        ) {
+            router.visit(home().url, { replace: true });
+
+            return;
+        }
+
         if (payload.change === 'room_closed') {
             router.visit(
                 join({ query: { join_code: room.value.join_code } }).url,
@@ -60,6 +70,17 @@ export function useRoomRealtime(
             ...payload.state,
         };
 
+        const currentRoomPlayer = room.value.players.find(
+            (player) => player.id === currentPlayer.value.id,
+        );
+
+        if (currentRoomPlayer !== undefined) {
+            currentPlayer.value = {
+                ...currentPlayer.value,
+                is_moderator: currentRoomPlayer.is_moderator,
+            };
+        }
+
         if (
             payload.change === 'votes_reset' ||
             payload.change === 'next_round'

resources/js/pages/auth/Login.vue

@@ -23,7 +23,6 @@ defineOptions({
 defineProps<{
     status?: string;
     canResetPassword: boolean;
-    rememberByDefault: boolean;
 }>();
 </script>
 
@@ -86,12 +85,7 @@ defineProps<{
 
             <div class="flex items-center justify-between">
                 <Label for="remember" class="flex items-center space-x-3">
-                    <Checkbox
+                    <Checkbox id="remember" name="remember" :tabindex="3" />
-                        id="remember"
-                        name="remember"
-                        :default-value="rememberByDefault"
-                        :tabindex="3"
-                    />
                     <span>Remember me</span>
                 </Label>
             </div>

resources/js/pages/embedded/Error.vue

@@ -1,9 +1,12 @@
 <script setup lang="ts">
-import { Head } from '@inertiajs/vue3';
+import { Head, Link } from '@inertiajs/vue3';
 import { CircleAlert } from '@lucide/vue';
 
+import { login } from '@/routes';
+
 defineProps<{
     message: string;
+    showLoginAction: boolean;
 }>();
 </script>
 
@@ -19,6 +22,13 @@ defineProps<{
             <CircleAlert class="size-10 text-amber-300" />
             <h1 class="text-2xl font-bold">Raum kann nicht geöffnet werden</h1>
             <p class="text-slate-300">{{ message }}</p>
+            <Link
+                v-if="showLoginAction"
+                :href="login()"
+                class="inline-flex rounded-lg bg-white px-4 py-2 font-semibold text-slate-900 transition hover:bg-slate-200 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-white"
+            >
+                Anmelden
+            </Link>
             <p class="text-sm text-slate-400">
                 Bitte ändere Raumcode oder Anzeigename auf der Home-Seite der
                 Fillibri Hub App und öffne Scrum Poker erneut.

resources/js/pages/rooms/Settings.vue

@@ -48,9 +48,10 @@ function submit(): void {
                 class="flex flex-col gap-6 rounded-xl border border-slate-700 bg-slate-800 p-6"
                 @submit.prevent="submit"
             >
-                <label class="flex cursor-pointer items-start gap-4">
+                <label class="flex cursor-pointer items-center gap-4">
                     <Checkbox
                         :model-value="form.allow_participants_to_manage_rounds"
+                        class="border-white"
                         @update:model-value="
                             form.allow_participants_to_manage_rounds =
                                 $event === true
@@ -58,12 +59,12 @@ function submit(): void {
                     />
                     <span>
                         <strong class="block"
-                            >Alle dürfen Runden steuern</strong
+                            >Alle dürfen den Raum verwalten</strong
                         >
                         <span class="mt-1 block text-sm text-slate-400">
-                            Alle aktiven Teilnehmer, auch Gäste, dürfen Karten
+                            Alle aktiven Teilnehmer, auch Gäste, dürfen Runden
-                            aufdecken, Votes zurücksetzen und die nächste Runde
+                            steuern und andere Teilnehmer aus dem Raum
-                            starten.
+                            entfernen.
                         </span>
                     </span>
                 </label>
@@ -71,9 +72,10 @@ function submit(): void {
                     :message="form.errors.allow_participants_to_manage_rounds"
                 />
 
-                <label class="flex cursor-pointer items-start gap-4">
+                <label class="flex cursor-pointer items-center gap-4">
                     <Checkbox
                         :model-value="form.is_persistent"
+                        class="border-white"
                         @update:model-value="
                             form.is_persistent = $event === true
                         "

resources/js/types/dashboard.ts

@@ -11,7 +11,6 @@ export type DashboardRoom = {
     join_code: string;
     current_round: number;
     players_count: number;
-    active_player_count: number;
     players: DashboardRoomPlayer[];
     last_activity_at: string | null;
     closed_at: string | null;

resources/js/types/room.ts

@@ -30,6 +30,7 @@ export type RoomPlayer = {
 
 export type CurrentRoomPlayer = {
     id: number;
+    instance_id: string;
     name: string;
     is_moderator: boolean;
     current_vote: string | null;
@@ -110,11 +111,13 @@ export type RoomRetentionNoticeProps = {
 
 export type RoomHeaderProps = Pick<
     PokerRoom,
-    'id' | 'title' | 'join_code' | 'is_favorite'
+    'id' | 'title' | 'join_code' | 'is_favorite' | 'players'
 > & {
     canFavorite: boolean;
+    canManageParticipants: boolean;
+    currentPlayerId: number;
     presenterMode: boolean;
-    embedded: boolean;
+    canLogout: boolean;
     playerName: string;
 };
 
@@ -161,6 +164,7 @@ export type RoomStateChange =
     | 'player_joined'
     | 'player_updated'
     | 'player_kicked'
+    | 'player_instance_replaced'
     | 'vote_changed'
     | 'cards_revealed'
     | 'votes_reset'
@@ -175,6 +179,7 @@ export type RoomStateChangedPayload = {
     change: RoomStateChange;
     state: RoomRealtimeState | null;
     affected_player_id?: number;
+    affected_instance_id?: string;
 };
 
 export type RoomRealtimeState = Pick<

routes/console.php

@@ -1,7 +1,7 @@
 <?php
 
 use App\Jobs\CloseInactiveRooms;
-use App\Jobs\MarkInactivePlayers;
+use App\Jobs\RemoveAbsentPlayers;
 use Illuminate\Foundation\DevCommands;
 use Illuminate\Support\Facades\Schedule;
 
@@ -11,6 +11,6 @@ Schedule::job(new CloseInactiveRooms)
     ->weeklyOn(1, '02:00')
     ->withoutOverlapping();
 
-Schedule::job(new MarkInactivePlayers)
+Schedule::job(new RemoveAbsentPlayers)
     ->everyFiveMinutes()
     ->withoutOverlapping();

routes/room.php

@@ -25,10 +25,8 @@ Route::get('/room/join', RoomJoinController::class)->name('room.join');
 Route::post('room/join', [RoomPlayerController::class, 'join'])->name('room.code');
 Route::post('/room', [RoomController::class, 'store'])->name('room.store');
 
-Route::middleware(['auth', 'verified'])->group(function () {
+Route::get('/embedded/scrum-poker', EmbeddedRoomController::class)
-    Route::get('/embedded/scrum-poker', EmbeddedRoomController::class)
+    ->name('embedded.room');
-        ->name('embedded.room');
-});
 
 Route::post('/embedded/scrum-poker/logout', EmbeddedLogoutController::class)
     ->middleware('auth')
@@ -45,10 +43,11 @@ Route::middleware(['auth', 'verified'])->group(function () {
         ->name('room.destroy');
     Route::post('/rooms/{room}/favorite', FavoriteRoomController::class)
         ->name('room.favorite');
-    Route::delete('/rooms/{room}/players/{player}', RoomPlayerKickController::class)
-        ->name('room.player.destroy');
 });
 
+Route::delete('/rooms/{room}/players/{player}', RoomPlayerKickController::class)
+    ->name('room.player.destroy');
+
 Route::middleware('room.player')->group(function () {
     Route::get('/rooms/{room}', [RoomController::class, 'show'])->name('room.show');
     Route::post('/rooms/{room}/votes', [VoteController::class, 'store'])

tests/Feature/AbsentPlayerRemovalTest.php

@@ -0,0 +1,184 @@
+<?php
+
+use App\Enums\RoomStateChange;
+use App\Events\RoomStateChanged;
+use App\Jobs\RemoveAbsentPlayers;
+use App\Models\Room;
+use App\Models\User;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Schema;
+
+test('the player table no longer stores an inactive status', function () {
+    expect(Schema::hasColumn('players', 'inactive_at'))->toBeFalse();
+});
+
+test('migrations remove absent players and reconcile guest rooms', function () {
+    Schema::table('players', function (Blueprint $table): void {
+        $table->timestamp('inactive_at')->nullable();
+    });
+
+    $room = Room::create([
+        'title' => 'Planning',
+        'deck_config' => ['name' => 'Fibonacci', 'cards' => []],
+    ]);
+    $previouslyInactive = $room->players()->create([
+        'name' => 'Inactive',
+        'last_seen_at' => now(),
+    ]);
+    $absent = $room->players()->create([
+        'name' => 'Nico',
+        'last_seen_at' => now()->subHours(2),
+    ]);
+    $present = $room->players()->create([
+        'name' => 'Anna',
+        'last_seen_at' => now(),
+    ]);
+    $emptyGuestRoom = Room::create([
+        'title' => 'Empty guest room',
+        'deck_config' => ['name' => 'Fibonacci', 'cards' => []],
+    ]);
+    $owner = User::factory()->create();
+    $emptyAccountRoom = Room::create([
+        'owner_id' => $owner->id,
+        'is_persistent' => true,
+        'title' => 'Persistent account room',
+        'deck_config' => ['name' => 'Fibonacci', 'cards' => []],
+    ]);
+
+    DB::table('players')->where('id', $previouslyInactive->id)->update(['inactive_at' => now()]);
+
+    $migration = require database_path('migrations/2026_09_24_123048_remove_previously_inactive_players.php');
+    $migration->up();
+    $guestRoomMigration = require database_path('migrations/2026_09_24_125529_reconcile_guest_rooms_after_player_cleanup.php');
+    $guestRoomMigration->up();
+
+    $this->assertModelMissing($previouslyInactive);
+    $this->assertModelMissing($absent);
+    $this->assertModelExists($present);
+    $this->assertSoftDeleted($emptyGuestRoom);
+    $this->assertModelExists($emptyAccountRoom);
+    expect($present->fresh()->is_moderator)->toBeTrue();
+    expect(Schema::hasColumn('players', 'inactive_at'))->toBeFalse();
+});
+
+test('the timeout removes absent players and their votes but keeps recent players', function () {
+    $room = Room::create([
+        'title' => 'Planning',
+        'current_round' => 1,
+        'deck_config' => ['name' => 'Fibonacci', 'cards' => []],
+    ]);
+    $absentPlayer = $room->players()->create([
+        'name' => 'Nico',
+        'is_moderator' => true,
+        'last_seen_at' => now()->subHour(),
+    ]);
+    $recentPlayer = $room->players()->create([
+        'name' => 'Anna',
+        'last_seen_at' => now()->subHour()->addSecond(),
+    ]);
+    $vote = $absentPlayer->votes()->create([
+        'room_id' => $room->id,
+        'round' => $room->current_round,
+        'value' => '3',
+    ]);
+    $previousVersion = $room->fresh()->state_version;
+
+    Event::fake([RoomStateChanged::class]);
+
+    app()->call([new RemoveAbsentPlayers, 'handle']);
+    app()->call([new RemoveAbsentPlayers, 'handle']);
+
+    $this->assertModelMissing($absentPlayer);
+    $this->assertModelMissing($vote);
+    $this->assertModelExists($recentPlayer);
+    expect($room->fresh()->state_version)->toBe($previousVersion + 1);
+    expect($recentPlayer->fresh()->is_moderator)->toBeTrue();
+
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        fn (RoomStateChanged $event): bool => $event->change === RoomStateChange::PlayerKicked
+            && $event->affectedPlayerId === $absentPlayer->id
+            && collect($event->state['players'])->doesntContain('id', $absentPlayer->id)
+            && collect($event->state['players'])->firstWhere('id', $recentPlayer->id)['is_moderator'] === true,
+    );
+    Event::assertDispatchedTimes(RoomStateChanged::class, 1);
+
+    $this->post(route('room.code'), [
+        'join_code' => $room->join_code,
+        'player_name' => 'Nico',
+    ])->assertRedirect(route('room.show', $room));
+
+    expect($room->players()->where('name', 'Nico')->sole()->id)->not->toBe($absentPlayer->id);
+});
+
+test('the timeout deletes a guest room when its last player is removed', function () {
+    $room = Room::create([
+        'title' => 'Guest planning',
+        'deck_config' => ['name' => 'Fibonacci', 'cards' => []],
+    ]);
+    $moderator = $room->players()->create([
+        'name' => 'Nico',
+        'is_moderator' => true,
+        'last_seen_at' => now()->subHour(),
+    ]);
+
+    Event::fake([RoomStateChanged::class]);
+
+    app()->call([new RemoveAbsentPlayers, 'handle']);
+    app()->call([new RemoveAbsentPlayers, 'handle']);
+
+    $this->assertModelMissing($moderator);
+    $this->assertSoftDeleted($room);
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        fn (RoomStateChanged $event): bool => $event->roomId === $room->id
+            && $event->change === RoomStateChange::RoomDeleted,
+    );
+    Event::assertDispatchedTimes(RoomStateChanged::class, 1);
+
+    $this->post(route('room.code'), [
+        'join_code' => $room->join_code,
+        'player_name' => 'Nico',
+    ])->assertSessionHasErrors('join_code');
+});
+
+test('the owner regains moderation when joining a persistent room after a timeout', function () {
+    $owner = User::factory()->create();
+    $room = Room::create([
+        'owner_id' => $owner->id,
+        'is_persistent' => true,
+        'title' => 'Permanent planning',
+        'deck_config' => ['name' => 'Fibonacci', 'cards' => []],
+    ]);
+    $oldModerator = $room->players()->create([
+        'user_id' => $owner->id,
+        'name' => 'Nico',
+        'is_moderator' => true,
+        'last_seen_at' => now()->subHour(),
+    ]);
+    $guest = $room->players()->create([
+        'name' => 'Anna',
+        'last_seen_at' => now(),
+    ]);
+
+    app()->call([new RemoveAbsentPlayers, 'handle']);
+
+    $this->assertModelMissing($oldModerator);
+    $this->assertModelExists($room);
+    expect($guest->fresh()->is_moderator)->toBeFalse();
+
+    $this->actingAs($owner)
+        ->withSession(["room_players.{$room->id}" => $oldModerator->id])
+        ->post(route('room.code'), [
+            'join_code' => $room->join_code,
+            'player_name' => 'Nico',
+        ])
+        ->assertRedirect(route('room.show', $room));
+
+    $newModerator = $room->players()->where('user_id', $owner->id)->sole();
+
+    expect($newModerator->id)->not->toBe($oldModerator->id)
+        ->and($newModerator->is_moderator)->toBeTrue();
+});

tests/Feature/EmbeddedRoomTest.php

@@ -1,7 +1,11 @@
 <?php
 
+use App\Enums\RoomStateChange;
+use App\Events\RoomStateChanged;
+use App\Jobs\RemoveAbsentPlayers;
 use App\Models\Room;
 use App\Models\User;
+use Illuminate\Support\Facades\Event;
 use Inertia\Testing\AssertableInertia as Assert;
 
 function createEmbeddedRoom(array $attributes = []): Room
@@ -19,22 +23,41 @@ function createEmbeddedRoom(array $attributes = []): Room
     ]);
 }
 
-test('embedded room access sends guests through login and remembers the intended room', function () {
+test('a guest automatically joins the embedded room', function () {
     $room = createEmbeddedRoom();
-    $url = route('embedded.room', [
+    $response = $this->get(route('embedded.room', [
-        'join_code' => $room->join_code,
+        'join_code' => strtolower($room->join_code),
-        'player_name' => 'Nico',
+        'player_name' => ' Nico ',
+    ]))
+        ->assertOk()
+        ->assertInertia(fn (Assert $page) => $page
+            ->component('embedded/Room')
+            ->where('room.id', $room->id)
+            ->where('currentPlayer.name', 'Nico'));
+
+    $player = $room->players()->sole();
+
+    expect($player->user_id)->toBeNull()
+        ->and($player->is_moderator)->toBeTrue();
+
+    $response->assertSessionHas("room_players.{$room->id}", $player->id);
+});
+
+test('embedded guest access reuses the session player and applies a changed display name', function () {
+    $room = createEmbeddedRoom();
+    $player = $room->players()->create([
+        'name' => 'Old name',
     ]);
 
-    $this->get($url)
+    $this->withSession(["room_players.{$room->id}" => $player->id])
-        ->assertRedirect(route('login'))
+        ->get(route('embedded.room', [
-        ->assertSessionHas('embedded_login', true)
+            'join_code' => $room->join_code,
-        ->assertSessionHas('url.intended', $url);
+            'player_name' => 'New name',
+        ]))
+        ->assertOk();
 
-    $this->get(route('login'))
+    expect($room->players()->count())->toBe(1)
-        ->assertInertia(fn (Assert $page) => $page
+        ->and($player->fresh()->name)->toBe('New name');
-            ->component('auth/Login')
-            ->where('rememberByDefault', true));
 });
 
 test('an authenticated user automatically joins the embedded room', function () {
@@ -58,17 +81,70 @@ test('an authenticated user automatically joins the embedded room', function ()
         'room_id' => $room->id,
         'user_id' => $user->id,
         'name' => 'Nico',
-        'is_moderator' => false,
+        'is_moderator' => true,
     ]);
 });
 
+test('a persistent room owner regains moderation through the embedded room', function () {
+    $owner = User::factory()->create();
+    $room = createEmbeddedRoom([
+        'owner_id' => $owner->id,
+        'is_persistent' => true,
+    ]);
+    $oldModerator = $room->players()->create([
+        'user_id' => $owner->id,
+        'name' => 'Nico',
+        'is_moderator' => true,
+        'last_seen_at' => now()->subHour(),
+    ]);
+
+    app()->call([new RemoveAbsentPlayers, 'handle']);
+
+    $this->actingAs($owner)
+        ->withSession(["room_players.{$room->id}" => $oldModerator->id])
+        ->get(route('embedded.room', [
+            'join_code' => $room->join_code,
+            'player_name' => 'Nico',
+        ]))
+        ->assertOk()
+        ->assertInertia(fn (Assert $page) => $page
+            ->where('currentPlayer.is_moderator', true));
+
+    expect($room->players()->where('user_id', $owner->id)->sole()->id)->not->toBe($oldModerator->id);
+});
+
+test('a persistent room owner does not take over another account session when becoming moderator', function () {
+    $owner = User::factory()->create();
+    $otherUser = User::factory()->create();
+    $room = createEmbeddedRoom([
+        'owner_id' => $owner->id,
+        'is_persistent' => true,
+    ]);
+    $otherPlayer = $room->players()->create([
+        'user_id' => $otherUser->id,
+        'name' => 'Anna',
+    ]);
+
+    $this->actingAs($owner)
+        ->withSession(["room_players.{$room->id}" => $otherPlayer->id])
+        ->get(route('embedded.room', [
+            'join_code' => $room->join_code,
+            'player_name' => 'Nico',
+        ]))
+        ->assertOk()
+        ->assertInertia(fn (Assert $page) => $page
+            ->where('currentPlayer.is_moderator', true));
+
+    expect($otherPlayer->fresh()->is_moderator)->toBeFalse()
+        ->and($room->players()->where('user_id', $owner->id)->sole()->is_moderator)->toBeTrue();
+});
+
 test('embedded access reuses the user player and applies a changed display name', function () {
     $user = User::factory()->create();
     $room = createEmbeddedRoom();
     $player = $room->players()->create([
         'user_id' => $user->id,
         'name' => 'Old name',
-        'inactive_at' => now(),
     ]);
 
     $this->actingAs($user)
@@ -79,51 +155,147 @@ test('embedded access reuses the user player and applies a changed display name'
         ->assertOk();
 
     expect($room->players()->count())->toBe(1)
-        ->and($player->fresh()->name)->toBe('New name')
+        ->and($player->fresh()->name)->toBe('New name');
-        ->and($player->fresh()->inactive_at)->toBeNull();
 });
 
-test('embedded access shows a dedicated error when the display name is taken', function () {
+test('an embedded guest keeps the same player after logging in separately', function () {
-    $user = User::factory()->create();
+    $user = User::factory()->create([
+        'email' => 'nico@example.com',
+    ]);
     $room = createEmbeddedRoom();
-    $room->players()->create(['name' => 'Nico']);
+    $url = route('embedded.room', [
+        'join_code' => $room->join_code,
+        'player_name' => 'Nico',
+    ]);
 
-    $this->actingAs($user)
+    $this->get($url)->assertOk();
-        ->get(route('embedded.room', [
+
-            'join_code' => $room->join_code,
+    $player = $room->players()->sole();
-            'player_name' => 'Nico',
+
-        ]))
+    $this->post(route('login.store'), [
+        'email' => 'nico@example.com',
+        'password' => 'password',
+    ])->assertRedirect();
+
+    $this->get($url)->assertOk();
+
+    expect($room->players()->count())->toBe(1)
+        ->and($player->fresh()->user_id)->toBe($user->id);
+});
+
+test('embedded guest access shows a dedicated error when the display name is taken', function () {
+    $user = User::factory()->create([
+        'email' => 'nico@example.com',
+    ]);
+    $room = createEmbeddedRoom();
+    $room->players()->create([
+        'user_id' => $user->id,
+        'name' => 'Nico',
+    ]);
+    $url = route('embedded.room', [
+        'join_code' => $room->join_code,
+        'player_name' => 'Nico',
+    ]);
+
+    $this->get($url)
         ->assertUnprocessable()
         ->assertInertia(fn (Assert $page) => $page
             ->component('embedded/Error')
-            ->where('message', 'Dieser Anzeigename ist in dem Raum bereits vorhanden.'));
+            ->where('message', 'Dieser Anzeigename ist in dem Raum bereits vorhanden.')
+            ->where('showLoginAction', true))
+        ->assertSessionHas('url.intended', $url);
+
+    $this->post(route('login.store'), [
+        'email' => 'nico@example.com',
+        'password' => 'password',
+    ])->assertRedirect($url);
+
+    $this->get($url)
+        ->assertOk()
+        ->assertInertia(fn (Assert $page) => $page
+            ->component('embedded/Room')
+            ->where('currentPlayer.name', 'Nico'));
+});
+
+test('a new account instance takes over the embedded player and kicks the previous instance', function () {
+    Event::fake([RoomStateChanged::class]);
+    $user = User::factory()->create();
+    $room = createEmbeddedRoom();
+    $player = $room->players()->create([
+        'user_id' => $user->id,
+        'name' => 'Nico',
+        'active_instance_id' => '019b8f80-37c4-71a3-b415-5f2697332c16',
+    ]);
+    $url = route('embedded.room', [
+        'join_code' => $room->join_code,
+        'player_name' => 'Nico',
+    ]);
+
+    $this->actingAs($user)
+        ->withSession([
+            'room_player_instance_id' => '019b8f80-37c4-71a3-b415-5f2697332c17',
+        ])
+        ->get($url)
+        ->assertOk()
+        ->assertInertia(fn (Assert $page) => $page
+            ->where('currentPlayer.id', $player->id)
+            ->where('currentPlayer.instance_id', '019b8f80-37c4-71a3-b415-5f2697332c17'));
+
+    expect($player->fresh()->active_instance_id)
+        ->toBe('019b8f80-37c4-71a3-b415-5f2697332c17');
+
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        fn (RoomStateChanged $event): bool => $event->change === RoomStateChange::PlayerInstanceReplaced
+            && $event->affectedPlayerId === $player->id
+            && $event->affectedInstanceId === '019b8f80-37c4-71a3-b415-5f2697332c16',
+    );
+
+    $this->withSession([
+        "room_players.{$room->id}" => $player->id,
+        'room_player_instance_id' => '019b8f80-37c4-71a3-b415-5f2697332c16',
+    ])
+        ->post(route('room.vote.store', $room), ['value' => '5'])
+        ->assertRedirect(route('room.join', ['join_code' => $room->join_code]));
+
+    $this->assertDatabaseCount('votes', 0);
 });
 
 test('embedded access shows a dedicated error for an unknown room code', function () {
-    $this->actingAs(User::factory()->create())
+    $this->get(route('embedded.room', [
-        ->get(route('embedded.room', [
+        'join_code' => 'ABC234',
-            'join_code' => 'ABC234',
+        'player_name' => 'Nico',
-            'player_name' => 'Nico',
+    ]))
-        ]))
         ->assertUnprocessable()
         ->assertInertia(fn (Assert $page) => $page
             ->component('embedded/Error')
-            ->where('message', 'Dieser Raumcode existiert nicht.'));
+            ->where('message', 'Dieser Raumcode existiert nicht.')
+            ->where('showLoginAction', false));
 });
 
-test('embedded logout returns to the same configured room and signs the user out', function () {
+test('embedded logout returns to the same room as a guest without duplicating the player', function () {
     $user = User::factory()->create();
     $room = createEmbeddedRoom();
+    $url = route('embedded.room', [
+        'join_code' => $room->join_code,
+        'player_name' => 'Nico',
+    ]);
 
-    $this->actingAs($user)
+    $this->actingAs($user)->get($url)->assertOk();
+
+    $player = $room->players()->sole();
+
+    $this
+        ->followingRedirects()
         ->post(route('embedded.logout', [
             'join_code' => $room->join_code,
             'player_name' => 'Nico',
         ]))
-        ->assertRedirect(route('embedded.room', [
+        ->assertOk()
-            'join_code' => $room->join_code,
+        ->assertInertia(fn (Assert $page) => $page
-            'player_name' => 'Nico',
+            ->component('embedded/Room')
-        ]));
+            ->where('currentPlayer.id', $player->id));
 
-    $this->assertGuest();
+    $this->assertGuest()
+        ->assertDatabaseCount('players', 1);
 });

tests/Feature/RoomBroadcastingTest.php

@@ -45,6 +45,25 @@ test('room state broadcasts synchronously expose sanitized state', function () {
         ]);
 });
 
+test('player instance replacement broadcasts the displaced instance', function () {
+    $event = new RoomStateChanged(
+        '019b8f80-37c4-71a3-b415-5f2697332c16',
+        8,
+        RoomStateChange::PlayerInstanceReplaced,
+        null,
+        42,
+        '019b8f80-37c4-71a3-b415-5f2697332c17',
+    );
+
+    expect($event->broadcastWith())->toBe([
+        'version' => 8,
+        'change' => 'player_instance_replaced',
+        'state' => null,
+        'affected_player_id' => 42,
+        'affected_instance_id' => '019b8f80-37c4-71a3-b415-5f2697332c17',
+    ]);
+});
+
 test('joining a room broadcasts the new room version', function () {
     Event::fake([RoomStateChanged::class]);
     $room = createBroadcastRoom();

tests/Feature/RoomFavoritesTest.php

@@ -20,11 +20,6 @@ test('favorited rooms are presented on the dashboard with player counts', functi
         'name' => 'Active player',
         'last_seen_at' => now(),
     ]);
-    $room->players()->create([
-        'name' => 'Inactive player',
-        'last_seen_at' => now()->subHour(),
-        'inactive_at' => now(),
-    ]);
 
     $this->actingAs($user)
         ->post(route('room.favorite', $room))
@@ -39,8 +34,7 @@ test('favorited rooms are presented on the dashboard with player counts', functi
         ->assertInertia(fn (Assert $page) => $page
             ->has('favoriteRooms', 1)
             ->where('favoriteRooms.0.id', $room->id)
-            ->where('favoriteRooms.0.players_count', 2)
+            ->where('favoriteRooms.0.players_count', 1));
-            ->where('favoriteRooms.0.active_player_count', 1));
 });
 
 test('the room resource exposes favorite and owner state', function () {

tests/Feature/RoomLifecycleTest.php

@@ -1,11 +1,14 @@
 <?php
 
+use App\Enums\RoomStateChange;
+use App\Events\RoomStateChanged;
 use App\Jobs\CloseInactiveRooms;
 use App\Models\Deck;
 use App\Models\Room;
 use App\Models\User;
 use App\Models\Vote;
 use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Event;
 use Inertia\Testing\AssertableInertia as Assert;
 
 function createLifecycleRoom(array $attributes = []): Room
@@ -156,6 +159,36 @@ test('an authenticated player rejoins with the existing room identity', function
     $response->assertSessionHas("room_players.{$room->id}", $player->id);
 });
 
+test('a new account instance takes over the player during a regular room join', function () {
+    $user = User::factory()->create();
+    $room = createLifecycleRoom();
+    $player = $room->players()->create([
+        'user_id' => $user->id,
+        'name' => 'Room nickname',
+        'active_instance_id' => '019b8f80-37c4-71a3-b415-5f2697332c16',
+    ]);
+    Event::fake([RoomStateChanged::class]);
+
+    $this->actingAs($user)
+        ->withSession([
+            'room_player_instance_id' => '019b8f80-37c4-71a3-b415-5f2697332c17',
+        ])
+        ->post(route('room.code'), [
+            'join_code' => $room->join_code,
+            'player_name' => 'Room nickname',
+        ])
+        ->assertRedirect(route('room.show', $room));
+
+    expect($player->fresh()->active_instance_id)
+        ->toBe('019b8f80-37c4-71a3-b415-5f2697332c17');
+
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        fn (RoomStateChanged $event): bool => $event->change === RoomStateChange::PlayerInstanceReplaced
+            && $event->affectedPlayerId === $player->id,
+    );
+});
+
 test('an authenticated player can restore room access without the previous session', function () {
     $user = User::factory()->create();
     $room = createLifecycleRoom(['owner_id' => $user->id]);
@@ -183,15 +216,16 @@ test('an active guest with a room session skips the join form', function () {
         ->assertRedirect(route('room.show', $room));
 });
 
-test('an inactive guest is sent through join and reuses the existing player', function () {
+test('a removed guest joins again with a new player identity', function () {
     $room = createLifecycleRoom();
     $player = $room->players()->create([
         'name' => 'Returning guest',
         'last_seen_at' => now()->subHours(2),
-        'inactive_at' => now()->subHour(),
     ]);
     $session = ["room_players.{$room->id}" => $player->id];
 
+    $player->delete();
+
     $this->withSession($session)
         ->get(route('room.show', $room))
         ->assertRedirect(route('room.join', ['join_code' => $room->join_code]));
@@ -200,7 +234,7 @@ test('an inactive guest is sent through join and reuses the existing player', fu
         ->get(route('room.join', ['join_code' => $room->join_code]))
         ->assertInertia(fn (Assert $page) => $page
             ->component('rooms/Join')
-            ->where('defaultPlayerName', 'Returning guest'));
+            ->where('defaultPlayerName', null));
 
     $this->withSession($session)
         ->post(route('room.code'), [
@@ -210,7 +244,7 @@ test('an inactive guest is sent through join and reuses the existing player', fu
         ->assertRedirect(route('room.show', $room));
 
     expect($room->players()->count())->toBe(1)
-        ->and($player->fresh()->inactive_at)->toBeNull();
+        ->and($room->players()->sole()->id)->not->toBe($player->id);
 });
 
 test('showing or polling a room does not count as room activity', function () {

tests/Feature/RoomPlayerKickTest.php

@@ -44,7 +44,6 @@ test('the room owner sees active room players on the dashboard', function () {
     $room = createRoomForPlayerKick($owner);
     $moderator = addPlayerToKickRoom($room, 'Moderator', $owner, true);
     $participant = addPlayerToKickRoom($room, 'Anna');
-    addPlayerToKickRoom($room, 'Inactive')->update(['inactive_at' => now()]);
 
     $this->actingAs($owner)
         ->get(route('dashboard'))
@@ -77,8 +76,8 @@ test('the room owner can kick an active participant', function () {
         ->delete(route('room.player.destroy', [$room, $participant]))
         ->assertRedirect();
 
-    expect($participant->fresh()->inactive_at)->not->toBeNull()
+    $this->assertModelMissing($participant);
-        ->and($room->fresh()->state_version)->toBe($previousVersion + 1);
+    expect($room->fresh()->state_version)->toBe($previousVersion + 1);
 
     Event::assertDispatched(
         RoomStateChanged::class,
@@ -104,21 +103,122 @@ test('the room owner can kick an active participant', function () {
     Event::assertDispatchedTimes(RoomStateChanged::class, 1);
 });
 
-test('a participant cannot kick another player', function () {
+test('a kicked guest loses their votes and their name becomes available', function () {
+    $owner = User::factory()->create();
+    $room = createRoomForPlayerKick($owner);
+    addPlayerToKickRoom($room, 'Moderator', $owner, true);
+    $guest = addPlayerToKickRoom($room, 'Nico');
+    $vote = $guest->votes()->create([
+        'room_id' => $room->id,
+        'round' => $room->current_round,
+        'value' => '3',
+    ]);
+
+    $this->actingAs($owner)
+        ->delete(route('room.player.destroy', [$room, $guest]))
+        ->assertRedirect();
+
+    $this->assertModelMissing($guest);
+    $this->assertModelMissing($vote);
+
+    auth()->logout();
+
+    $this->withSession(["room_players.{$room->id}" => $guest->id])
+        ->post(route('room.code'), [
+            'join_code' => $room->join_code,
+            'player_name' => 'Nico',
+        ])
+        ->assertRedirect(route('room.show', $room));
+
+    expect($room->players()->where('name', 'Nico')->sole()->id)->not->toBe($guest->id);
+});
+
+test('the room moderator can kick an active participant without shared management', function () {
+    $owner = User::factory()->create();
+    $room = createRoomForPlayerKick($owner, ['owner_id' => null]);
+    $moderator = addPlayerToKickRoom($room, 'Moderator', null, true);
+    $target = addPlayerToKickRoom($room, 'Anna');
+
+    Event::fake([RoomStateChanged::class]);
+
+    $this->withSession(["room_players.{$room->id}" => $moderator->id])
+        ->delete(route('room.player.destroy', [$room, $target]))
+        ->assertRedirect();
+
+    $this->assertModelMissing($target);
+    Event::assertDispatchedTimes(RoomStateChanged::class, 1);
+});
+
+test('a participant cannot kick another player when participant management is disabled', function () {
     $owner = User::factory()->create();
     $participantUser = User::factory()->create();
     $room = createRoomForPlayerKick($owner);
     addPlayerToKickRoom($room, 'Moderator', $owner, true);
-    addPlayerToKickRoom($room, 'Anna', $participantUser);
+    $participant = addPlayerToKickRoom($room, 'Anna', $participantUser);
     $target = addPlayerToKickRoom($room, 'Ben');
 
     Event::fake([RoomStateChanged::class]);
 
     $this->actingAs($participantUser)
+        ->withSession(["room_players.{$room->id}" => $participant->id])
         ->delete(route('room.player.destroy', [$room, $target]))
         ->assertForbidden();
 
-    expect($target->fresh()->inactive_at)->toBeNull();
+    $this->assertModelExists($target);
+    Event::assertNotDispatched(RoomStateChanged::class);
+});
+
+test('a participant can kick another player when participant management is enabled', function () {
+    $owner = User::factory()->create();
+    $room = createRoomForPlayerKick($owner, [
+        'allow_participants_to_manage_rounds' => true,
+    ]);
+    addPlayerToKickRoom($room, 'Moderator', $owner, true);
+    $participant = addPlayerToKickRoom($room, 'Anna');
+    $target = addPlayerToKickRoom($room, 'Ben');
+
+    Event::fake([RoomStateChanged::class]);
+
+    $this->withSession(["room_players.{$room->id}" => $participant->id])
+        ->delete(route('room.player.destroy', [$room, $target]))
+        ->assertRedirect();
+
+    $this->assertModelMissing($target);
+    Event::assertDispatched(RoomStateChanged::class);
+});
+
+test('a participant cannot kick themselves when participant management is enabled', function () {
+    $owner = User::factory()->create();
+    $room = createRoomForPlayerKick($owner, [
+        'allow_participants_to_manage_rounds' => true,
+    ]);
+    $participant = addPlayerToKickRoom($room, 'Anna');
+
+    Event::fake([RoomStateChanged::class]);
+
+    $this->withSession(["room_players.{$room->id}" => $participant->id])
+        ->delete(route('room.player.destroy', [$room, $participant]))
+        ->assertForbidden();
+
+    $this->assertModelExists($participant);
+    Event::assertNotDispatched(RoomStateChanged::class);
+});
+
+test('an anonymous visitor without a room session cannot kick from an ownerless room', function () {
+    $owner = User::factory()->create();
+    $room = createRoomForPlayerKick($owner, [
+        'owner_id' => null,
+        'allow_participants_to_manage_rounds' => true,
+    ]);
+    addPlayerToKickRoom($room, 'Moderator', null, true);
+    $target = addPlayerToKickRoom($room, 'Ben');
+
+    Event::fake([RoomStateChanged::class]);
+
+    $this->delete(route('room.player.destroy', [$room, $target]))
+        ->assertForbidden();
+
+    $this->assertModelExists($target);
     Event::assertNotDispatched(RoomStateChanged::class);
 });
 
@@ -133,7 +233,7 @@ test('the room owner cannot kick their own player', function () {
         ->delete(route('room.player.destroy', [$room, $moderator]))
         ->assertForbidden();
 
-    expect($moderator->fresh()->inactive_at)->toBeNull();
+    $this->assertModelExists($moderator);
     Event::assertNotDispatched(RoomStateChanged::class);
 });
 
@@ -150,6 +250,6 @@ test('the room owner cannot kick a player from another room', function () {
         ->delete(route('room.player.destroy', [$room, $target]))
         ->assertForbidden();
 
-    expect($target->fresh()->inactive_at)->toBeNull();
+    $this->assertModelExists($target);
     Event::assertNotDispatched(RoomStateChanged::class);
 });