Merge pull request #5 from ericasch6/allow-other-control

allow anyone controll room option

.codex/config.toml

@@ -1,3 +1,7 @@
 [mcp_servers.laravel-boost]
 command = "php"
 args = ["artisan", "boost:mcp"]
+
+[mcp_servers.nightwatch]
+command = "npx"
+args = ["-y", "mcp-remote", "https://nightwatch.laravel.com/mcp"]

.github/workflows/ci_cd.yml

@@ -49,7 +49,7 @@ jobs:
               printf -v run_attempt '%03d' "${GITHUB_RUN_ATTEMPT}"
               tag="main-${GITHUB_RUN_NUMBER}-${run_attempt}-${GITHUB_SHA:0:12}"
               environment="staging"
-              vite_app_version="main-${GITHUB_SHA:0:12}"
+              vite_app_version="staging-${GITHUB_SHA:0:12}"
               vite_reverb_app_key="1af96b48d2ef78983e4ef281eed3a48b"
               vite_reverb_host="scrum-poker.twyco-staging.de"
               ;;

README.md

@@ -1,4 +1,3 @@
 # Scrumpoker without AD's
 
 trigger workflow
-

app/Enums/RoomStateChange.php

@@ -5,15 +5,12 @@ namespace App\Enums;
 enum RoomStateChange: string
 {
     case PlayerJoined = 'player_joined';
-    case PlayerUpdated = 'player_updated';
-    case PlayerKicked = 'player_kicked';
-    case PlayerInstanceReplaced = 'player_instance_replaced';
     case VoteChanged = 'vote_changed';
     case CardsRevealed = 'cards_revealed';
     case VotesReset = 'votes_reset';
     case NextRound = 'next_round';
+    case PermissionsUpdated = 'permissions_updated';
     case RoomReopened = 'room_reopened';
     case RoomClosed = 'room_closed';
     case RoomDeleted = 'room_deleted';
-    case RoomSettingsUpdated = 'room_settings_updated';
 }

app/Events/RoomStateChanged.php

@@ -21,8 +21,6 @@ class RoomStateChanged implements ShouldBroadcastNow
         public readonly int $version,
         public readonly RoomStateChange $change,
         public readonly ?array $state = null,
-        public readonly ?int $affectedPlayerId = null,
-        public readonly ?string $affectedInstanceId = null,
     ) {}
 
     public function broadcastOn(): Channel
@@ -36,24 +34,14 @@ class RoomStateChanged implements ShouldBroadcastNow
     }
 
     /**
-     * @return array{version: int, change: string, state: array<string, mixed>|null, affected_player_id?: int, affected_instance_id?: string}
+     * @return array{version: int, change: string, state: array<string, mixed>|null}
      */
     public function broadcastWith(): array
     {
-        $payload = [
+        return [
             'version' => $this->version,
             'change' => $this->change->value,
             'state' => $this->state,
         ];
-
-        if ($this->affectedPlayerId !== null) {
-            $payload['affected_player_id'] = $this->affectedPlayerId;
-        }
-
-        if ($this->affectedInstanceId !== null) {
-            $payload['affected_instance_id'] = $this->affectedInstanceId;
-        }
-
-        return $payload;
     }
 }

app/Http/Controllers/EmbeddedLogoutController.php

@@ -1,45 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\Models\Room;
-use Illuminate\Http\RedirectResponse;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Auth;
-
-class EmbeddedLogoutController extends Controller
-{
-    /**
-     * Handle the incoming request.
-     */
-    public function __invoke(Request $request): RedirectResponse
-    {
-        $joinCode = $request->string('join_code')->trim()->upper()->toString();
-        $playerName = $request->string('player_name')->trim()->toString();
-        $room = Room::query()->where('join_code', $joinCode)->first();
-        $playerId = null;
-
-        if ($room !== null) {
-            $sessionPlayerId = $request->session()->get("room_players.{$room->id}");
-
-            if (is_numeric($sessionPlayerId)) {
-                $playerId = $room->players()
-                    ->whereKey((int) $sessionPlayerId)
-                    ->value('id');
-            }
-        }
-
-        Auth::guard('web')->logout();
-        $request->session()->invalidate();
-        $request->session()->regenerateToken();
-
-        if ($room !== null && is_numeric($playerId)) {
-            $request->session()->put("room_players.{$room->id}", (int) $playerId);
-        }
-
-        return to_route('embedded.room', [
-            'join_code' => $joinCode,
-            'player_name' => $playerName,
-        ]);
-    }
-}

app/Http/Controllers/EmbeddedRoomController.php

@@ -1,53 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\Http\Requests\ShowEmbeddedRoomRequest;
-use App\Http\Resources\CurrentPlayerResource;
-use App\Http\Resources\RoomResource;
-use App\Models\Room;
-use App\Services\Rooms\RoomPageService;
-use App\Services\Rooms\RoomParticipationService;
-use App\Services\Rooms\RoomPlayerInstanceService;
-use Inertia\Inertia;
-use Inertia\Response;
-
-class EmbeddedRoomController extends Controller
-{
-    public function __construct(
-        private readonly RoomParticipationService $roomParticipation,
-        private readonly RoomPageService $roomPage,
-        private readonly RoomPlayerInstanceService $playerInstances,
-    ) {}
-
-    public function __invoke(ShowEmbeddedRoomRequest $request): Response
-    {
-        /** @var array{join_code: string, player_name: string} $validated */
-        $validated = $request->validated();
-        $user = $request->user();
-
-        $room = Room::query()
-            ->where('join_code', $validated['join_code'])
-            ->firstOrFail();
-        $player = $this->roomParticipation->joinEmbedded(
-            $room,
-            $user,
-            $validated['player_name'],
-            $request->session()->get("room_players.{$room->id}"),
-        );
-        $player = $this->roomParticipation->activateInstance(
-            $room,
-            $player,
-            $this->playerInstances->for($request),
-        );
-
-        $request->session()->put("room_players.{$room->id}", $player->id);
-
-        $pageData = $this->roomPage->prepare($room, $player, $user);
-
-        return Inertia::render('embedded/Room', [
-            'room' => (new RoomResource($pageData))->resolve($request),
-            'currentPlayer' => (new CurrentPlayerResource($pageData))->resolve($request),
-        ]);
-    }
-}

app/Http/Controllers/RoomController.php

@@ -10,7 +10,6 @@ use App\Models\Player;
 use App\Models\Room;
 use App\Services\Rooms\RoomCreationService;
 use App\Services\Rooms\RoomPageService;
-use App\Services\Rooms\RoomPlayerInstanceService;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Inertia\Inertia;
@@ -21,7 +20,6 @@ class RoomController extends Controller
     public function __construct(
         private readonly RoomCreationService $roomCreation,
         private readonly RoomPageService $roomPage,
-        private readonly RoomPlayerInstanceService $playerInstances,
     ) {}
 
     public function create(Request $request): Response
@@ -42,9 +40,6 @@ class RoomController extends Controller
             $validated,
             $request->user(),
         );
-        $player->update([
-            'active_instance_id' => $this->playerInstances->for($request),
-        ]);
 
         $request->session()->put(
             "room_players.{$room->id}",

app/Http/Controllers/RoomJoinController.php

@@ -32,6 +32,7 @@ class RoomJoinController extends Controller
             $room !== null
             && ! $room->isClosed()
             && $existingPlayer instanceof Player
+            && $existingPlayer->inactive_at === null
         ) {
             return to_route('room.show', $room);
         }

app/Http/Controllers/RoomPermissionController.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\UpdateRoomPermissionsRequest;
+use App\Models\Room;
+use App\Services\Rooms\RoomPermissionService;
+use Illuminate\Http\Response;
+
+class RoomPermissionController extends Controller
+{
+    public function __construct(
+        private readonly RoomPermissionService $roomPermissions,
+    ) {}
+
+    public function __invoke(UpdateRoomPermissionsRequest $request, Room $room): Response
+    {
+        $this->roomPermissions->updateParticipantControls(
+            $room,
+            (bool) $request->validated('allow_participant_controls'),
+        );
+
+        return response()->noContent();
+    }
+}

app/Http/Controllers/RoomPlayerController.php

@@ -4,14 +4,12 @@ namespace App\Http\Controllers;
 
 use App\Http\Requests\JoinRoomRequest;
 use App\Services\Rooms\RoomParticipationService;
-use App\Services\Rooms\RoomPlayerInstanceService;
 use Illuminate\Http\RedirectResponse;
 
 class RoomPlayerController extends Controller
 {
     public function __construct(
         private readonly RoomParticipationService $roomParticipation,
-        private readonly RoomPlayerInstanceService $playerInstances,
     ) {}
 
     public function join(JoinRoomRequest $request): RedirectResponse
@@ -25,11 +23,6 @@ class RoomPlayerController extends Controller
             $request->user(),
             is_array($sessionPlayerIds) ? $sessionPlayerIds : [],
         );
-        $player = $this->roomParticipation->activateInstance(
-            $room,
-            $player,
-            $this->playerInstances->for($request),
-        );
 
         $request->session()->put(
             "room_players.{$room->id}",

app/Http/Controllers/RoomPlayerKickController.php

@@ -1,34 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\Http\Requests\KickRoomPlayerRequest;
-use App\Models\Player;
-use App\Models\Room;
-use App\Services\Rooms\RoomParticipationService;
-use Illuminate\Http\RedirectResponse;
-use Inertia\Inertia;
-
-class RoomPlayerKickController extends Controller
-{
-    public function __construct(
-        private readonly RoomParticipationService $roomParticipation,
-    ) {}
-
-    public function __invoke(KickRoomPlayerRequest $request, Room $room, Player $player): RedirectResponse
-    {
-        $this->roomParticipation->kick(
-            $room,
-            $player,
-            $request->user(),
-            $request->currentPlayer($room),
-        );
-
-        Inertia::flash('toast', [
-            'type' => 'success',
-            'message' => "{$player->name} wurde aus dem Raum entfernt.",
-        ]);
-
-        return back();
-    }
-}

app/Http/Controllers/RoomSettingsController.php

@@ -1,52 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\Http\Requests\UpdateRoomSettingsRequest;
-use App\Models\Room;
-use App\Models\User;
-use App\Services\Rooms\RoomSettingsService;
-use Illuminate\Http\RedirectResponse;
-use Illuminate\Http\Request;
-use Inertia\Inertia;
-use Inertia\Response;
-
-class RoomSettingsController extends Controller
-{
-    public function __construct(
-        private readonly RoomSettingsService $roomSettings,
-    ) {}
-
-    public function edit(Room $room, Request $request): Response
-    {
-        abort_unless($request->user()?->id === $room->owner_id, 403);
-
-        return Inertia::render('rooms/Settings', [
-            'room' => [
-                'id' => $room->id,
-                'title' => $room->title,
-                'join_code' => $room->join_code,
-                'allow_participants_to_manage_rounds' => $room->allow_participants_to_manage_rounds,
-                'is_persistent' => $room->is_persistent,
-            ],
-        ]);
-    }
-
-    public function update(UpdateRoomSettingsRequest $request, Room $room): RedirectResponse
-    {
-        $user = $request->user();
-
-        abort_unless($user instanceof User, 403);
-
-        /** @var array{allow_participants_to_manage_rounds: bool, is_persistent: bool} $settings */
-        $settings = $request->validated();
-        $this->roomSettings->update($room, $user, $settings);
-
-        Inertia::flash('toast', [
-            'type' => 'success',
-            'message' => 'Die Raumeinstellungen wurden gespeichert.',
-        ]);
-
-        return back();
-    }
-}

app/Http/Controllers/RoundController.php

@@ -16,7 +16,7 @@ class RoundController extends Controller
 
     public function reset(Request $request, Room $room): Response
     {
-        $this->ensureCanManageRounds($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->reset($room);
 
         return response()->noContent();
@@ -24,7 +24,7 @@ class RoundController extends Controller
 
     public function reveal(Request $request, Room $room): Response
     {
-        $this->ensureCanManageRounds($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->reveal($room);
 
         return response()->noContent();
@@ -32,20 +32,20 @@ class RoundController extends Controller
 
     public function nextRound(Request $request, Room $room): Response
     {
-        $this->ensureCanManageRounds($request, $room);
+        $this->ensureCanControlRound($request, $room);
         $this->rounds->startNext($room);
 
         return response()->noContent();
     }
 
-    private function ensureCanManageRounds(Request $request, Room $room): void
+    private function ensureCanControlRound(Request $request, Room $room): void
     {
         $player = $request->attributes->get('currentPlayer');
 
         abort_unless(
             $player instanceof Player
             && $player->room_id === $room->id
-            && ($player->is_moderator || $room->allow_participants_to_manage_rounds),
+            && ($player->is_moderator || $room->allow_participant_controls),
             403,
         );
     }

app/Http/Middleware/EnsureRoomParticipant.php

@@ -3,8 +3,6 @@
 namespace App\Http\Middleware;
 
 use App\Models\Room;
-use App\Services\Rooms\RoomParticipationService;
-use App\Services\Rooms\RoomPlayerInstanceService;
 use Closure;
 use Illuminate\Http\Request;
 use Inertia\Inertia;
@@ -12,11 +10,6 @@ use Symfony\Component\HttpFoundation\Response;
 
 class EnsureRoomParticipant
 {
-    public function __construct(
-        private readonly RoomParticipationService $roomParticipation,
-        private readonly RoomPlayerInstanceService $playerInstances,
-    ) {}
-
     /**
      * Handle an incoming request.
      *
@@ -51,43 +44,13 @@ class EnsureRoomParticipant
         }
 
         $playerId = $request->session()->get($sessionKey);
-        $hasSessionPlayer = is_numeric($playerId);
-        $instanceId = $this->playerInstances->for($request);
 
-        $player = $hasSessionPlayer
+        $player = is_numeric($playerId)
             ? $room->players()->find((int) $playerId)
             : null;
 
-        if ($player === null && $hasSessionPlayer) {
+        if ($player === null && $playerId) {
             $request->session()->forget($sessionKey);
-
-            return to_route('room.join', [
-                'join_code' => $room->join_code,
-            ])->withErrors([
-                'join_code' => 'Diese Spieler-Instanz ist nicht mehr aktiv.',
-            ]);
-        }
-
-        if (
-            $player !== null
-            && $player->active_instance_id !== null
-            && $player->active_instance_id !== $instanceId
-        ) {
-            $request->session()->forget($sessionKey);
-
-            return to_route('room.join', [
-                'join_code' => $room->join_code,
-            ])->withErrors([
-                'join_code' => 'Dein Account ist diesem Raum in einer anderen Instanz beigetreten.',
-            ]);
-        }
-
-        if ($player !== null) {
-            $player = $this->roomParticipation->activateInstance(
-                $room,
-                $player,
-                $instanceId,
-            );
         }
 
         if ($player === null && $request->user() !== null) {
@@ -96,11 +59,6 @@ class EnsureRoomParticipant
                 ->first();
 
             if ($player !== null) {
-                $player = $this->roomParticipation->activateInstance(
-                    $room,
-                    $player,
-                    $instanceId,
-                );
                 $request->session()->put($sessionKey, $player->id);
             }
         }
@@ -113,6 +71,12 @@ class EnsureRoomParticipant
             ]);
         }
 
+        if ($player->inactive_at !== null) {
+            return to_route('room.join', [
+                'join_code' => $room->join_code,
+            ]);
+        }
+
         $player->markAsSeen();
         $request->attributes->set('currentPlayer', $player);
 

app/Http/Requests/KickRoomPlayerRequest.php

@@ -1,63 +0,0 @@
-<?php
-
-namespace App\Http\Requests;
-
-use App\Models\Player;
-use App\Models\Room;
-use Illuminate\Foundation\Http\FormRequest;
-
-class KickRoomPlayerRequest extends FormRequest
-{
-    /**
-     * Determine if the user is authorized to make this request.
-     */
-    public function authorize(): bool
-    {
-        $room = $this->route('room');
-        $targetPlayer = $this->route('player');
-
-        if (
-            ! $room instanceof Room
-            || ! $targetPlayer instanceof Player
-            || $targetPlayer->room_id !== $room->id
-            || $targetPlayer->is_moderator
-            || ($room->owner_id !== null && $targetPlayer->user_id === $room->owner_id)
-        ) {
-            return false;
-        }
-
-        $user = $this->user();
-
-        if ($user !== null && $user->id === $room->owner_id) {
-            return true;
-        }
-
-        $currentPlayer = $this->currentPlayer($room);
-
-        return ! $room->isClosed()
-            && $currentPlayer !== null
-            && $currentPlayer->id !== $targetPlayer->id
-            && ($currentPlayer->is_moderator || $room->allow_participants_to_manage_rounds);
-    }
-
-    public function currentPlayer(Room $room): ?Player
-    {
-        $playerId = $this->session()->get("room_players.{$room->id}");
-
-        if (! is_numeric($playerId)) {
-            return null;
-        }
-
-        return $room->players()->find((int) $playerId);
-    }
-
-    /**
-     * Get the validation rules that apply to the request.
-     *
-     * @return array<string, array<int, string>>
-     */
-    public function rules(): array
-    {
-        return [];
-    }
-}

app/Http/Requests/ShowEmbeddedRoomRequest.php

@@ -1,134 +0,0 @@
-<?php
-
-namespace App\Http\Requests;
-
-use App\Models\Player;
-use App\Models\Room;
-use Illuminate\Contracts\Validation\ValidationRule;
-use Illuminate\Contracts\Validation\Validator;
-use Illuminate\Foundation\Http\FormRequest;
-use Illuminate\Http\Exceptions\HttpResponseException;
-use Illuminate\Validation\Rule;
-use Inertia\Inertia;
-
-class ShowEmbeddedRoomRequest extends FormRequest
-{
-    private const string PLAYER_NAME_TAKEN_MESSAGE = 'Dieser Anzeigename ist in dem Raum bereits vorhanden.';
-
-    /**
-     * Determine if the user is authorized to make this request.
-     */
-    public function authorize(): bool
-    {
-        return true;
-    }
-
-    protected function prepareForValidation(): void
-    {
-        $this->merge([
-            'join_code' => $this->string('join_code')->trim()->upper()->toString(),
-            'player_name' => $this->string('player_name')->trim()->toString(),
-        ]);
-    }
-
-    /**
-     * Get the validation rules that apply to the request.
-     *
-     * @return array<string, ValidationRule|array<mixed>|string>
-     */
-    public function rules(): array
-    {
-        return [
-            'join_code' => [
-                'bail',
-                'required',
-                'string',
-                'size:6',
-                Rule::exists(Room::class, 'join_code')->whereNull('deleted_at'),
-            ],
-            'player_name' => ['required', 'string', 'max:50'],
-        ];
-    }
-
-    /** @return array<callable(Validator): void> */
-    public function after(): array
-    {
-        return [
-            function (Validator $validator): void {
-                if ($validator->errors()->has('join_code')) {
-                    return;
-                }
-
-                $room = Room::query()
-                    ->where('join_code', $this->input('join_code'))
-                    ->first();
-
-                if ($room?->isClosed()) {
-                    $validator->errors()->add('join_code', 'Dieser Raum ist geschlossen.');
-
-                    return;
-                }
-
-                if ($room === null) {
-                    return;
-                }
-
-                $sessionPlayerId = $this->session()->get("room_players.{$room->id}");
-                $existingPlayer = null;
-
-                if ($this->user() !== null) {
-                    $existingPlayer = $room->players()
-                        ->where('user_id', $this->user()->id)
-                        ->first();
-                }
-
-                if ($existingPlayer === null && is_numeric($sessionPlayerId)) {
-                    $existingPlayer = $room->players()->find((int) $sessionPlayerId);
-                }
-
-                $nameIsTaken = Player::query()
-                    ->where('room_id', $room->id)
-                    ->where('name', $this->input('player_name'))
-                    ->when(
-                        $existingPlayer !== null,
-                        fn ($query) => $query->whereKeyNot($existingPlayer->id),
-                    )
-                    ->exists();
-
-                if ($nameIsTaken) {
-                    $validator->errors()->add(
-                        'player_name',
-                        self::PLAYER_NAME_TAKEN_MESSAGE,
-                    );
-                }
-            },
-        ];
-    }
-
-    public function messages(): array
-    {
-        return [
-            'join_code.exists' => 'Dieser Raumcode existiert nicht.',
-            'join_code.size' => 'Der Raumcode muss aus sechs Zeichen bestehen.',
-            'player_name.required' => 'Bitte hinterlege in der Hub-App einen Anzeigenamen.',
-        ];
-    }
-
-    protected function failedValidation(Validator $validator): never
-    {
-        $message = $validator->errors()->first();
-        $showLoginAction = $this->user() === null
-            && $message === self::PLAYER_NAME_TAKEN_MESSAGE;
-
-        if ($showLoginAction) {
-            $this->session()->put('url.intended', $this->fullUrl());
-        }
-
-        throw new HttpResponseException(
-            Inertia::render('embedded/Error', [
-                'message' => $message,
-                'showLoginAction' => $showLoginAction,
-            ])->toResponse($this)->setStatusCode(422),
-        );
-    }
-}

app/Http/Requests/UpdateRoomPermissionsRequest.php

@@ -2,10 +2,12 @@
 
 namespace App\Http\Requests;
 
+use App\Models\Player;
 use App\Models\Room;
+use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Foundation\Http\FormRequest;
 
-class UpdateRoomSettingsRequest extends FormRequest
+class UpdateRoomPermissionsRequest extends FormRequest
 {
     /**
      * Determine if the user is authorized to make this request.
@@ -13,21 +15,23 @@ class UpdateRoomSettingsRequest extends FormRequest
     public function authorize(): bool
     {
         $room = $this->route('room');
+        $player = $this->attributes->get('currentPlayer');
 
         return $room instanceof Room
-            && $this->user()?->id === $room->owner_id;
+            && $player instanceof Player
+            && $player->room_id === $room->id
+            && $player->is_moderator;
     }
 
     /**
      * Get the validation rules that apply to the request.
      *
-     * @return array<string, array<int, string>>
+     * @return array<string, ValidationRule|array<mixed>|string>
      */
     public function rules(): array
     {
         return [
-            'allow_participants_to_manage_rounds' => ['required', 'boolean'],
+            'allow_participant_controls' => ['required', 'boolean:strict'],
-            'is_persistent' => ['required', 'boolean'],
         ];
     }
 }

app/Http/Resources/CurrentPlayerResource.php

@@ -19,7 +19,6 @@ class CurrentPlayerResource extends JsonResource
 
         return [
             'id' => $player->id,
-            'instance_id' => $player->active_instance_id,
             'name' => $player->name,
             'is_moderator' => $player->is_moderator,
             'current_vote' => $pageData->currentVote,

app/Http/Resources/DashboardRoomResource.php

@@ -18,17 +18,7 @@ class DashboardRoomResource extends JsonResource
             'join_code' => $this->resource->join_code,
             'current_round' => $this->resource->current_round,
             'players_count' => $this->resource->players_count,
-            'players' => $this->resource->relationLoaded('players')
+            'active_player_count' => $this->resource->active_player_count,
-                ? $this->resource->players
-                    ->map(fn ($player): array => [
-                        'id' => $player->id,
-                        'name' => $player->name,
-                        'is_moderator' => $player->is_moderator,
-                        'is_owner' => $player->user_id === $this->resource->owner_id,
-                    ])
-                    ->values()
-                    ->all()
-                : [],
             'last_activity_at' => $this->resource->last_activity_at?->toIso8601String(),
             'closed_at' => $this->resource->closed_at?->toIso8601String(),
         ];

app/Http/Resources/RoomResource.php

@@ -26,8 +26,7 @@ class RoomResource extends JsonResource
             'current_round' => $room->current_round,
             'revealed' => $room->revealed_at !== null,
             'state_version' => $room->state_version,
-            'allow_participants_to_manage_rounds' => $room->allow_participants_to_manage_rounds,
+            'allow_participant_controls' => $room->allow_participant_controls,
-            'is_persistent' => $room->is_persistent,
             'statistics' => $pageData->statistics,
             'deck' => (new RoomDeckResource($room->deck_config))->resolve($request),
             'players' => $room->players

app/Jobs/CloseInactiveRooms.php

@@ -21,7 +21,6 @@ class CloseInactiveRooms implements ShouldQueue
 
         Room::query()
             ->whereNull('closed_at')
-            ->where('is_persistent', false)
             ->where(function ($query) use ($guestCutoff, $accountCutoff): void {
                 $query
                     ->where(function ($query) use ($guestCutoff): void {
@@ -41,12 +40,7 @@ class CloseInactiveRooms implements ShouldQueue
                             ->lockForUpdate()
                             ->find((string) $roomId);
 
-                        if (
+                        if ($room === null || $room->isClosed() || $room->last_activity_at === null) {
-                            $room === null
-                            || $room->isClosed()
-                            || $room->is_persistent
-                            || $room->last_activity_at === null
-                        ) {
                             return null;
                         }
 

app/Jobs/MarkInactivePlayers.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\Player;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Queue\Queueable;
+
+class MarkInactivePlayers implements ShouldQueue
+{
+    use Queueable;
+
+    public function handle(): void
+    {
+        Player::query()
+            ->whereNull('inactive_at')
+            ->where('last_seen_at', '<=', now()->subHour())
+            ->update([
+                'inactive_at' => now(),
+            ]);
+    }
+}

app/Jobs/RemoveAbsentPlayers.php

@@ -1,76 +0,0 @@
-<?php
-
-namespace App\Jobs;
-
-use App\Enums\RoomStateChange;
-use App\Events\RoomStateChanged;
-use App\Models\Player;
-use App\Models\Room;
-use App\Services\Rooms\RoomRealtimeStateService;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Foundation\Queue\Queueable;
-use Illuminate\Support\Facades\DB;
-
-class RemoveAbsentPlayers implements ShouldQueue
-{
-    use Queueable;
-
-    public function handle(RoomRealtimeStateService $realtimeState): void
-    {
-        $cutoff = now()->subHour();
-
-        Player::query()
-            ->where(function ($query) use ($cutoff): void {
-                $query->where('last_seen_at', '<=', $cutoff)
-                    ->orWhere(function ($query) use ($cutoff): void {
-                        $query->whereNull('last_seen_at')
-                            ->where('created_at', '<=', $cutoff);
-                    });
-            })
-            ->select(['id', 'room_id'])
-            ->chunkById(100, function ($players) use ($cutoff, $realtimeState): void {
-                foreach ($players as $player) {
-                    $room = DB::transaction(function () use ($player, $cutoff): ?Room {
-                        $room = Room::withTrashed()
-                            ->lockForUpdate()
-                            ->find($player->room_id);
-
-                        if ($room === null) {
-                            return null;
-                        }
-
-                        $currentPlayer = $room->players()
-                            ->lockForUpdate()
-                            ->find($player->id);
-
-                        if ($currentPlayer === null) {
-                            return null;
-                        }
-
-                        $lastActivity = $currentPlayer->last_seen_at ?? $currentPlayer->created_at;
-
-                        if ($lastActivity === null || $lastActivity->greaterThan($cutoff)) {
-                            return null;
-                        }
-
-                        $currentPlayer->delete();
-                        $room->update([
-                            'state_version' => $room->state_version + 1,
-                        ]);
-
-                        return $room;
-                    });
-
-                    if ($room !== null && ! $room->trashed()) {
-                        RoomStateChanged::dispatch(
-                            $room->id,
-                            $room->state_version,
-                            RoomStateChange::PlayerKicked,
-                            $realtimeState->for($room),
-                            $player->id,
-                        );
-                    }
-                }
-            });
-    }
-}

app/Models/Player.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
@@ -11,10 +12,10 @@ use Illuminate\Support\Carbon;
  * @property int $id
  * @property string $room_id
  * @property int|null $user_id
- * @property string|null $active_instance_id
  * @property string $name
  * @property bool $is_moderator
  * @property Carbon|null $last_seen_at
+ * @property Carbon|null $inactive_at
  * @property Carbon|null $created_at
  * @property Carbon|null $updated_at
  * @property-read Room $room
@@ -24,10 +25,10 @@ class Player extends Model
     protected $fillable = [
         'room_id',
         'user_id',
-        'active_instance_id',
         'name',
         'is_moderator',
         'last_seen_at',
+        'inactive_at',
     ];
 
     protected function casts(): array
@@ -35,6 +36,7 @@ class Player extends Model
         return [
             'is_moderator' => 'boolean',
             'last_seen_at' => 'datetime',
+            'inactive_at' => 'datetime',
         ];
     }
 
@@ -81,4 +83,14 @@ class Player extends Model
             'last_seen_at' => now(),
         ]);
     }
+
+    /**
+     * @param  Builder<Player>  $query
+     * @return Builder<Player>
+     */
+    public function scopeActive(Builder $query): Builder
+    {
+        return $query->whereNull('inactive_at');
+
+    }
 }

app/Models/Room.php

@@ -19,11 +19,10 @@ use Illuminate\Database\Eloquent\SoftDeletes;
  * @property int $current_round
  * @property CarbonImmutable|null $revealed_at
  * @property int $state_version
+ * @property bool $allow_participant_controls
  * @property CarbonImmutable|null $last_activity_at
  * @property CarbonImmutable|null $closed_at
  * @property CarbonImmutable|null $deleted_at
- * @property bool $allow_participants_to_manage_rounds
- * @property bool $is_persistent
  * @property int $players_count
  */
 class Room extends Model
@@ -37,15 +36,9 @@ class Room extends Model
         'deck_config',
         'revealed_at',
         'state_version',
+        'allow_participant_controls',
         'last_activity_at',
         'closed_at',
-        'allow_participants_to_manage_rounds',
-        'is_persistent',
-    ];
-
-    protected $attributes = [
-        'allow_participants_to_manage_rounds' => false,
-        'is_persistent' => false,
     ];
 
     protected function casts(): array
@@ -53,15 +46,18 @@ class Room extends Model
         return [
             'current_round' => 'integer',
             'state_version' => 'integer',
+            'allow_participant_controls' => 'boolean',
             'revealed_at' => 'immutable_datetime',
             'last_activity_at' => 'immutable_datetime',
             'closed_at' => 'immutable_datetime',
             'deck_config' => 'array',
-            'allow_participants_to_manage_rounds' => 'boolean',
-            'is_persistent' => 'boolean',
         ];
     }
 
+    protected $attributes = [
+        'allow_participant_controls' => false,
+    ];
+
     protected static function booted(): void
     {
         static::creating(function (Room $room) {
@@ -93,6 +89,12 @@ class Room extends Model
 
     }
 
+    /** @return HasMany<Player, $this> */
+    public function activePlayers(): HasMany
+    {
+        return $this->hasMany(Player::class)->whereNull('inactive_at');
+    }
+
     /** @return BelongsTo<User, $this> */
     public function owner(): BelongsTo
     {

app/Services/Rooms/DashboardRoomService.php

@@ -15,13 +15,8 @@ class DashboardRoomService
     {
         $ownedRooms = $user
             ->ownedRooms()
-            ->with([
-                'players' => fn ($query) => $query
-                    ->select(['id', 'room_id', 'user_id', 'name', 'is_moderator', 'created_at'])
-                    ->orderByDesc('is_moderator')
-                    ->orderBy('created_at'),
-            ])
             ->withCount('players')
+            ->withCount(['activePlayers as active_player_count'])
             ->orderByRaw('closed_at IS NOT NULL')
             ->orderByDesc('last_activity_at')
             ->get();
@@ -29,6 +24,7 @@ class DashboardRoomService
         $favoriteRooms = $user
             ->favoriteRooms()
             ->withCount('players')
+            ->withCount(['activePlayers as active_player_count'])
             ->orderByRaw('closed_at IS NOT NULL')
             ->orderByDesc('last_activity_at')
             ->get();

app/Services/Rooms/RoomEmoteService.php

@@ -29,17 +29,15 @@ class RoomEmoteService
             ]);
         }
 
-        if (! $player->isModerator()) {
+        $rateLimitKey = "room-emote:{$room->id}:{$player->id}";
-            $rateLimitKey = "room-emote:{$room->id}:{$player->id}";
 
-            abort_if(
+        abort_if(
-                RateLimiter::tooManyAttempts($rateLimitKey, 10),
+            RateLimiter::tooManyAttempts($rateLimitKey, 10),
-                429,
+            429,
-                'Bitte warte kurz, bevor du erneut wirfst.',
+            'Bitte warte kurz, bevor du erneut wirfst.',
-            );
+        );
 
-            RateLimiter::hit($rateLimitKey, 10);
+        RateLimiter::hit($rateLimitKey, 10);
-        }
 
         PaperBallThrown::dispatch(
             Str::uuid()->toString(),

app/Services/Rooms/RoomPageService.php

@@ -20,6 +20,7 @@ class RoomPageService
 
         $room->load([
             'players' => fn ($query) => $query
+                ->active()
                 ->select(['id', 'room_id', 'user_id', 'name', 'is_moderator', 'created_at'])
                 ->orderByDesc('is_moderator')
                 ->orderBy('created_at'),

app/Services/Rooms/RoomParticipationService.php

@@ -80,6 +80,7 @@ class RoomParticipationService
             } else {
                 $player->update([
                     'last_seen_at' => now(),
+                    'inactive_at' => null,
                 ]);
             }
 
@@ -100,229 +101,4 @@ class RoomParticipationService
 
         return [$room, $player];
     }
-
-    public function joinEmbedded(
-        Room $room,
-        ?User $user,
-        string $playerName,
-        mixed $sessionPlayerId,
-    ): Player {
-        [$player, $change, $stateVersion] = DB::transaction(function () use ($room, $user, $playerName, $sessionPlayerId): array {
-            $lockedRoom = Room::query()
-                ->lockForUpdate()
-                ->findOrFail($room->id);
-
-            if ($lockedRoom->isClosed()) {
-                throw ValidationException::withMessages([
-                    'join_code' => 'Dieser Raum ist geschlossen.',
-                ]);
-            }
-
-            $player = $this->findExistingEmbeddedPlayer(
-                $lockedRoom,
-                $user,
-                $sessionPlayerId,
-            );
-
-            $nameIsTaken = $lockedRoom->players()
-                ->where('name', $playerName)
-                ->when(
-                    $player !== null,
-                    fn ($query) => $query->whereKeyNot($player->id),
-                )
-                ->exists();
-
-            if ($nameIsTaken) {
-                throw ValidationException::withMessages([
-                    'player_name' => 'Dieser Anzeigename ist in dem Raum bereits vorhanden.',
-                ]);
-            }
-
-            $change = null;
-
-            if ($player === null) {
-                $player = $lockedRoom->players()->create([
-                    'user_id' => $user?->id,
-                    'name' => $playerName,
-                    'is_moderator' => false,
-                    'last_seen_at' => now(),
-                ]);
-                $change = RoomStateChange::PlayerJoined;
-            } else {
-                if ($player->name !== $playerName) {
-                    $change = RoomStateChange::PlayerUpdated;
-                }
-
-                $updates = [
-                    'name' => $playerName,
-                    'last_seen_at' => now(),
-                ];
-
-                if (
-                    $user !== null
-                    && $player->user_id === null
-                    && ! $lockedRoom->players()
-                        ->where('user_id', $user->id)
-                        ->whereKeyNot($player->id)
-                        ->exists()
-                ) {
-                    $updates['user_id'] = $user->id;
-                }
-
-                $player->update($updates);
-            }
-
-            if ($change === null) {
-                return [$player, null, null];
-            }
-
-            $lockedRoom->update([
-                'last_activity_at' => now(),
-                'state_version' => $lockedRoom->state_version + 1,
-            ]);
-
-            return [$player, $change, $lockedRoom->state_version];
-        });
-
-        if ($change instanceof RoomStateChange && is_int($stateVersion)) {
-            RoomStateChanged::dispatch(
-                $room->id,
-                $stateVersion,
-                $change,
-                $this->realtimeState->for($room),
-            );
-        }
-
-        return $player;
-    }
-
-    private function findExistingEmbeddedPlayer(
-        Room $room,
-        ?User $user,
-        mixed $sessionPlayerId,
-    ): ?Player {
-        if ($user !== null) {
-            $userPlayer = $room->players()
-                ->where('user_id', $user->id)
-                ->lockForUpdate()
-                ->first();
-
-            if ($userPlayer !== null) {
-                return $userPlayer;
-            }
-        }
-
-        if (is_numeric($sessionPlayerId)) {
-            $sessionPlayer = $room->players()
-                ->whereKey((int) $sessionPlayerId)
-                ->lockForUpdate()
-                ->first();
-
-            if ($sessionPlayer !== null) {
-                return $sessionPlayer;
-            }
-        }
-
-        return null;
-    }
-
-    public function activateInstance(Room $room, Player $player, string $instanceId): Player
-    {
-        [$activePlayer, $replacedInstanceId, $stateVersion] = DB::transaction(function () use ($room, $player, $instanceId): array {
-            $lockedRoom = Room::query()
-                ->lockForUpdate()
-                ->findOrFail($room->id);
-            $lockedPlayer = $lockedRoom->players()
-                ->lockForUpdate()
-                ->findOrFail($player->id);
-
-            if ($lockedPlayer->active_instance_id === $instanceId) {
-                return [$lockedPlayer, null, null];
-            }
-
-            $replacedInstanceId = $lockedPlayer->active_instance_id;
-            $lockedPlayer->update([
-                'active_instance_id' => $instanceId,
-                'last_seen_at' => now(),
-            ]);
-
-            if ($replacedInstanceId === null) {
-                return [$lockedPlayer, null, null];
-            }
-
-            $lockedRoom->update([
-                'last_activity_at' => now(),
-                'state_version' => $lockedRoom->state_version + 1,
-            ]);
-
-            return [$lockedPlayer, $replacedInstanceId, $lockedRoom->state_version];
-        });
-
-        if (is_string($replacedInstanceId) && is_int($stateVersion)) {
-            RoomStateChanged::dispatch(
-                $room->id,
-                $stateVersion,
-                RoomStateChange::PlayerInstanceReplaced,
-                $this->realtimeState->for($room),
-                $activePlayer->id,
-                $replacedInstanceId,
-            );
-        }
-
-        return $activePlayer;
-    }
-
-    public function kick(
-        Room $room,
-        Player $player,
-        ?User $user,
-        ?Player $currentPlayer,
-    ): void {
-        $stateVersion = DB::transaction(function () use ($room, $player, $user, $currentPlayer): int {
-            $lockedRoom = Room::query()
-                ->lockForUpdate()
-                ->findOrFail($room->id);
-
-            $lockedCurrentPlayer = $currentPlayer === null
-                ? null
-                : $lockedRoom->players()
-                    ->lockForUpdate()
-                    ->find($currentPlayer->id);
-            $isOwner = $user !== null && $lockedRoom->owner_id === $user->id;
-            $participantCanManage = ! $lockedRoom->isClosed()
-                && $lockedCurrentPlayer !== null
-                && ($lockedCurrentPlayer->is_moderator
-                    || $lockedRoom->allow_participants_to_manage_rounds);
-
-            abort_unless($isOwner || $participantCanManage, 403);
-
-            $lockedPlayer = $lockedRoom->players()
-                ->lockForUpdate()
-                ->findOrFail($player->id);
-
-            abort_if(
-                $lockedPlayer->is_moderator
-                || ($lockedRoom->owner_id !== null
-                    && $lockedPlayer->user_id === $lockedRoom->owner_id)
-                || $lockedCurrentPlayer?->id === $lockedPlayer->id,
-                403,
-            );
-
-            $lockedPlayer->delete();
-            $lockedRoom->update([
-                'last_activity_at' => now(),
-                'state_version' => $lockedRoom->state_version + 1,
-            ]);
-
-            return $lockedRoom->state_version;
-        });
-
-        RoomStateChanged::dispatch(
-            $room->id,
-            $stateVersion,
-            RoomStateChange::PlayerKicked,
-            $this->realtimeState->for($room),
-            $player->id,
-        );
-    }
 }

app/Services/Rooms/RoomPermissionService.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Services\Rooms;
+
+use App\Enums\RoomStateChange;
+use App\Events\RoomStateChanged;
+use App\Models\Room;
+use Illuminate\Support\Facades\DB;
+
+class RoomPermissionService
+{
+    public function __construct(
+        private readonly RoomRealtimeStateService $realtimeState,
+    ) {}
+
+    public function updateParticipantControls(Room $room, bool $allowParticipantControls): void
+    {
+        [$stateVersion, $wasChanged] = DB::transaction(function () use ($room, $allowParticipantControls): array {
+            $lockedRoom = Room::query()
+                ->lockForUpdate()
+                ->findOrFail($room->id);
+
+            if ($lockedRoom->allow_participant_controls === $allowParticipantControls) {
+                return [$lockedRoom->state_version, false];
+            }
+
+            $lockedRoom->update([
+                'allow_participant_controls' => $allowParticipantControls,
+                'last_activity_at' => now(),
+                'state_version' => $lockedRoom->state_version + 1,
+            ]);
+
+            return [$lockedRoom->state_version, true];
+        });
+
+        if (! $wasChanged) {
+            return;
+        }
+
+        RoomStateChanged::dispatch(
+            $room->id,
+            $stateVersion,
+            RoomStateChange::PermissionsUpdated,
+            $this->realtimeState->for($room),
+        );
+    }
+}

app/Services/Rooms/RoomPlayerInstanceService.php

@@ -1,25 +0,0 @@
-<?php
-
-namespace App\Services\Rooms;
-
-use Illuminate\Http\Request;
-use Illuminate\Support\Str;
-
-class RoomPlayerInstanceService
-{
-    private const string SESSION_KEY = 'room_player_instance_id';
-
-    public function for(Request $request): string
-    {
-        $instanceId = $request->session()->get(self::SESSION_KEY);
-
-        if (is_string($instanceId) && Str::isUuid($instanceId)) {
-            return $instanceId;
-        }
-
-        $instanceId = (string) Str::uuid();
-        $request->session()->put(self::SESSION_KEY, $instanceId);
-
-        return $instanceId;
-    }
-}

app/Services/Rooms/RoomRealtimeStateService.php

@@ -15,7 +15,7 @@ class RoomRealtimeStateService
      *     current_round: int,
      *     revealed: bool,
      *     state_version: int,
-     *     allow_participants_to_manage_rounds: bool,
+     *     allow_participant_controls: bool,
      *     statistics: array{average: string|null, median: string|null}|null,
      *     players: array<int, array{
      *         id: int,
@@ -32,6 +32,7 @@ class RoomRealtimeStateService
         $room->refresh();
         $room->load([
             'players' => fn ($query) => $query
+                ->active()
                 ->select(['id', 'room_id', 'user_id', 'name', 'is_moderator', 'created_at'])
                 ->orderByDesc('is_moderator')
                 ->orderBy('created_at'),
@@ -44,7 +45,7 @@ class RoomRealtimeStateService
             'current_round' => $room->current_round,
             'revealed' => $room->revealed_at !== null,
             'state_version' => $room->state_version,
-            'allow_participants_to_manage_rounds' => $room->allow_participants_to_manage_rounds,
+            'allow_participant_controls' => $room->allow_participant_controls,
             'statistics' => $this->statistics->currentRound($room),
             'players' => $room->players
                 ->map(function ($player) use ($room): array {

app/Services/Rooms/RoomSettingsService.php

@@ -1,50 +0,0 @@
-<?php
-
-namespace App\Services\Rooms;
-
-use App\Enums\RoomStateChange;
-use App\Events\RoomStateChanged;
-use App\Models\Room;
-use App\Models\User;
-use Illuminate\Support\Facades\DB;
-
-class RoomSettingsService
-{
-    public function __construct(
-        private readonly RoomRealtimeStateService $realtimeState,
-    ) {}
-
-    /** @param array{allow_participants_to_manage_rounds: bool, is_persistent: bool} $settings */
-    public function update(Room $room, User $user, array $settings): void
-    {
-        $stateVersion = DB::transaction(function () use ($room, $user, $settings): ?int {
-            $lockedRoom = Room::query()
-                ->lockForUpdate()
-                ->findOrFail($room->id);
-
-            abort_unless($lockedRoom->owner_id === $user->id, 403);
-
-            $lockedRoom->fill($settings);
-
-            if (! $lockedRoom->isDirty()) {
-                return null;
-            }
-
-            $lockedRoom->state_version++;
-            $lockedRoom->save();
-
-            return $lockedRoom->state_version;
-        });
-
-        if ($stateVersion === null) {
-            return;
-        }
-
-        RoomStateChanged::dispatch(
-            $room->id,
-            $stateVersion,
-            RoomStateChange::RoomSettingsUpdated,
-            $this->realtimeState->for($room),
-        );
-    }
-}

database/migrations/2026_08_27_133231_add_allow_participant_controls_to_rooms_table.php

@@ -12,8 +12,9 @@ return new class extends Migration
     public function up(): void
     {
         Schema::table('rooms', function (Blueprint $table) {
-            $table->boolean('allow_participants_to_manage_rounds')->default(false);
+            $table->boolean('allow_participant_controls')
-            $table->boolean('is_persistent')->default(false);
+                ->default(false)
+                ->after('state_version');
         });
     }
 
@@ -23,10 +24,7 @@ return new class extends Migration
     public function down(): void
     {
         Schema::table('rooms', function (Blueprint $table) {
-            $table->dropColumn([
+            $table->dropColumn('allow_participant_controls');
-                'allow_participants_to_manage_rounds',
-                'is_persistent',
-            ]);
         });
     }
 };

database/migrations/2026_09_03_142925_add_active_instance_id_to_players_table.php

@@ -1,28 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        Schema::table('players', function (Blueprint $table) {
-            $table->uuid('active_instance_id')->nullable()->after('user_id');
-        });
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        Schema::table('players', function (Blueprint $table) {
-            $table->dropColumn('active_instance_id');
-        });
-    }
-};

database/migrations/2026_09_24_123048_remove_previously_inactive_players.php

@@ -1,42 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Schema;
-
-return new class extends Migration
-{
-    /**
-     * Run the migrations.
-     */
-    public function up(): void
-    {
-        $cutoff = now()->subHour();
-
-        DB::table('players')
-            ->where(function ($query) use ($cutoff): void {
-                $query->whereNotNull('inactive_at')
-                    ->orWhere('last_seen_at', '<=', $cutoff)
-                    ->orWhere(function ($query) use ($cutoff): void {
-                        $query->whereNull('last_seen_at')
-                            ->where('created_at', '<=', $cutoff);
-                    });
-            })
-            ->delete();
-
-        Schema::table('players', function (Blueprint $table): void {
-            $table->dropColumn('inactive_at');
-        });
-    }
-
-    /**
-     * Reverse the migrations.
-     */
-    public function down(): void
-    {
-        Schema::table('players', function (Blueprint $table): void {
-            $table->timestamp('inactive_at')->nullable()->after('last_seen_at');
-        });
-    }
-};

docker/nginx/nginx.conf.template

@@ -38,8 +38,6 @@ http {
 
         location = /index.php {
             include /etc/nginx/fastcgi_params;
-            fastcgi_buffer_size 32k;
-            fastcgi_buffers 8 32k;
             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
             fastcgi_param HTTP_PROXY '';
             fastcgi_param HTTP_X_FORWARDED_FOR $http_x_forwarded_for;

package-lock.json

@@ -4,7 +4,6 @@
     "requires": true,
     "packages": {
         "": {
-            "name": "scrum-poker-internal",
             "dependencies": {
                 "@inertiajs/vite": "^3.0.0",
                 "@inertiajs/vue3": "^3.0.0",
@@ -4960,9 +4959,9 @@
             }
         },
         "node_modules/js-yaml": {
-            "version": "4.3.2",
+            "version": "4.3.1",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-            "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
+            "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
             "dev": true,
             "funding": [
                 {

resources/js/app.ts

@@ -9,8 +9,8 @@ const appName = import.meta.env.VITE_APP_NAME || 'Laravel';
 createInertiaApp({
     title: (title) => (title ? `${title} - ${appName}` : appName),
 
-    layout: (name) => {
+    layout: () => {
-        return name.startsWith('embedded/') ? null : PublicLayout;
+        return PublicLayout;
     },
 
     progress: {

resources/js/components/MyRooms.vue

@@ -1,12 +1,6 @@
 <script setup lang="ts">
 import { Link, useForm } from '@inertiajs/vue3';
-import {
+import { DoorOpen, Plus, Trash2 } from '@lucide/vue';
-    DoorOpen,
-    Plus,
-    Settings as SettingsIcon,
-    Trash2,
-    UserMinus,
-} from '@lucide/vue';
 import { ref } from 'vue';
 
 import DashboardRoomCard from '@/components/dashboard/DashboardRoomCard.vue';
@@ -19,23 +13,12 @@ import {
     DialogTitle,
 } from '@/components/ui/dialog';
 import { create, destroy, reopen, show } from '@/routes/room';
-import { destroy as kickRoomPlayer } from '@/routes/room/player';
+import type { DashboardRoom, OwnedRoomListProps } from '@/types/dashboard';
-import { edit as roomSettings } from '@/routes/room/settings';
-import type {
-    DashboardRoom,
-    DashboardRoomPlayer,
-    OwnedRoomListProps,
-} from '@/types/dashboard';
 
 defineProps<OwnedRoomListProps>();
 
 const selectedRoom = ref<DashboardRoom | null>(null);
-const selectedPlayer = ref<{
-    room: DashboardRoom;
-    player: DashboardRoomPlayer;
-} | null>(null);
 const deleteForm = useForm({});
-const kickForm = useForm({});
 
 function setDeleteDialogOpen(open: boolean): void {
     if (!open && !deleteForm.processing) {
@@ -43,12 +26,6 @@ function setDeleteDialogOpen(open: boolean): void {
     }
 }
 
-function setKickDialogOpen(open: boolean): void {
-    if (!open && !kickForm.processing) {
-        selectedPlayer.value = null;
-    }
-}
-
 function deleteRoom(): void {
     if (selectedRoom.value === null || deleteForm.processing) {
         return;
@@ -61,25 +38,6 @@ function deleteRoom(): void {
         },
     });
 }
-
-function kickPlayer(): void {
-    if (selectedPlayer.value === null || kickForm.processing) {
-        return;
-    }
-
-    kickForm.delete(
-        kickRoomPlayer({
-            room: selectedPlayer.value.room.id,
-            player: selectedPlayer.value.player.id,
-        }).url,
-        {
-            preserveScroll: true,
-            onSuccess: () => {
-                selectedPlayer.value = null;
-            },
-        },
-    );
-}
 </script>
 
 <template>
@@ -133,14 +91,6 @@ function kickPlayer(): void {
                         Raum öffnen
                     </Link>
 
-                    <Link
-                        :href="roomSettings(room.id)"
-                        class="inline-flex items-center gap-2 rounded-md px-3 py-2 text-sm font-semibold transition hover:bg-slate-700"
-                    >
-                        <SettingsIcon class="size-4" />
-                        Einstellungen
-                    </Link>
-
                     <button
                         type="button"
                         class="inline-flex items-center gap-2 rounded-md px-3 py-2 text-sm font-semibold text-rose-300 transition hover:bg-rose-500/80"
@@ -149,56 +99,6 @@ function kickPlayer(): void {
                         <Trash2 class="size-4" />
                         Raum löschen
                     </button>
-
-                    <div
-                        class="mt-2 w-full rounded-md border border-slate-700 bg-slate-900/40 p-3"
-                    >
-                        <h3 class="text-sm font-semibold">Teilnehmer</h3>
-
-                        <ul
-                            v-if="room.players.length > 0"
-                            class="mt-2 flex flex-col gap-2"
-                        >
-                            <li
-                                v-for="player in room.players"
-                                :key="player.id"
-                                class="flex items-center justify-between gap-3 rounded-md bg-slate-800 px-3 py-2"
-                            >
-                                <span class="min-w-0">
-                                    <span
-                                        class="block truncate text-sm"
-                                        :class="
-                                            player.is_moderator
-                                                ? 'text-amber-300'
-                                                : 'text-slate-100'
-                                        "
-                                    >
-                                        {{ player.name }}
-                                    </span>
-                                </span>
-
-                                <span
-                                    v-if="player.is_owner"
-                                    class="shrink-0 text-xs text-slate-400"
-                                >
-                                    Du
-                                </span>
-                                <button
-                                    v-else
-                                    type="button"
-                                    class="inline-flex shrink-0 items-center gap-1.5 rounded-md px-2.5 py-1.5 text-xs font-semibold text-rose-300 transition hover:bg-rose-500/20 hover:text-rose-200"
-                                    @click="selectedPlayer = { room, player }"
-                                >
-                                    <UserMinus class="size-3.5" />
-                                    Kicken
-                                </button>
-                            </li>
-                        </ul>
-
-                        <p v-else class="mt-2 text-sm text-slate-400">
-                            Aktuell sind keine Teilnehmer im Raum.
-                        </p>
-                    </div>
                 </template>
             </DashboardRoomCard>
         </div>
@@ -264,42 +164,5 @@ function kickPlayer(): void {
                 </DialogFooter>
             </DialogContent>
         </Dialog>
-
-        <Dialog
-            :open="selectedPlayer !== null"
-            @update:open="setKickDialogOpen"
-        >
-            <DialogContent
-                class="border-slate-700 bg-slate-800 text-slate-100 sm:max-w-md"
-            >
-                <DialogHeader>
-                    <DialogTitle>Teilnehmer wirklich kicken?</DialogTitle>
-                    <DialogDescription class="text-slate-300">
-                        {{ selectedPlayer?.player.name }} wird aus „{{
-                            selectedPlayer?.room.title ?? 'Scrum Poker'
-                        }}“ entfernt und zur Startseite weitergeleitet.
-                    </DialogDescription>
-                </DialogHeader>
-
-                <DialogFooter class="gap-6 space-x-4 sm:gap-0">
-                    <button
-                        type="button"
-                        class="rounded-md border border-slate-600 px-4 py-2 text-sm font-semibold text-slate-200 transition hover:bg-slate-700"
-                        :disabled="kickForm.processing"
-                        @click="selectedPlayer = null"
-                    >
-                        Abbrechen
-                    </button>
-                    <button
-                        type="button"
-                        class="rounded-md bg-rose-600 px-4 py-2 text-sm font-semibold text-white transition hover:bg-rose-500 disabled:opacity-50"
-                        :disabled="kickForm.processing"
-                        @click="kickPlayer"
-                    >
-                        {{ kickForm.processing ? 'Wird entfernt …' : 'Kicken' }}
-                    </button>
-                </DialogFooter>
-            </DialogContent>
-        </Dialog>
     </section>
 </template>

resources/js/components/dashboard/DashboardRoomCard.vue

@@ -47,7 +47,8 @@ function formatDate(value: string | null): string {
         <div class="mt-5 grid grid-cols-2 gap-3 text-sm text-muted-foreground">
             <span class="inline-flex items-center gap-2">
                 <Users class="size-4" />
-                {{ room.players_count }} Spieler
+                {{ room.players_count }} Spieler /
+                {{ room.active_player_count }} aktiv
             </span>
             <span>Runde {{ room.current_round }}</span>
             <span class="col-span-2 inline-flex items-center gap-2">

resources/js/components/rooms/RoomExperience.vue

@@ -1,98 +0,0 @@
-<script setup lang="ts">
-import { Head, usePage } from '@inertiajs/vue3';
-import { computed, ref } from 'vue';
-
-import RoomHeader from '@/components/rooms/RoomHeader.vue';
-import RoomRetentionNotice from '@/components/rooms/RoomRetentionNotice.vue';
-import RoomTable from '@/components/rooms/RoomTable.vue';
-import RoomVoteDeck from '@/components/rooms/RoomVoteDeck.vue';
-import { useRoomRealtime } from '@/composables/useRoomRealtime';
-import type { RoomExperienceProps } from '@/types/room';
-
-const props = withDefaults(defineProps<RoomExperienceProps>(), {
-    embedded: false,
-});
-
-const page = usePage();
-const presenterMode = ref(false);
-const roomNotice = computed(() => page.props.roomNotice);
-const isAuthenticated = computed(() => page.props.auth.user !== null);
-const embeddedBackgroundColor = computed(() => {
-    if (!props.embedded) {
-        return undefined;
-    }
-
-    const backgroundColor = new URL(
-        page.url,
-        'https://embedded.invalid',
-    ).searchParams.get('background_color');
-
-    return backgroundColor && /^#[0-9a-f]{6}$/i.test(backgroundColor)
-        ? backgroundColor
-        : undefined;
-});
-const canFavorite = computed(
-    () => !props.embedded && page.props.auth.user?.id != props.room.owner_id,
-);
-
-const {
-    room: realtimeRoom,
-    currentPlayer: realtimeCurrentPlayer,
-    setCurrentVote,
-} = useRoomRealtime(
-    () => props.room,
-    () => props.currentPlayer,
-);
-</script>
-
-<template>
-    <Head :title="realtimeRoom.title ?? 'Scrum Poker'" />
-
-    <main
-        class="min-h-svh bg-slate-900 px-3 py-6 text-white sm:px-6 md:flex md:min-h-0 md:flex-col md:overflow-hidden lg:px-10"
-        :style="
-            embeddedBackgroundColor
-                ? { backgroundColor: embeddedBackgroundColor }
-                : undefined
-        "
-        :class="
-            embedded
-                ? 'md:h-dvh'
-                : '-m-6 min-h-[calc(100svh-4rem)] md:h-[calc(100dvh-4rem-1px)]'
-        "
-    >
-        <RoomRetentionNotice v-if="roomNotice" :notice="roomNotice" />
-
-        <RoomHeader
-            :id="realtimeRoom.id"
-            :title="realtimeRoom.title"
-            :join_code="realtimeRoom.join_code"
-            :is_favorite="realtimeRoom.is_favorite"
-            :players="realtimeRoom.players"
-            :can-favorite="canFavorite"
-            :can-manage-participants="
-                realtimeCurrentPlayer.is_moderator ||
-                realtimeRoom.allow_participants_to_manage_rounds
-            "
-            :current-player-id="realtimeCurrentPlayer.id"
-            :can-logout="embedded && isAuthenticated"
-            :player-name="realtimeCurrentPlayer.name"
-            v-model:presenter-mode="presenterMode"
-        />
-
-        <RoomTable
-            :room="realtimeRoom"
-            :current-player="realtimeCurrentPlayer"
-            :presenter-mode="presenterMode"
-        />
-
-        <RoomVoteDeck
-            :room-id="realtimeRoom.id"
-            :revealed="realtimeRoom.revealed"
-            :cards="realtimeRoom.deck.cards"
-            :current-vote="realtimeCurrentPlayer.current_vote"
-            :presenter-mode="presenterMode"
-            @vote-changed="setCurrentVote"
-        />
-    </main>
-</template>

resources/js/components/rooms/RoomHeader.vue

@@ -1,65 +1,32 @@
 <script setup lang="ts">
-import { Link, useForm } from '@inertiajs/vue3';
+import { Link, useHttp } from '@inertiajs/vue3';
-import { Check, Copy, LogOut, Settings, UserMinus, Users } from '@lucide/vue';
+import { Check, Copy } from '@lucide/vue';
-import { ref } from 'vue';
+import { ref, watch } from 'vue';
 
 import { Checkbox } from '@/components/ui/checkbox';
-import {
-    Dialog,
-    DialogContent,
-    DialogDescription,
-    DialogFooter,
-    DialogHeader,
-    DialogTitle,
-} from '@/components/ui/dialog';
-import {
-    DropdownMenu,
-    DropdownMenuContent,
-    DropdownMenuItem,
-    DropdownMenuLabel,
-    DropdownMenuTrigger,
-} from '@/components/ui/dropdown-menu';
-import { logout as embeddedLogout } from '@/routes/embedded';
 import { favorite } from '@/routes/room';
-import { destroy as kickRoomPlayer } from '@/routes/room/player';
+import { update as updatePermissions } from '@/routes/room/permissions';
-import type {
+import type { RoomHeaderEmits, RoomHeaderProps } from '@/types/room';
-    RoomHeaderEmits,
-    RoomHeaderProps,
-    RoomPlayer,
-} from '@/types/room';
 
 const props = defineProps<RoomHeaderProps>();
 const emit = defineEmits<RoomHeaderEmits>();
 
 const copied = ref(false);
-const participantsDialogOpen = ref(false);
+const allowParticipantControls = ref(props.allowParticipantControls);
-const selectedPlayer = ref<RoomPlayer | null>(null);
+const permissionRequest = useHttp(() => updatePermissions(props.id), {
-const kickForm = useForm({});
+    allow_participant_controls: props.allowParticipantControls,
+});
 
-function kickPlayer(): void {
+watch(
-    if (selectedPlayer.value === null || kickForm.processing) {
+    () => props.allowParticipantControls,
-        return;
+    (value) => {
-    }
+        allowParticipantControls.value = value;
 
-    kickForm.delete(
+        if (!permissionRequest.processing) {
-        kickRoomPlayer({
+            permissionRequest.allow_participant_controls = value;
-            room: props.id,
+        }
-            player: selectedPlayer.value.id,
+    },
-        }).url,
+);
-        {
-            preserveScroll: true,
-            onSuccess: () => {
-                selectedPlayer.value = null;
-            },
-        },
-    );
-}
-
-function setKickDialogOpen(open: boolean): void {
-    if (!open && !kickForm.processing) {
-        selectedPlayer.value = null;
-    }
-}
 
 async function copyInviteLink(): Promise<void> {
     const inviteUrl = new URL('/room/join', window.location.origin);
@@ -71,228 +38,106 @@ async function copyInviteLink(): Promise<void> {
         copied.value = false;
     }, 1_800);
 }
+
+function updateParticipantControls(value: boolean): void {
+    if (permissionRequest.processing) {
+        return;
+    }
+
+    const previousValue = allowParticipantControls.value;
+
+    allowParticipantControls.value = value;
+    permissionRequest.allow_participant_controls = value;
+
+    void permissionRequest.submit({
+        onError: () => {
+            allowParticipantControls.value = previousValue;
+            permissionRequest.allow_participant_controls = previousValue;
+        },
+    });
+}
 </script>
 
 <template>
-    <div class="contents">
+    <header
-        <header
+        class="mx-auto flex w-full max-w-6xl flex-col gap-4 sm:flex-row sm:items-center sm:justify-between"
-            class="mx-auto flex w-full max-w-6xl flex-col gap-4 sm:flex-row sm:items-center sm:justify-between"
+    >
-        >
+        <div>
-            <div>
+            <h1 class="text-2xl font-bold sm:text-3xl">
-                <h1 class="text-2xl font-bold sm:text-3xl">
+                {{ title ?? 'Scrum Poker' }}
-                    {{ title ?? 'Scrum Poker' }}
+            </h1>
-                </h1>
 
-                <Link
+            <Link
-                    v-if="canFavorite"
+                v-if="canFavorite"
-                    :href="favorite(id)"
+                :href="favorite(id)"
-                    method="post"
+                method="post"
-                    as="button"
+                as="button"
-                    class="mt-2 inline-flex items-center gap-2"
+                class="mt-2 inline-flex items-center gap-2"
-                >
+            >
-                    <span>Favorit</span>
+                <span>Favorit</span>
-                    <span class="material-icons" aria-hidden="true">
+                <span class="material-icons" aria-hidden="true">
-                        {{ is_favorite ? 'favorite' : 'favorite_border' }}
+                    {{ is_favorite ? 'favorite' : 'favorite_border' }}
+                </span>
+            </Link>
+        </div>
+
+        <div class="flex flex-col items-end gap-2">
+            <button
+                type="button"
+                class="flex w-fit items-center gap-3 rounded-xl border border-slate-700 bg-slate-800 px-4 py-2.5 text-left transition hover:bg-slate-700 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-cyan-300"
+                @click="copyInviteLink"
+            >
+                <span>
+                    <span
+                        class="block text-sm tracking-[0.18em] text-slate-400"
+                    >
+                        Raumcode
                     </span>
-                </Link>
+                    <strong class="font-mono text-lg tracking-[0.2em]">
-            </div>
+                        {{ join_code }}
+                    </strong>
+                </span>
+                <Check v-if="copied" class="size-5 text-emerald-300" />
+                <Copy v-else class="size-5 text-slate-300" />
+            </button>
 
-            <div class="flex flex-col items-end gap-2">
+            <label
-                <Link
+                v-if="isModerator"
-                    v-if="canLogout"
+                for="participant-controls"
-                    :href="
+                class="flex cursor-pointer items-center gap-2 text-sm text-slate-300"
-                        embeddedLogout({
+            >
-                            query: {
+                <Checkbox
-                                join_code,
+                    id="participant-controls"
-                                player_name: playerName,
+                    :model-value="allowParticipantControls"
-                            },
+                    :disabled="permissionRequest.processing"
-                        })
+                    @update:model-value="
+                        updateParticipantControls($event === true)
                     "
-                    method="post"
+                />
-                    as="button"
+                <span>Alle dürfen die Runde steuern</span>
-                    class="inline-flex items-center gap-2 text-sm text-slate-300 transition hover:text-white"
+            </label>
-                >
-                    <LogOut class="size-4" />
-                    Abmelden
-                </Link>
 
-                <div class="flex items-center gap-2">
+            <p
-                    <DropdownMenu v-if="canManageParticipants">
+                v-if="permissionRequest.errors.allow_participant_controls"
-                        <DropdownMenuTrigger :as-child="true">
+                class="max-w-xs text-right text-sm text-rose-300"
-                            <button
+                role="alert"
-                                type="button"
-                                class="inline-flex size-11 items-center justify-center rounded-xl border border-slate-700 bg-slate-800 text-slate-300 transition hover:bg-slate-700 hover:text-white focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-cyan-300"
-                                aria-label="Raumeinstellungen öffnen"
-                            >
-                                <Settings class="size-5" />
-                            </button>
-                        </DropdownMenuTrigger>
-                        <DropdownMenuContent
-                            align="end"
-                            class="w-52 border-slate-700 bg-slate-800 text-slate-100"
-                        >
-                            <DropdownMenuLabel class="text-slate-400">
-                                Einstellungen
-                            </DropdownMenuLabel>
-                            <DropdownMenuItem
-                                class="focus:bg-slate-700 focus:text-white"
-                                @select="participantsDialogOpen = true"
-                            >
-                                <Users class="size-4" />
-                                Teilnehmer
-                            </DropdownMenuItem>
-                        </DropdownMenuContent>
-                    </DropdownMenu>
-
-                    <button
-                        type="button"
-                        class="flex w-fit items-center gap-3 rounded-xl border border-slate-700 bg-slate-800 px-4 py-2.5 text-left transition hover:bg-slate-700 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-cyan-300"
-                        @click="copyInviteLink"
-                    >
-                        <span>
-                            <span
-                                class="block text-sm tracking-[0.18em] text-slate-400"
-                            >
-                                Raumcode
-                            </span>
-                            <strong class="font-mono text-lg tracking-[0.2em]">
-                                {{ join_code }}
-                            </strong>
-                        </span>
-                        <Check v-if="copied" class="size-5 text-emerald-300" />
-                        <Copy v-else class="size-5 text-slate-300" />
-                    </button>
-                </div>
-
-                <label
-                    for="presenter-mode"
-                    class="flex cursor-pointer items-center gap-2 text-sm text-slate-300"
-                >
-                    <Checkbox
-                        id="presenter-mode"
-                        :model-value="presenterMode"
-                        @update:model-value="
-                            emit('update:presenterMode', $event === true)
-                        "
-                    />
-                    <span>Präsentatormodus</span>
-                </label>
-            </div>
-        </header>
-
-        <Dialog v-model:open="participantsDialogOpen">
-            <DialogContent
-                class="max-h-[calc(100dvh-2rem)] overflow-hidden border-slate-700 bg-slate-800 text-slate-100 sm:max-w-xl"
-                overlay-class="bg-black/70 backdrop-blur-sm"
             >
-                <DialogHeader>
+                {{ permissionRequest.errors.allow_participant_controls }}
-                    <DialogTitle>Teilnehmer</DialogTitle>
+            </p>
-                    <DialogDescription class="text-slate-300">
-                        Verwalte die aktiven Teilnehmer in diesem Raum.
-                    </DialogDescription>
-                </DialogHeader>
 
-                <ul
+            <label
-                    v-if="players.length > 0"
+                for="presenter-mode"
-                    class="flex max-h-[min(60dvh,32rem)] flex-col gap-2 overflow-y-auto pr-1"
+                class="flex cursor-pointer items-center gap-2 text-sm text-slate-300"
-                >
-                    <li
-                        v-for="player in players"
-                        :key="player.id"
-                        class="flex items-center justify-between gap-3 rounded-md bg-slate-900/60 px-3 py-2"
-                    >
-                        <span class="min-w-0">
-                            <span
-                                class="block truncate text-sm"
-                                :class="
-                                    player.is_moderator
-                                        ? 'text-amber-300'
-                                        : 'text-slate-100'
-                                "
-                            >
-                                {{ player.name }}
-                            </span>
-                        </span>
-
-                        <span
-                            v-if="
-                                player.id === currentPlayerId ||
-                                player.is_moderator
-                            "
-                            class="shrink-0 text-xs text-slate-400"
-                        >
-                            {{
-                                player.id === currentPlayerId
-                                    ? player.is_moderator
-                                        ? 'Du · Admin'
-                                        : 'Du'
-                                    : 'Admin'
-                            }}
-                        </span>
-                        <button
-                            v-else
-                            type="button"
-                            class="inline-flex shrink-0 items-center gap-1.5 rounded-md px-2.5 py-1.5 text-xs font-semibold text-rose-300 transition hover:bg-rose-500/20 hover:text-rose-200"
-                            @click="selectedPlayer = player"
-                        >
-                            <UserMinus class="size-3.5" />
-                            Kicken
-                        </button>
-                    </li>
-                </ul>
-
-                <p v-else class="text-sm text-slate-400">
-                    Aktuell sind keine Teilnehmer im Raum.
-                </p>
-
-                <DialogFooter>
-                    <button
-                        type="button"
-                        class="rounded-md border border-slate-600 px-4 py-2 text-sm font-semibold text-slate-200 transition hover:bg-slate-700"
-                        @click="participantsDialogOpen = false"
-                    >
-                        Schließen
-                    </button>
-                </DialogFooter>
-            </DialogContent>
-        </Dialog>
-
-        <Dialog
-            :open="selectedPlayer !== null"
-            @update:open="setKickDialogOpen"
-        >
-            <DialogContent
-                class="border-slate-700 bg-slate-800 text-slate-100 sm:max-w-md"
-                overlay-class="bg-black/70 backdrop-blur-sm"
             >
-                <DialogHeader>
+                <Checkbox
-                    <DialogTitle>Teilnehmer wirklich kicken?</DialogTitle>
+                    id="presenter-mode"
-                    <DialogDescription class="text-slate-300">
+                    :model-value="presenterMode"
-                        {{ selectedPlayer?.name }} wird aus „{{
+                    @update:model-value="
-                            title ?? 'Scrum Poker'
+                        emit('update:presenterMode', $event === true)
-                        }}“ entfernt und zur Startseite weitergeleitet.
+                    "
-                    </DialogDescription>
+                />
-                </DialogHeader>
+                <span>Präsentatormodus</span>
-
+            </label>
-                <DialogFooter class="gap-6 space-x-4 sm:gap-0">
+        </div>
-                    <button
+    </header>
-                        type="button"
-                        class="rounded-md border border-slate-600 px-4 py-2 text-sm font-semibold text-slate-200 transition hover:bg-slate-700"
-                        :disabled="kickForm.processing"
-                        @click="selectedPlayer = null"
-                    >
-                        Abbrechen
-                    </button>
-                    <button
-                        type="button"
-                        class="rounded-md bg-rose-600 px-4 py-2 text-sm font-semibold text-white transition hover:bg-rose-500 disabled:opacity-50"
-                        :disabled="kickForm.processing"
-                        @click="kickPlayer"
-                    >
-                        {{ kickForm.processing ? 'Wird entfernt …' : 'Kicken' }}
-                    </button>
-                </DialogFooter>
-            </DialogContent>
-        </Dialog>
-    </div>
 </template>

resources/js/components/rooms/RoomSeat.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { CircleUserRound } from '@lucide/vue';
+import { CircleUserRound, Crown } from '@lucide/vue';
 
 import type { RoomSeatProps } from '@/types/room';
 
@@ -75,18 +75,22 @@ function playerVote(): string | null {
             :class="{ 'player-details-above': player.isTopSeat }"
         >
             <p
-                class="player-name max-w-32 text-center text-sm leading-tight font-semibold"
+                class="player-name max-w-32 text-center text-sm leading-tight font-semibold text-slate-100"
-                :class="
-                    player.is_moderator ? 'text-amber-300' : 'text-slate-100'
-                "
             >
                 {{ player.name }}
             </p>
             <div
-                v-if="isCurrentPlayer()"
+                v-if="player.is_moderator || isCurrentPlayer()"
                 class="flex flex-wrap items-center justify-center gap-x-2 gap-y-0.5 text-[11px]"
             >
-                <span class="text-cyan-300">Du</span>
+                <span
+                    v-if="player.is_moderator"
+                    class="inline-flex items-center gap-1 text-amber-300"
+                >
+                    <Crown class="size-3 fill-amber-300" aria-hidden="true" />
+                    Moderator
+                </span>
+                <span v-if="isCurrentPlayer()" class="text-cyan-300">Du</span>
             </div>
         </div>
 

resources/js/components/rooms/RoomTable.vue

@@ -21,7 +21,6 @@ const { activePaperBalls, hitPlayerIds, throwingAtPlayerId, throwPaperBall } =
     usePaperBallToss({
         roomId: () => props.room.id,
         currentPlayerId: () => props.currentPlayer.id,
-        currentPlayerIsModerator: () => props.currentPlayer.is_moderator,
         board: gameBoard,
     });
 
@@ -116,16 +115,14 @@ const voteCount = computed(
                 :revealed="room.revealed"
                 :presenter-mode="presenterMode"
                 :is-paper-ball-hit="hitPlayerIds.includes(player.id)"
-                :throw-disabled="
+                :throw-disabled="throwingAtPlayerId !== null"
-                    !currentPlayer.is_moderator && throwingAtPlayerId !== null
-                "
                 @throw-paper-ball="throwPaperBall"
             />
 
             <RoomModeratorControls
                 v-if="
                     currentPlayer.is_moderator ||
-                    room.allow_participants_to_manage_rounds
+                    room.allow_participant_controls
                 "
                 :room-id="room.id"
                 :revealed="room.revealed"

resources/js/components/ui/dialog/DialogContent.vue

@@ -16,26 +16,19 @@ defineOptions({
   inheritAttrs: false,
 })
 
-const props = withDefaults(
+const props = withDefaults(defineProps<DialogContentProps & { class?: HTMLAttributes["class"], showCloseButton?: boolean }>(), {
-  defineProps<DialogContentProps & {
+  showCloseButton: true,
-    class?: HTMLAttributes["class"]
+})
-    overlayClass?: HTMLAttributes["class"]
-    showCloseButton?: boolean
-  }>(),
-  {
-    showCloseButton: true,
-  },
-)
 const emits = defineEmits<DialogContentEmits>()
 
-const delegatedProps = reactiveOmit(props, "class", "overlayClass", "showCloseButton")
+const delegatedProps = reactiveOmit(props, "class")
 
 const forwarded = useForwardPropsEmits(delegatedProps, emits)
 </script>
 
 <template>
   <DialogPortal>
-    <DialogOverlay :class="props.overlayClass" />
+    <DialogOverlay />
     <DialogContent
       data-slot="dialog-content"
       v-bind="{ ...$attrs, ...forwarded }"

resources/js/composables/usePaperBallToss.ts

@@ -17,7 +17,6 @@ const THROW_BUTTON_COOLDOWN = 550;
 export function usePaperBallToss({
     roomId,
     currentPlayerId,
-    currentPlayerIsModerator,
     board,
 }: PaperBallTossOptions) {
     const activePaperBalls = ref<PaperBallFlight[]>([]);
@@ -36,11 +35,9 @@ export function usePaperBallToss({
     }
 
     async function throwPaperBall(targetPlayerId: number): Promise<void> {
-        const shouldApplyCooldown = !currentPlayerIsModerator();
-
         if (
             targetPlayerId === currentPlayerId() ||
-            (shouldApplyCooldown && throwingAtPlayerId.value !== null)
+            throwingAtPlayerId.value !== null
         ) {
             return;
         }
@@ -55,9 +52,7 @@ export function usePaperBallToss({
             return;
         }
 
-        if (shouldApplyCooldown) {
+        throwingAtPlayerId.value = targetPlayerId;
-            throwingAtPlayerId.value = targetPlayerId;
-        }
 
         try {
             const response = await fetch(throwPaperBallRoute(roomId()).url, {
@@ -96,13 +91,11 @@ export function usePaperBallToss({
         } catch {
             toast.error('Der Papierknäuel konnte nicht geworfen werden.');
         } finally {
-            if (shouldApplyCooldown) {
+            schedule(() => {
-                schedule(() => {
+                if (throwingAtPlayerId.value === targetPlayerId) {
-                    if (throwingAtPlayerId.value === targetPlayerId) {
+                    throwingAtPlayerId.value = null;
-                        throwingAtPlayerId.value = null;
+                }
-                    }
+            }, THROW_BUTTON_COOLDOWN);
-                }, THROW_BUTTON_COOLDOWN);
-            }
         }
     }
 

resources/js/composables/useRoomRealtime.ts

@@ -33,25 +33,6 @@ export function useRoomRealtime(
             return;
         }
 
-        if (
-            payload.change === 'player_kicked' &&
-            payload.affected_player_id === currentPlayer.value.id
-        ) {
-            router.visit(home().url, { replace: true });
-
-            return;
-        }
-
-        if (
-            payload.change === 'player_instance_replaced' &&
-            payload.affected_player_id === currentPlayer.value.id &&
-            payload.affected_instance_id === currentPlayer.value.instance_id
-        ) {
-            router.visit(home().url, { replace: true });
-
-            return;
-        }
-
         if (payload.change === 'room_closed') {
             router.visit(
                 join({ query: { join_code: room.value.join_code } }).url,

resources/js/pages/embedded/Error.vue

@@ -1,38 +0,0 @@
-<script setup lang="ts">
-import { Head, Link } from '@inertiajs/vue3';
-import { CircleAlert } from '@lucide/vue';
-
-import { login } from '@/routes';
-
-defineProps<{
-    message: string;
-    showLoginAction: boolean;
-}>();
-</script>
-
-<template>
-    <Head title="Scrum Poker nicht verfügbar" />
-
-    <main
-        class="grid min-h-svh place-items-center bg-slate-900 p-8 text-slate-100"
-    >
-        <section
-            class="flex max-w-lg flex-col items-center gap-4 rounded-2xl border border-slate-700 bg-slate-800 p-8 text-center shadow-xl"
-        >
-            <CircleAlert class="size-10 text-amber-300" />
-            <h1 class="text-2xl font-bold">Raum kann nicht geöffnet werden</h1>
-            <p class="text-slate-300">{{ message }}</p>
-            <Link
-                v-if="showLoginAction"
-                :href="login()"
-                class="inline-flex rounded-lg bg-white px-4 py-2 font-semibold text-slate-900 transition hover:bg-slate-200 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-white"
-            >
-                Anmelden
-            </Link>
-            <p class="text-sm text-slate-400">
-                Bitte ändere Raumcode oder Anzeigename auf der Home-Seite der
-                Fillibri Hub App und öffne Scrum Poker erneut.
-            </p>
-        </section>
-    </main>
-</template>

resources/js/pages/embedded/Room.vue

@@ -1,14 +0,0 @@
-<script setup lang="ts">
-import RoomExperience from '@/components/rooms/RoomExperience.vue';
-import type { RoomPageProps } from '@/types/room';
-
-const props = defineProps<RoomPageProps>();
-</script>
-
-<template>
-    <RoomExperience
-        :room="props.room"
-        :current-player="props.currentPlayer"
-        embedded
-    />
-</template>

resources/js/pages/rooms/Settings.vue

@@ -1,105 +0,0 @@
-<script setup lang="ts">
-import { Head, Link, useForm } from '@inertiajs/vue3';
-import { ArrowLeft } from '@lucide/vue';
-
-import InputError from '@/components/InputError.vue';
-import { Checkbox } from '@/components/ui/checkbox';
-import { dashboard } from '@/routes';
-import { update as updateSettings } from '@/routes/room/settings';
-import type { RoomSettingsPageProps } from '@/types/room';
-
-const props = defineProps<RoomSettingsPageProps>();
-const form = useForm({
-    allow_participants_to_manage_rounds:
-        props.room.allow_participants_to_manage_rounds,
-    is_persistent: props.room.is_persistent,
-});
-
-function submit(): void {
-    form.patch(updateSettings(props.room.id).url, {
-        preserveScroll: true,
-    });
-}
-</script>
-
-<template>
-    <Head title="Raumeinstellungen" />
-
-    <main
-        class="flex min-h-[calc(100svh-4rem)] justify-center bg-slate-900 p-4 text-slate-100 sm:p-8"
-    >
-        <section class="flex w-full max-w-2xl flex-col gap-6">
-            <Link
-                :href="dashboard()"
-                class="inline-flex w-fit items-center gap-2 text-sm text-slate-300 transition hover:text-white"
-            >
-                <ArrowLeft class="size-4" />
-                Zurück zu meinen Räumen
-            </Link>
-
-            <div>
-                <h1 class="text-2xl font-bold">Raumeinstellungen</h1>
-                <p class="mt-1 text-sm text-slate-400">
-                    {{ room.title ?? 'Scrum Poker' }} · {{ room.join_code }}
-                </p>
-            </div>
-
-            <form
-                class="flex flex-col gap-6 rounded-xl border border-slate-700 bg-slate-800 p-6"
-                @submit.prevent="submit"
-            >
-                <label class="flex cursor-pointer items-center gap-4">
-                    <Checkbox
-                        :model-value="form.allow_participants_to_manage_rounds"
-                        class="border-white"
-                        @update:model-value="
-                            form.allow_participants_to_manage_rounds =
-                                $event === true
-                        "
-                    />
-                    <span>
-                        <strong class="block"
-                            >Alle dürfen den Raum verwalten</strong
-                        >
-                        <span class="mt-1 block text-sm text-slate-400">
-                            Alle aktiven Teilnehmer, auch Gäste, dürfen Runden
-                            steuern und andere Teilnehmer aus dem Raum
-                            entfernen.
-                        </span>
-                    </span>
-                </label>
-                <InputError
-                    :message="form.errors.allow_participants_to_manage_rounds"
-                />
-
-                <label class="flex cursor-pointer items-center gap-4">
-                    <Checkbox
-                        :model-value="form.is_persistent"
-                        class="border-white"
-                        @update:model-value="
-                            form.is_persistent = $event === true
-                        "
-                    />
-                    <span>
-                        <strong class="block"
-                            >Raum dauerhaft offen halten</strong
-                        >
-                        <span class="mt-1 block text-sm text-slate-400">
-                            Der Raum wird auch nach längerer Inaktivität nicht
-                            automatisch geschlossen.
-                        </span>
-                    </span>
-                </label>
-                <InputError :message="form.errors.is_persistent" />
-
-                <button
-                    type="submit"
-                    class="inline-flex w-fit rounded-md bg-primary px-4 py-2 text-sm font-semibold text-primary-foreground transition hover:bg-primary/90 disabled:opacity-50"
-                    :disabled="form.processing"
-                >
-                    {{ form.processing ? 'Wird gespeichert …' : 'Speichern' }}
-                </button>
-            </form>
-        </section>
-    </main>
-</template>

resources/js/pages/rooms/Show.vue

@@ -1,10 +1,67 @@
 <script setup lang="ts">
-import RoomExperience from '@/components/rooms/RoomExperience.vue';
+import { Head, usePage } from '@inertiajs/vue3';
+import { computed, ref } from 'vue';
+
+import RoomHeader from '@/components/rooms/RoomHeader.vue';
+import RoomRetentionNotice from '@/components/rooms/RoomRetentionNotice.vue';
+import RoomTable from '@/components/rooms/RoomTable.vue';
+import RoomVoteDeck from '@/components/rooms/RoomVoteDeck.vue';
+import { useRoomRealtime } from '@/composables/useRoomRealtime';
 import type { RoomPageProps } from '@/types/room';
 
 const props = defineProps<RoomPageProps>();
+
+const page = usePage();
+const presenterMode = ref(false);
+const roomNotice = computed(() => page.props.roomNotice);
+const canFavorite = computed(
+    () => page.props.auth.user?.id != props.room.owner_id,
+);
+
+const {
+    room: realtimeRoom,
+    currentPlayer: realtimeCurrentPlayer,
+    setCurrentVote,
+} = useRoomRealtime(
+    () => props.room,
+    () => props.currentPlayer,
+);
 </script>
 
 <template>
-    <RoomExperience :room="props.room" :current-player="props.currentPlayer" />
+    <Head :title="realtimeRoom.title ?? 'Scrum Poker'" />
+
+    <main
+        class="-m-6 min-h-[calc(100svh-4rem)] bg-slate-900 px-3 py-6 text-white sm:px-6 md:flex md:h-[calc(100dvh-4rem-1px)] md:min-h-0 md:flex-col md:overflow-hidden lg:px-10"
+    >
+        <RoomRetentionNotice v-if="roomNotice" :notice="roomNotice" />
+
+        <RoomHeader
+            :id="realtimeRoom.id"
+            :title="realtimeRoom.title"
+            :join_code="realtimeRoom.join_code"
+            :is_favorite="realtimeRoom.is_favorite"
+            :can-favorite="canFavorite"
+            :is-moderator="realtimeCurrentPlayer.is_moderator"
+            :allow-participant-controls="
+                realtimeRoom.allow_participant_controls
+            "
+            v-model:presenter-mode="presenterMode"
+        />
+
+        <RoomTable
+            :room="realtimeRoom"
+            :current-player="realtimeCurrentPlayer"
+            :presenter-mode="presenterMode"
+        />
+
+        <RoomVoteDeck
+            :room-id="realtimeRoom.id"
+            :revealed="realtimeRoom.revealed"
+            :cards="realtimeRoom.deck.cards"
+            :current-vote="realtimeCurrentPlayer.current_vote"
+            :presenter-mode="presenterMode"
+            @vote-changed="setCurrentVote"
+        />
+    </main>
 </template>

resources/js/types/dashboard.ts

@@ -1,17 +1,10 @@
-export type DashboardRoomPlayer = {
-    id: number;
-    name: string;
-    is_moderator: boolean;
-    is_owner: boolean;
-};
-
 export type DashboardRoom = {
     id: string;
     title: string | null;
     join_code: string;
     current_round: number;
     players_count: number;
-    players: DashboardRoomPlayer[];
+    active_player_count: number;
     last_activity_at: string | null;
     closed_at: string | null;
 };

resources/js/types/emote.ts

@@ -25,7 +25,6 @@ export type PaperBallFlight = {
 export type PaperBallTossOptions = {
     roomId: () => string;
     currentPlayerId: () => number;
-    currentPlayerIsModerator: () => boolean;
     board: Ref<HTMLElement | null>;
 };
 

resources/js/types/room.ts

@@ -30,7 +30,6 @@ export type RoomPlayer = {
 
 export type CurrentRoomPlayer = {
     id: number;
-    instance_id: string;
     name: string;
     is_moderator: boolean;
     current_vote: string | null;
@@ -45,8 +44,7 @@ export type PokerRoom = {
     current_round: number;
     revealed: boolean;
     state_version: number;
-    allow_participants_to_manage_rounds: boolean;
+    allow_participant_controls: boolean;
-    is_persistent: boolean;
     statistics: RoomStatistics | null;
     deck: RoomDeck;
     players: RoomPlayer[];
@@ -67,23 +65,6 @@ export type RoomPageProps = {
     currentPlayer: CurrentRoomPlayer;
 };
 
-export type RoomExperienceProps = RoomPageProps & {
-    embedded?: boolean;
-};
-
-export type RoomSettings = Pick<
-    PokerRoom,
-    | 'id'
-    | 'title'
-    | 'join_code'
-    | 'allow_participants_to_manage_rounds'
-    | 'is_persistent'
->;
-
-export type RoomSettingsPageProps = {
-    room: RoomSettings;
-};
-
 export type CreateRoomPageProps = {
     decks: SelectableDeck[];
     defaultPlayerName: string | null;
@@ -111,14 +92,12 @@ export type RoomRetentionNoticeProps = {
 
 export type RoomHeaderProps = Pick<
     PokerRoom,
-    'id' | 'title' | 'join_code' | 'is_favorite' | 'players'
+    'id' | 'title' | 'join_code' | 'is_favorite'
 > & {
     canFavorite: boolean;
-    canManageParticipants: boolean;
+    isModerator: boolean;
-    currentPlayerId: number;
+    allowParticipantControls: boolean;
     presenterMode: boolean;
-    canLogout: boolean;
-    playerName: string;
 };
 
 export type RoomHeaderEmits = {
@@ -162,24 +141,19 @@ export type RoomVoteDeckEmits = {
 
 export type RoomStateChange =
     | 'player_joined'
-    | 'player_updated'
-    | 'player_kicked'
-    | 'player_instance_replaced'
     | 'vote_changed'
     | 'cards_revealed'
     | 'votes_reset'
     | 'next_round'
+    | 'permissions_updated'
     | 'room_reopened'
     | 'room_closed'
-    | 'room_deleted'
+    | 'room_deleted';
-    | 'room_settings_updated';
 
 export type RoomStateChangedPayload = {
     version: number;
     change: RoomStateChange;
     state: RoomRealtimeState | null;
-    affected_player_id?: number;
-    affected_instance_id?: string;
 };
 
 export type RoomRealtimeState = Pick<
@@ -187,7 +161,7 @@ export type RoomRealtimeState = Pick<
     | 'current_round'
     | 'revealed'
     | 'state_version'
-    | 'allow_participants_to_manage_rounds'
+    | 'allow_participant_controls'
     | 'statistics'
     | 'players'
 >;

routes/console.php

@@ -1,7 +1,7 @@
 <?php
 
 use App\Jobs\CloseInactiveRooms;
-use App\Jobs\RemoveAbsentPlayers;
+use App\Jobs\MarkInactivePlayers;
 use Illuminate\Foundation\DevCommands;
 use Illuminate\Support\Facades\Schedule;
 
@@ -11,6 +11,6 @@ Schedule::job(new CloseInactiveRooms)
     ->weeklyOn(1, '02:00')
     ->withoutOverlapping();
 
-Schedule::job(new RemoveAbsentPlayers)
+Schedule::job(new MarkInactivePlayers)
     ->everyFiveMinutes()
     ->withoutOverlapping();

routes/room.php

@@ -1,15 +1,12 @@
 <?php
 
-use App\Http\Controllers\EmbeddedLogoutController;
-use App\Http\Controllers\EmbeddedRoomController;
 use App\Http\Controllers\FavoriteRoomController;
 use App\Http\Controllers\RoomController;
 use App\Http\Controllers\RoomEmoteController;
 use App\Http\Controllers\RoomJoinController;
 use App\Http\Controllers\RoomLifecycleController;
+use App\Http\Controllers\RoomPermissionController;
 use App\Http\Controllers\RoomPlayerController;
-use App\Http\Controllers\RoomPlayerKickController;
-use App\Http\Controllers\RoomSettingsController;
 use App\Http\Controllers\RoundController;
 use App\Http\Controllers\VoteController;
 use App\Models\Room;
@@ -25,18 +22,7 @@ Route::get('/room/join', RoomJoinController::class)->name('room.join');
 Route::post('room/join', [RoomPlayerController::class, 'join'])->name('room.code');
 Route::post('/room', [RoomController::class, 'store'])->name('room.store');
 
-Route::get('/embedded/scrum-poker', EmbeddedRoomController::class)
-    ->name('embedded.room');
-
-Route::post('/embedded/scrum-poker/logout', EmbeddedLogoutController::class)
-    ->middleware('auth')
-    ->name('embedded.logout');
-
 Route::middleware(['auth', 'verified'])->group(function () {
-    Route::get('/rooms/{room}/settings', [RoomSettingsController::class, 'edit'])
-        ->name('room.settings.edit');
-    Route::patch('/rooms/{room}/settings', [RoomSettingsController::class, 'update'])
-        ->name('room.settings.update');
     Route::post('/rooms/{room}/reopen', [RoomLifecycleController::class, 'reopen'])
         ->name('room.reopen');
     Route::delete('/rooms/{room}', [RoomLifecycleController::class, 'destroy'])
@@ -45,9 +31,6 @@ Route::middleware(['auth', 'verified'])->group(function () {
         ->name('room.favorite');
 });
 
-Route::delete('/rooms/{room}/players/{player}', RoomPlayerKickController::class)
-    ->name('room.player.destroy');
-
 Route::middleware('room.player')->group(function () {
     Route::get('/rooms/{room}', [RoomController::class, 'show'])->name('room.show');
     Route::post('/rooms/{room}/votes', [VoteController::class, 'store'])
@@ -60,4 +43,6 @@ Route::middleware('room.player')->group(function () {
         ->name('room.reset');
     Route::post('/rooms/{room}/next-round', [RoundController::class, 'nextRound'])
         ->name('room.next-round');
+    Route::patch('/rooms/{room}/permissions', RoomPermissionController::class)
+        ->name('room.permissions.update');
 });

tests/Feature/AbsentPlayerRemovalTest.php

@@ -1,94 +0,0 @@
-<?php
-
-use App\Enums\RoomStateChange;
-use App\Events\RoomStateChanged;
-use App\Jobs\RemoveAbsentPlayers;
-use App\Models\Room;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Event;
-use Illuminate\Support\Facades\Schema;
-
-test('the player table no longer stores an inactive status', function () {
-    expect(Schema::hasColumn('players', 'inactive_at'))->toBeFalse();
-});
-
-test('the migration removes old inactive and absent players while keeping present players', function () {
-    Schema::table('players', function (Blueprint $table): void {
-        $table->timestamp('inactive_at')->nullable();
-    });
-
-    $room = Room::create([
-        'title' => 'Planning',
-        'deck_config' => ['name' => 'Fibonacci', 'cards' => []],
-    ]);
-    $previouslyInactive = $room->players()->create([
-        'name' => 'Inactive',
-        'last_seen_at' => now(),
-    ]);
-    $absent = $room->players()->create([
-        'name' => 'Nico',
-        'last_seen_at' => now()->subHours(2),
-    ]);
-    $present = $room->players()->create([
-        'name' => 'Anna',
-        'last_seen_at' => now(),
-    ]);
-
-    DB::table('players')->where('id', $previouslyInactive->id)->update(['inactive_at' => now()]);
-
-    $migration = require database_path('migrations/2026_09_24_123048_remove_previously_inactive_players.php');
-    $migration->up();
-
-    $this->assertModelMissing($previouslyInactive);
-    $this->assertModelMissing($absent);
-    $this->assertModelExists($present);
-    expect(Schema::hasColumn('players', 'inactive_at'))->toBeFalse();
-});
-
-test('the timeout removes absent players and their votes but keeps recent players', function () {
-    $room = Room::create([
-        'title' => 'Planning',
-        'current_round' => 1,
-        'deck_config' => ['name' => 'Fibonacci', 'cards' => []],
-    ]);
-    $absentPlayer = $room->players()->create([
-        'name' => 'Nico',
-        'last_seen_at' => now()->subHour(),
-    ]);
-    $recentPlayer = $room->players()->create([
-        'name' => 'Anna',
-        'last_seen_at' => now()->subHour()->addSecond(),
-    ]);
-    $vote = $absentPlayer->votes()->create([
-        'room_id' => $room->id,
-        'round' => $room->current_round,
-        'value' => '3',
-    ]);
-    $previousVersion = $room->fresh()->state_version;
-
-    Event::fake([RoomStateChanged::class]);
-
-    app()->call([new RemoveAbsentPlayers, 'handle']);
-    app()->call([new RemoveAbsentPlayers, 'handle']);
-
-    $this->assertModelMissing($absentPlayer);
-    $this->assertModelMissing($vote);
-    $this->assertModelExists($recentPlayer);
-    expect($room->fresh()->state_version)->toBe($previousVersion + 1);
-
-    Event::assertDispatched(
-        RoomStateChanged::class,
-        fn (RoomStateChanged $event): bool => $event->change === RoomStateChange::PlayerKicked
-            && $event->affectedPlayerId === $absentPlayer->id
-            && collect($event->state['players'])->doesntContain('id', $absentPlayer->id),
-    );
-    Event::assertDispatchedTimes(RoomStateChanged::class, 1);
-
-    $this->post(route('room.code'), [
-        'join_code' => $room->join_code,
-        'player_name' => 'Nico',
-    ])->assertRedirect(route('room.show', $room));
-
-    expect($room->players()->where('name', 'Nico')->sole()->id)->not->toBe($absentPlayer->id);
-});

tests/Feature/EmbeddedRoomTest.php

@@ -1,246 +0,0 @@
-<?php
-
-use App\Enums\RoomStateChange;
-use App\Events\RoomStateChanged;
-use App\Models\Room;
-use App\Models\User;
-use Illuminate\Support\Facades\Event;
-use Inertia\Testing\AssertableInertia as Assert;
-
-function createEmbeddedRoom(array $attributes = []): Room
-{
-    return Room::create([
-        'title' => 'Fillibri Planning',
-        'deck_config' => [
-            'name' => 'Fibonacci',
-            'cards' => [
-                ['key' => '3', 'label' => '3'],
-                ['key' => '5', 'label' => '5'],
-            ],
-        ],
-        ...$attributes,
-    ]);
-}
-
-test('a guest automatically joins the embedded room', function () {
-    $room = createEmbeddedRoom();
-    $response = $this->get(route('embedded.room', [
-        'join_code' => strtolower($room->join_code),
-        'player_name' => ' Nico ',
-    ]))
-        ->assertOk()
-        ->assertInertia(fn (Assert $page) => $page
-            ->component('embedded/Room')
-            ->where('room.id', $room->id)
-            ->where('currentPlayer.name', 'Nico'));
-
-    $player = $room->players()->sole();
-
-    expect($player->user_id)->toBeNull()
-        ->and($player->is_moderator)->toBeFalse();
-
-    $response->assertSessionHas("room_players.{$room->id}", $player->id);
-});
-
-test('embedded guest access reuses the session player and applies a changed display name', function () {
-    $room = createEmbeddedRoom();
-    $player = $room->players()->create([
-        'name' => 'Old name',
-    ]);
-
-    $this->withSession(["room_players.{$room->id}" => $player->id])
-        ->get(route('embedded.room', [
-            'join_code' => $room->join_code,
-            'player_name' => 'New name',
-        ]))
-        ->assertOk();
-
-    expect($room->players()->count())->toBe(1)
-        ->and($player->fresh()->name)->toBe('New name');
-});
-
-test('an authenticated user automatically joins the embedded room', function () {
-    $user = User::factory()->create();
-    $room = createEmbeddedRoom(['allow_participants_to_manage_rounds' => true]);
-
-    $this->actingAs($user)
-        ->get(route('embedded.room', [
-            'join_code' => strtolower($room->join_code),
-            'player_name' => ' Nico ',
-        ]))
-        ->assertOk()
-        ->assertInertia(fn (Assert $page) => $page
-            ->component('embedded/Room')
-            ->where('room.id', $room->id)
-            ->where('room.allow_participants_to_manage_rounds', true)
-            ->where('currentPlayer.name', 'Nico'))
-        ->assertSessionHas("room_players.{$room->id}");
-
-    $this->assertDatabaseHas('players', [
-        'room_id' => $room->id,
-        'user_id' => $user->id,
-        'name' => 'Nico',
-        'is_moderator' => false,
-    ]);
-});
-
-test('embedded access reuses the user player and applies a changed display name', function () {
-    $user = User::factory()->create();
-    $room = createEmbeddedRoom();
-    $player = $room->players()->create([
-        'user_id' => $user->id,
-        'name' => 'Old name',
-    ]);
-
-    $this->actingAs($user)
-        ->get(route('embedded.room', [
-            'join_code' => $room->join_code,
-            'player_name' => 'New name',
-        ]))
-        ->assertOk();
-
-    expect($room->players()->count())->toBe(1)
-        ->and($player->fresh()->name)->toBe('New name');
-});
-
-test('an embedded guest keeps the same player after logging in separately', function () {
-    $user = User::factory()->create([
-        'email' => 'nico@example.com',
-    ]);
-    $room = createEmbeddedRoom();
-    $url = route('embedded.room', [
-        'join_code' => $room->join_code,
-        'player_name' => 'Nico',
-    ]);
-
-    $this->get($url)->assertOk();
-
-    $player = $room->players()->sole();
-
-    $this->post(route('login.store'), [
-        'email' => 'nico@example.com',
-        'password' => 'password',
-    ])->assertRedirect();
-
-    $this->get($url)->assertOk();
-
-    expect($room->players()->count())->toBe(1)
-        ->and($player->fresh()->user_id)->toBe($user->id);
-});
-
-test('embedded guest access shows a dedicated error when the display name is taken', function () {
-    $user = User::factory()->create([
-        'email' => 'nico@example.com',
-    ]);
-    $room = createEmbeddedRoom();
-    $room->players()->create([
-        'user_id' => $user->id,
-        'name' => 'Nico',
-    ]);
-    $url = route('embedded.room', [
-        'join_code' => $room->join_code,
-        'player_name' => 'Nico',
-    ]);
-
-    $this->get($url)
-        ->assertUnprocessable()
-        ->assertInertia(fn (Assert $page) => $page
-            ->component('embedded/Error')
-            ->where('message', 'Dieser Anzeigename ist in dem Raum bereits vorhanden.')
-            ->where('showLoginAction', true))
-        ->assertSessionHas('url.intended', $url);
-
-    $this->post(route('login.store'), [
-        'email' => 'nico@example.com',
-        'password' => 'password',
-    ])->assertRedirect($url);
-
-    $this->get($url)
-        ->assertOk()
-        ->assertInertia(fn (Assert $page) => $page
-            ->component('embedded/Room')
-            ->where('currentPlayer.name', 'Nico'));
-});
-
-test('a new account instance takes over the embedded player and kicks the previous instance', function () {
-    Event::fake([RoomStateChanged::class]);
-    $user = User::factory()->create();
-    $room = createEmbeddedRoom();
-    $player = $room->players()->create([
-        'user_id' => $user->id,
-        'name' => 'Nico',
-        'active_instance_id' => '019b8f80-37c4-71a3-b415-5f2697332c16',
-    ]);
-    $url = route('embedded.room', [
-        'join_code' => $room->join_code,
-        'player_name' => 'Nico',
-    ]);
-
-    $this->actingAs($user)
-        ->withSession([
-            'room_player_instance_id' => '019b8f80-37c4-71a3-b415-5f2697332c17',
-        ])
-        ->get($url)
-        ->assertOk()
-        ->assertInertia(fn (Assert $page) => $page
-            ->where('currentPlayer.id', $player->id)
-            ->where('currentPlayer.instance_id', '019b8f80-37c4-71a3-b415-5f2697332c17'));
-
-    expect($player->fresh()->active_instance_id)
-        ->toBe('019b8f80-37c4-71a3-b415-5f2697332c17');
-
-    Event::assertDispatched(
-        RoomStateChanged::class,
-        fn (RoomStateChanged $event): bool => $event->change === RoomStateChange::PlayerInstanceReplaced
-            && $event->affectedPlayerId === $player->id
-            && $event->affectedInstanceId === '019b8f80-37c4-71a3-b415-5f2697332c16',
-    );
-
-    $this->withSession([
-        "room_players.{$room->id}" => $player->id,
-        'room_player_instance_id' => '019b8f80-37c4-71a3-b415-5f2697332c16',
-    ])
-        ->post(route('room.vote.store', $room), ['value' => '5'])
-        ->assertRedirect(route('room.join', ['join_code' => $room->join_code]));
-
-    $this->assertDatabaseCount('votes', 0);
-});
-
-test('embedded access shows a dedicated error for an unknown room code', function () {
-    $this->get(route('embedded.room', [
-        'join_code' => 'ABC234',
-        'player_name' => 'Nico',
-    ]))
-        ->assertUnprocessable()
-        ->assertInertia(fn (Assert $page) => $page
-            ->component('embedded/Error')
-            ->where('message', 'Dieser Raumcode existiert nicht.')
-            ->where('showLoginAction', false));
-});
-
-test('embedded logout returns to the same room as a guest without duplicating the player', function () {
-    $user = User::factory()->create();
-    $room = createEmbeddedRoom();
-    $url = route('embedded.room', [
-        'join_code' => $room->join_code,
-        'player_name' => 'Nico',
-    ]);
-
-    $this->actingAs($user)->get($url)->assertOk();
-
-    $player = $room->players()->sole();
-
-    $this
-        ->followingRedirects()
-        ->post(route('embedded.logout', [
-            'join_code' => $room->join_code,
-            'player_name' => 'Nico',
-        ]))
-        ->assertOk()
-        ->assertInertia(fn (Assert $page) => $page
-            ->component('embedded/Room')
-            ->where('currentPlayer.id', $player->id));
-
-    $this->assertGuest()
-        ->assertDatabaseCount('players', 1);
-});

tests/Feature/RoomBroadcastingTest.php

@@ -45,25 +45,6 @@ test('room state broadcasts synchronously expose sanitized state', function () {
         ]);
 });
 
-test('player instance replacement broadcasts the displaced instance', function () {
-    $event = new RoomStateChanged(
-        '019b8f80-37c4-71a3-b415-5f2697332c16',
-        8,
-        RoomStateChange::PlayerInstanceReplaced,
-        null,
-        42,
-        '019b8f80-37c4-71a3-b415-5f2697332c17',
-    );
-
-    expect($event->broadcastWith())->toBe([
-        'version' => 8,
-        'change' => 'player_instance_replaced',
-        'state' => null,
-        'affected_player_id' => 42,
-        'affected_instance_id' => '019b8f80-37c4-71a3-b415-5f2697332c17',
-    ]);
-});
-
 test('joining a room broadcasts the new room version', function () {
     Event::fake([RoomStateChanged::class]);
     $room = createBroadcastRoom();
@@ -88,6 +69,12 @@ test('voting and round actions broadcast their state changes', function () {
     ]);
     $session = ["room_players.{$room->id}" => $moderator->id];
 
+    $this->withSession($session)
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertNoContent();
+
     $this->withSession($session)
         ->post(route('room.vote.store', $room), ['value' => '5'])
         ->assertNoContent();
@@ -113,6 +100,7 @@ test('voting and round actions broadcast their state changes', function () {
         RoomStateChange::CardsRevealed,
         RoomStateChange::NextRound,
         RoomStateChange::VotesReset,
+        RoomStateChange::PermissionsUpdated,
     ] as $change) {
         Event::assertDispatched(
             RoomStateChanged::class,
@@ -149,7 +137,14 @@ test('voting and round actions broadcast their state changes', function () {
         },
     );
 
-    Event::assertDispatchedTimes(RoomStateChanged::class, 5);
+    Event::assertDispatched(
+        RoomStateChanged::class,
+        fn (RoomStateChanged $event): bool => $event->change === RoomStateChange::PermissionsUpdated
+            && $event->state !== null
+            && $event->state['allow_participant_controls'] === true,
+    );
+
+    Event::assertDispatchedTimes(RoomStateChanged::class, 6);
 });
 
 test('failed room actions do not broadcast updates', function () {

tests/Feature/RoomEmoteTest.php

@@ -59,58 +59,6 @@ test('a participant can throw a realtime paper ball at another player', function
         ->and($room->state_version)->toBe($stateVersion);
 });
 
-test('moderator paper ball throws are not rate limited', function () {
-    Event::fake([PaperBallThrown::class]);
-    $room = createEmoteRoom();
-    $moderator = $room->players()->create([
-        'name' => 'Eric',
-        'is_moderator' => true,
-    ]);
-    $target = $room->players()->create([
-        'name' => 'Anna',
-        'is_moderator' => false,
-    ]);
-
-    for ($throwCount = 0; $throwCount < 11; $throwCount++) {
-        $this->withSession(["room_players.{$room->id}" => $moderator->id])
-            ->postJson(route('room.emote.paper-ball.store', $room), [
-                'target_player_id' => $target->id,
-            ])
-            ->assertNoContent();
-    }
-
-    Event::assertDispatchedTimes(PaperBallThrown::class, 11);
-});
-
-test('participant paper ball throws remain rate limited', function () {
-    Event::fake([PaperBallThrown::class]);
-    $room = createEmoteRoom();
-    $moderator = $room->players()->create([
-        'name' => 'Eric',
-        'is_moderator' => true,
-    ]);
-    $participant = $room->players()->create([
-        'name' => 'Anna',
-        'is_moderator' => false,
-    ]);
-
-    for ($throwCount = 0; $throwCount < 10; $throwCount++) {
-        $this->withSession(["room_players.{$room->id}" => $participant->id])
-            ->postJson(route('room.emote.paper-ball.store', $room), [
-                'target_player_id' => $moderator->id,
-            ])
-            ->assertNoContent();
-    }
-
-    $this->withSession(["room_players.{$room->id}" => $participant->id])
-        ->postJson(route('room.emote.paper-ball.store', $room), [
-            'target_player_id' => $moderator->id,
-        ])
-        ->assertTooManyRequests();
-
-    Event::assertDispatchedTimes(PaperBallThrown::class, 10);
-});
-
 test('a participant cannot throw a paper ball at themselves', function () {
     Event::fake([PaperBallThrown::class]);
     $room = createEmoteRoom();

tests/Feature/RoomFavoritesTest.php

@@ -20,6 +20,11 @@ test('favorited rooms are presented on the dashboard with player counts', functi
         'name' => 'Active player',
         'last_seen_at' => now(),
     ]);
+    $room->players()->create([
+        'name' => 'Inactive player',
+        'last_seen_at' => now()->subHour(),
+        'inactive_at' => now(),
+    ]);
 
     $this->actingAs($user)
         ->post(route('room.favorite', $room))
@@ -34,7 +39,8 @@ test('favorited rooms are presented on the dashboard with player counts', functi
         ->assertInertia(fn (Assert $page) => $page
             ->has('favoriteRooms', 1)
             ->where('favoriteRooms.0.id', $room->id)
-            ->where('favoriteRooms.0.players_count', 1));
+            ->where('favoriteRooms.0.players_count', 2)
+            ->where('favoriteRooms.0.active_player_count', 1));
 });
 
 test('the room resource exposes favorite and owner state', function () {

tests/Feature/RoomLifecycleTest.php

@@ -1,14 +1,11 @@
 <?php
 
-use App\Enums\RoomStateChange;
-use App\Events\RoomStateChanged;
 use App\Jobs\CloseInactiveRooms;
 use App\Models\Deck;
 use App\Models\Room;
 use App\Models\User;
 use App\Models\Vote;
 use Illuminate\Support\Carbon;
-use Illuminate\Support\Facades\Event;
 use Inertia\Testing\AssertableInertia as Assert;
 
 function createLifecycleRoom(array $attributes = []): Room
@@ -159,36 +156,6 @@ test('an authenticated player rejoins with the existing room identity', function
     $response->assertSessionHas("room_players.{$room->id}", $player->id);
 });
 
-test('a new account instance takes over the player during a regular room join', function () {
-    $user = User::factory()->create();
-    $room = createLifecycleRoom();
-    $player = $room->players()->create([
-        'user_id' => $user->id,
-        'name' => 'Room nickname',
-        'active_instance_id' => '019b8f80-37c4-71a3-b415-5f2697332c16',
-    ]);
-    Event::fake([RoomStateChanged::class]);
-
-    $this->actingAs($user)
-        ->withSession([
-            'room_player_instance_id' => '019b8f80-37c4-71a3-b415-5f2697332c17',
-        ])
-        ->post(route('room.code'), [
-            'join_code' => $room->join_code,
-            'player_name' => 'Room nickname',
-        ])
-        ->assertRedirect(route('room.show', $room));
-
-    expect($player->fresh()->active_instance_id)
-        ->toBe('019b8f80-37c4-71a3-b415-5f2697332c17');
-
-    Event::assertDispatched(
-        RoomStateChanged::class,
-        fn (RoomStateChanged $event): bool => $event->change === RoomStateChange::PlayerInstanceReplaced
-            && $event->affectedPlayerId === $player->id,
-    );
-});
-
 test('an authenticated player can restore room access without the previous session', function () {
     $user = User::factory()->create();
     $room = createLifecycleRoom(['owner_id' => $user->id]);
@@ -216,16 +183,15 @@ test('an active guest with a room session skips the join form', function () {
         ->assertRedirect(route('room.show', $room));
 });
 
-test('a removed guest joins again with a new player identity', function () {
+test('an inactive guest is sent through join and reuses the existing player', function () {
     $room = createLifecycleRoom();
     $player = $room->players()->create([
         'name' => 'Returning guest',
         'last_seen_at' => now()->subHours(2),
+        'inactive_at' => now()->subHour(),
     ]);
     $session = ["room_players.{$room->id}" => $player->id];
 
-    $player->delete();
-
     $this->withSession($session)
         ->get(route('room.show', $room))
         ->assertRedirect(route('room.join', ['join_code' => $room->join_code]));
@@ -234,7 +200,7 @@ test('a removed guest joins again with a new player identity', function () {
         ->get(route('room.join', ['join_code' => $room->join_code]))
         ->assertInertia(fn (Assert $page) => $page
             ->component('rooms/Join')
-            ->where('defaultPlayerName', null));
+            ->where('defaultPlayerName', 'Returning guest'));
 
     $this->withSession($session)
         ->post(route('room.code'), [
@@ -244,7 +210,7 @@ test('a removed guest joins again with a new player identity', function () {
         ->assertRedirect(route('room.show', $room));
 
     expect($room->players()->count())->toBe(1)
-        ->and($room->players()->sole()->id)->not->toBe($player->id);
+        ->and($player->fresh()->inactive_at)->toBeNull();
 });
 
 test('showing or polling a room does not count as room activity', function () {

tests/Feature/RoomPlayerKickTest.php

@@ -1,255 +0,0 @@
-<?php
-
-use App\Enums\RoomStateChange;
-use App\Events\RoomStateChanged;
-use App\Models\Player;
-use App\Models\Room;
-use App\Models\User;
-use Illuminate\Support\Facades\Event;
-use Inertia\Testing\AssertableInertia as Assert;
-
-function createRoomForPlayerKick(User $owner, array $attributes = []): Room
-{
-    return Room::create([
-        'owner_id' => $owner->id,
-        'title' => 'Team Planning',
-        'current_round' => 1,
-        'deck_config' => [
-            'name' => 'Fibonacci',
-            'cards' => [
-                ['key' => '3', 'label' => '3'],
-                ['key' => '5', 'label' => '5'],
-            ],
-        ],
-        ...$attributes,
-    ]);
-}
-
-function addPlayerToKickRoom(
-    Room $room,
-    string $name,
-    ?User $user = null,
-    bool $isModerator = false,
-): Player {
-    return $room->players()->create([
-        'user_id' => $user?->id,
-        'name' => $name,
-        'is_moderator' => $isModerator,
-        'last_seen_at' => now(),
-    ]);
-}
-
-test('the room owner sees active room players on the dashboard', function () {
-    $owner = User::factory()->create();
-    $room = createRoomForPlayerKick($owner);
-    $moderator = addPlayerToKickRoom($room, 'Moderator', $owner, true);
-    $participant = addPlayerToKickRoom($room, 'Anna');
-
-    $this->actingAs($owner)
-        ->get(route('dashboard'))
-        ->assertInertia(fn (Assert $page) => $page
-            ->has('rooms.0.players', 2)
-            ->where('rooms.0.players.0.id', $moderator->id)
-            ->where('rooms.0.players.0.is_moderator', true)
-            ->where('rooms.0.players.0.is_owner', true)
-            ->where('rooms.0.players.1.id', $participant->id)
-            ->where('rooms.0.players.1.is_moderator', false)
-            ->where('rooms.0.players.1.is_owner', false));
-});
-
-test('the room owner can kick an active participant', function () {
-    $owner = User::factory()->create();
-    $room = createRoomForPlayerKick($owner);
-    addPlayerToKickRoom($room, 'Moderator', $owner, true);
-    $participant = addPlayerToKickRoom($room, 'Anna');
-    $remainingPlayer = addPlayerToKickRoom($room, 'Ben');
-    $remainingPlayer->votes()->create([
-        'room_id' => $room->id,
-        'round' => $room->current_round,
-        'value' => '5',
-    ]);
-    $previousVersion = $room->fresh()->state_version;
-
-    Event::fake([RoomStateChanged::class]);
-
-    $this->actingAs($owner)
-        ->delete(route('room.player.destroy', [$room, $participant]))
-        ->assertRedirect();
-
-    $this->assertModelMissing($participant);
-    expect($room->fresh()->state_version)->toBe($previousVersion + 1);
-
-    Event::assertDispatched(
-        RoomStateChanged::class,
-        function (RoomStateChanged $event) use ($participant, $remainingPlayer, $room): bool {
-            if (
-                $event->roomId !== $room->id
-                || $event->change !== RoomStateChange::PlayerKicked
-                || $event->affectedPlayerId !== $participant->id
-                || $event->state === null
-            ) {
-                return false;
-            }
-
-            $remainingPlayerState = collect($event->state['players'])
-                ->firstWhere('id', $remainingPlayer->id);
-
-            return collect($event->state['players'])->doesntContain('id', $participant->id)
-                && $remainingPlayerState['has_voted'] === true
-                && $remainingPlayerState['vote'] === null
-                && $event->broadcastWith()['affected_player_id'] === $participant->id;
-        },
-    );
-    Event::assertDispatchedTimes(RoomStateChanged::class, 1);
-});
-
-test('a kicked guest loses their votes and their name becomes available', function () {
-    $owner = User::factory()->create();
-    $room = createRoomForPlayerKick($owner);
-    addPlayerToKickRoom($room, 'Moderator', $owner, true);
-    $guest = addPlayerToKickRoom($room, 'Nico');
-    $vote = $guest->votes()->create([
-        'room_id' => $room->id,
-        'round' => $room->current_round,
-        'value' => '3',
-    ]);
-
-    $this->actingAs($owner)
-        ->delete(route('room.player.destroy', [$room, $guest]))
-        ->assertRedirect();
-
-    $this->assertModelMissing($guest);
-    $this->assertModelMissing($vote);
-
-    auth()->logout();
-
-    $this->withSession(["room_players.{$room->id}" => $guest->id])
-        ->post(route('room.code'), [
-            'join_code' => $room->join_code,
-            'player_name' => 'Nico',
-        ])
-        ->assertRedirect(route('room.show', $room));
-
-    expect($room->players()->where('name', 'Nico')->sole()->id)->not->toBe($guest->id);
-});
-
-test('the room moderator can kick an active participant without shared management', function () {
-    $owner = User::factory()->create();
-    $room = createRoomForPlayerKick($owner, ['owner_id' => null]);
-    $moderator = addPlayerToKickRoom($room, 'Moderator', null, true);
-    $target = addPlayerToKickRoom($room, 'Anna');
-
-    Event::fake([RoomStateChanged::class]);
-
-    $this->withSession(["room_players.{$room->id}" => $moderator->id])
-        ->delete(route('room.player.destroy', [$room, $target]))
-        ->assertRedirect();
-
-    $this->assertModelMissing($target);
-    Event::assertDispatchedTimes(RoomStateChanged::class, 1);
-});
-
-test('a participant cannot kick another player when participant management is disabled', function () {
-    $owner = User::factory()->create();
-    $participantUser = User::factory()->create();
-    $room = createRoomForPlayerKick($owner);
-    addPlayerToKickRoom($room, 'Moderator', $owner, true);
-    $participant = addPlayerToKickRoom($room, 'Anna', $participantUser);
-    $target = addPlayerToKickRoom($room, 'Ben');
-
-    Event::fake([RoomStateChanged::class]);
-
-    $this->actingAs($participantUser)
-        ->withSession(["room_players.{$room->id}" => $participant->id])
-        ->delete(route('room.player.destroy', [$room, $target]))
-        ->assertForbidden();
-
-    $this->assertModelExists($target);
-    Event::assertNotDispatched(RoomStateChanged::class);
-});
-
-test('a participant can kick another player when participant management is enabled', function () {
-    $owner = User::factory()->create();
-    $room = createRoomForPlayerKick($owner, [
-        'allow_participants_to_manage_rounds' => true,
-    ]);
-    addPlayerToKickRoom($room, 'Moderator', $owner, true);
-    $participant = addPlayerToKickRoom($room, 'Anna');
-    $target = addPlayerToKickRoom($room, 'Ben');
-
-    Event::fake([RoomStateChanged::class]);
-
-    $this->withSession(["room_players.{$room->id}" => $participant->id])
-        ->delete(route('room.player.destroy', [$room, $target]))
-        ->assertRedirect();
-
-    $this->assertModelMissing($target);
-    Event::assertDispatched(RoomStateChanged::class);
-});
-
-test('a participant cannot kick themselves when participant management is enabled', function () {
-    $owner = User::factory()->create();
-    $room = createRoomForPlayerKick($owner, [
-        'allow_participants_to_manage_rounds' => true,
-    ]);
-    $participant = addPlayerToKickRoom($room, 'Anna');
-
-    Event::fake([RoomStateChanged::class]);
-
-    $this->withSession(["room_players.{$room->id}" => $participant->id])
-        ->delete(route('room.player.destroy', [$room, $participant]))
-        ->assertForbidden();
-
-    $this->assertModelExists($participant);
-    Event::assertNotDispatched(RoomStateChanged::class);
-});
-
-test('an anonymous visitor without a room session cannot kick from an ownerless room', function () {
-    $owner = User::factory()->create();
-    $room = createRoomForPlayerKick($owner, [
-        'owner_id' => null,
-        'allow_participants_to_manage_rounds' => true,
-    ]);
-    addPlayerToKickRoom($room, 'Moderator', null, true);
-    $target = addPlayerToKickRoom($room, 'Ben');
-
-    Event::fake([RoomStateChanged::class]);
-
-    $this->delete(route('room.player.destroy', [$room, $target]))
-        ->assertForbidden();
-
-    $this->assertModelExists($target);
-    Event::assertNotDispatched(RoomStateChanged::class);
-});
-
-test('the room owner cannot kick their own player', function () {
-    $owner = User::factory()->create();
-    $room = createRoomForPlayerKick($owner);
-    $moderator = addPlayerToKickRoom($room, 'Moderator', $owner, true);
-
-    Event::fake([RoomStateChanged::class]);
-
-    $this->actingAs($owner)
-        ->delete(route('room.player.destroy', [$room, $moderator]))
-        ->assertForbidden();
-
-    $this->assertModelExists($moderator);
-    Event::assertNotDispatched(RoomStateChanged::class);
-});
-
-test('the room owner cannot kick a player from another room', function () {
-    $owner = User::factory()->create();
-    $otherOwner = User::factory()->create();
-    $room = createRoomForPlayerKick($owner);
-    $otherRoom = createRoomForPlayerKick($otherOwner, ['title' => 'Other room']);
-    $target = addPlayerToKickRoom($otherRoom, 'Anna');
-
-    Event::fake([RoomStateChanged::class]);
-
-    $this->actingAs($owner)
-        ->delete(route('room.player.destroy', [$room, $target]))
-        ->assertForbidden();
-
-    $this->assertModelExists($target);
-    Event::assertNotDispatched(RoomStateChanged::class);
-});

tests/Feature/RoomSettingsTest.php

@@ -1,158 +0,0 @@
-<?php
-
-use App\Enums\RoomStateChange;
-use App\Events\RoomStateChanged;
-use App\Jobs\CloseInactiveRooms;
-use App\Models\Room;
-use App\Models\User;
-use Illuminate\Support\Facades\Event;
-use Inertia\Testing\AssertableInertia as Assert;
-
-function createSettingsRoom(array $attributes = []): Room
-{
-    return Room::create([
-        'title' => 'Teamraum',
-        'deck_config' => [
-            'name' => 'Fibonacci',
-            'cards' => [
-                ['key' => '3', 'label' => '3'],
-                ['key' => '5', 'label' => '5'],
-            ],
-        ],
-        ...$attributes,
-    ]);
-}
-
-test('room settings default to moderator control and normal retention', function () {
-    $room = createSettingsRoom();
-
-    expect($room->allow_participants_to_manage_rounds)->toBeFalse()
-        ->and($room->is_persistent)->toBeFalse();
-});
-
-test('the owner can view and update room settings', function () {
-    $owner = User::factory()->create();
-    $room = createSettingsRoom(['owner_id' => $owner->id]);
-
-    $this->actingAs($owner)
-        ->get(route('room.settings.edit', $room))
-        ->assertInertia(fn (Assert $page) => $page
-            ->component('rooms/Settings')
-            ->where('room.id', $room->id)
-            ->where('room.allow_participants_to_manage_rounds', false)
-            ->where('room.is_persistent', false));
-
-    Event::fake();
-
-    $this->actingAs($owner)
-        ->patch(route('room.settings.update', $room), [
-            'allow_participants_to_manage_rounds' => true,
-            'is_persistent' => true,
-        ])
-        ->assertRedirect();
-
-    $room->refresh();
-
-    expect($room->allow_participants_to_manage_rounds)->toBeTrue()
-        ->and($room->is_persistent)->toBeTrue()
-        ->and($room->state_version)->toBe(2);
-
-    Event::assertDispatched(
-        RoomStateChanged::class,
-        fn (RoomStateChanged $event): bool => $event->change === RoomStateChange::RoomSettingsUpdated
-            && $event->state['allow_participants_to_manage_rounds'] === true,
-    );
-});
-
-test('a user who does not own a room cannot manage its settings', function () {
-    $owner = User::factory()->create();
-    $otherUser = User::factory()->create();
-    $room = createSettingsRoom(['owner_id' => $owner->id]);
-
-    $this->actingAs($otherUser)
-        ->get(route('room.settings.edit', $room))
-        ->assertForbidden();
-
-    $this->actingAs($otherUser)
-        ->patch(route('room.settings.update', $room), [
-            'allow_participants_to_manage_rounds' => true,
-            'is_persistent' => true,
-        ])
-        ->assertForbidden();
-
-    expect($room->fresh()->allow_participants_to_manage_rounds)->toBeFalse();
-});
-
-test('all active participants can manage rounds when the room setting is enabled', function () {
-    $room = createSettingsRoom(['allow_participants_to_manage_rounds' => true]);
-    $player = $room->players()->create([
-        'name' => 'Anna',
-        'is_moderator' => false,
-    ]);
-
-    $this->withSession(["room_players.{$room->id}" => $player->id])
-        ->post(route('room.reveal', $room))
-        ->assertNoContent();
-
-    expect($room->fresh()->revealed_at)->not->toBeNull();
-});
-
-test('normal participants remain unable to manage rounds when the setting is disabled', function () {
-    $room = createSettingsRoom();
-    $player = $room->players()->create([
-        'name' => 'Anna',
-        'is_moderator' => false,
-    ]);
-
-    $this->withSession(["room_players.{$room->id}" => $player->id])
-        ->post(route('room.reveal', $room))
-        ->assertForbidden();
-});
-
-test('persistent rooms are excluded from automatic closing', function () {
-    $persistentRoom = createSettingsRoom([
-        'owner_id' => User::factory()->create()->id,
-        'is_persistent' => true,
-        'last_activity_at' => now()->subDays(60),
-    ]);
-    $expiringRoom = createSettingsRoom([
-        'owner_id' => User::factory()->create()->id,
-        'last_activity_at' => now()->subDays(60),
-    ]);
-
-    (new CloseInactiveRooms)->handle();
-
-    expect($persistentRoom->fresh()->closed_at)->toBeNull()
-        ->and($expiringRoom->fresh()->closed_at)->not->toBeNull();
-});
-
-test('room settings broadcasts never expose hidden vote values', function () {
-    $owner = User::factory()->create();
-    $room = createSettingsRoom(['owner_id' => $owner->id]);
-    $player = $room->players()->create([
-        'name' => 'Anna',
-        'is_moderator' => false,
-    ]);
-    $player->votes()->create([
-        'room_id' => $room->id,
-        'round' => 1,
-        'value' => '5',
-    ]);
-
-    Event::fake();
-
-    $this->actingAs($owner)->patch(route('room.settings.update', $room), [
-        'allow_participants_to_manage_rounds' => true,
-        'is_persistent' => false,
-    ]);
-
-    Event::assertDispatched(
-        RoomStateChanged::class,
-        function (RoomStateChanged $event) use ($player): bool {
-            $broadcastPlayer = collect($event->state['players'])->firstWhere('id', $player->id);
-
-            return $broadcastPlayer['has_voted'] === true
-                && $broadcastPlayer['vote'] === null;
-        },
-    );
-});

tests/Feature/RoomVotingTest.php

@@ -102,16 +102,96 @@ test('other votes stay hidden until the moderator reveals the round', function (
             ->where('room.players.1.vote', '8'));
 });
 
-test('only the moderator may reveal cards', function () {
+test('round controls remain moderator-only by default', function () {
     [$room, , $player] = createVotingRoom();
+    $session = ["room_players.{$room->id}" => $player->id];
 
-    $this->withSession(["room_players.{$room->id}" => $player->id])
+    $this->withSession($session)
         ->post(route('room.reveal', $room))
         ->assertForbidden();
 
+    $this->withSession($session)
+        ->post(route('room.next-round', $room))
+        ->assertForbidden();
+
+    $this->withSession($session)
+        ->post(route('room.reset', $room))
+        ->assertForbidden();
+
     expect($room->fresh()->revealed_at)->toBeNull();
 });
 
+test('the moderator can allow every participant to control the round', function () {
+    [$room, $moderator, $player] = createVotingRoom();
+    $room->refresh();
+    $initialStateVersion = $room->state_version;
+
+    $this->withSession(["room_players.{$room->id}" => $moderator->id])
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertNoContent();
+
+    $room->refresh();
+
+    expect($room->allow_participant_controls)->toBeTrue()
+        ->and($room->state_version)->toBe($initialStateVersion + 1);
+
+    $session = ["room_players.{$room->id}" => $player->id];
+
+    $this->withSession($session)
+        ->get(route('room.show', $room))
+        ->assertInertia(fn (Assert $page) => $page
+            ->where('room.allow_participant_controls', true));
+
+    $this->withSession($session)
+        ->post(route('room.reveal', $room))
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.next-round', $room))
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.vote.store', $room), ['value' => '5'])
+        ->assertNoContent();
+
+    $this->withSession($session)
+        ->post(route('room.reset', $room))
+        ->assertNoContent();
+
+    expect($room->fresh()->current_round)->toBe(2);
+
+    $this->assertDatabaseMissing('votes', [
+        'room_id' => $room->id,
+        'round' => 2,
+    ]);
+});
+
+test('participants cannot change room permissions', function () {
+    [$room, , $player] = createVotingRoom();
+
+    $this->withSession(["room_players.{$room->id}" => $player->id])
+        ->patch(route('room.permissions.update', $room), [
+            'allow_participant_controls' => true,
+        ])
+        ->assertForbidden();
+
+    expect($room->fresh()->allow_participant_controls)->toBeFalse();
+});
+
+test('room permissions require a strict boolean value', function () {
+    [$room, $moderator] = createVotingRoom();
+
+    $this->withSession(["room_players.{$room->id}" => $moderator->id])
+        ->patchJson(route('room.permissions.update', $room), [
+            'allow_participant_controls' => 'true',
+        ])
+        ->assertJsonValidationErrors('allow_participant_controls');
+
+    expect($room->fresh()->allow_participant_controls)->toBeFalse();
+});
+
 test('starting the next round clears the revealed state', function () {
     [$room, $moderator] = createVotingRoom();