Enforce at-most-one active round per session

[Copilot]

POST /api/sessions/[id]/rounds had no guard against concurrent active rounds — calling it twice would create duplicate active rounds and double-assign roles.

Changes

• Active round check: Before creating a round, query for any existing status = 'active' round on the session. Return HTTP 409 if one is found, with a message directing the caller to end the current round first.
• Explicit status on insert: New rounds are now inserted with status = 'active' so the guard reliably detects them.

const activeRound = await sql`
  SELECT id FROM rounds WHERE session_id = ${id} AND status = 'active'
`;
if (activeRound.length > 0) {
  return NextResponse.json(
    { error: 'A round is already active for this session. End the current round before starting a new one.' },
    { status: 409 }
  );
}

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
live-game	Error		Mar 10, 2026 5:45am