Fix cross-session round hijacking and idempotent end-round penalties

.gitignore

@@ -1,3 +1,4 @@
 node_modules
 .next
 .env*.local
+tsconfig.tsbuildinfo

app/api/sessions/[id]/rounds/[roundId]/end/route.ts

@@ -10,8 +10,29 @@ export async function POST(req: Request, { params }: { params: { id: string, rou
     if (session.length === 0) return NextResponse.json({ error: 'Session not found' }, { status: 404 });
     if (session[0].passphrase !== passphrase) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
 
-    // End round
-    await sql`UPDATE rounds SET status = 'ended', ended_at = NOW() WHERE id = ${roundId}`;
+    // Verify round belongs to this session
+    const round = await sql`SELECT id, status FROM rounds WHERE id = ${roundId} AND session_id = ${id}`;
+    if (round.length === 0) return NextResponse.json({ error: 'Round not found' }, { status: 404 });
+
+    // Idempotent: if round already ended, return the existing summary without re-applying penalties
+    if (round[0].status === 'ended') {
+      const txs = await sql`SELECT price FROM transactions WHERE round_id = ${roundId} AND status = 'confirmed'`;
+      const playerRounds = await sql`SELECT * FROM player_rounds WHERE round_id = ${roundId}`;
+      const tradeCount = txs.length;
+      const avgPrice = tradeCount > 0 ? txs.reduce((acc, t) => acc + parseFloat(t.price), 0) / tradeCount : 0;
+      const penaltyCount = playerRounds.filter(pr => !pr.has_traded).length;
+      return NextResponse.json({
+        summary: {
+          tradeCount,
+          avgPrice: Math.round(avgPrice * 100) / 100,
+          penaltyCount,
+          totalPlayers: playerRounds.length
+        }
+      });
+    }
+
+    // End round — scoped to this session to prevent cross-session tampering
+    await sql`UPDATE rounds SET status = 'ended', ended_at = NOW() WHERE id = ${roundId} AND session_id = ${id}`;
 
     // Apply penalties and update total surplus
     const playerRounds = await sql`SELECT * FROM player_rounds WHERE round_id = ${roundId}`;