Validate that placed tiles come from the player's own hand

[paskal]

Problem

In makeTurn the check that a turn only used tiles from the player's own hand was commented out, with a TODO saying it didn't work because of board wildcards. So a modified client could place tiles it didn't hold — letters not in hand, or more copies of a letter than it held — and the downstream subtract(userLetters, putLetters) would silently keep the unmatched tiles, letting a player score with tiles they never had and keep their real hand.

Fix

Reinstated the ownership check in services/turn.ts, running after the existing wildcard-on-board swap loop (which has already adjusted userLetters, splicing out a real letter and inserting a * for each legitimate swap):

• build a multiset of the player's current hand
• for every placed cell, determine the tile it consumes: a wildcard cell ("*x", 2 chars) consumes a *; a real-letter cell (1 char) consumes that letter; anything else (malformed) is rejected
• decrement the multiset per placed tile; if a required tile isn't available, mark the turn invalid

Duplicates are counted, so over-spending a letter is caught. This is consistent with the downstream subtract, which removes the same placed tiles from the hand. Legitimate turns, including legitimate wildcard swaps, are unaffected. Also removed the dead commented-out block and a stray closing-brace comment.

[Copilot]

Pull request overview

Reintroduces server-side validation in makeTurn to ensure a player can only place tiles they actually possess in their hand (including correct handling of wildcard tiles), closing a cheating vector where a modified client could place arbitrary letters.

Changes:

• Adds a multiset-based “available letters” check to validate every placed tile is spendable from the player’s current hand.
• Removes the old commented-out (non-working) ownership-check block and related dead comment.
• Runs the new check after the wildcard-on-board swap reconciliation so legitimate swaps remain valid.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[paskal]

Both good points, thanks.

1. Falsy-cell bypass: fixed. The empty test now uses cell === null (and the top-level pass check uses letter !== null), so a non-null falsy value (0, false, "") is no longer skipped/treated as a pass; it falls through to the type/length checks and is rejected. This matches how newBoard treats userBoard[y][x] !== null as a placement, so nothing non-null can slip onto the board unvalidated.

2. Wildcard represented-letter ("*$"): left as-is on purpose. That check is about the represented letter's legality (does it belong to the alphabet), not about tile ownership, which is this PR's scope: the player does own a *. Words in this game aren't dictionary-validated server-side anyway (they're approved by the other players), so a wildcard representing a non-letter has no scoring advantage. Worth a separate follow-up for input hygiene, but out of scope here to keep this PR atomic.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

[paskal]

Fixed. The swap loop no longer mutates on an invalid swap: it computes isValidSwap = index !== -1 && typeof boardCell === 'string' && boardCell[0] === '*' && boardCell[1] === letter, and on !isValidSwap it sets ok = false and returns before any splice/board write. That removes both the splice(-1, 1, '*') hand corruption and the currentGameBoard[y][x][1] dereference on a non-wildcard/empty target cell. Legitimate swaps are unchanged.

[paskal]

Fixed. validateRequestBody now enforces the exact grid: userBoard must be 15 rows, each an array of 15 cells, each cell null or a string, else 400. That closes the ragged/short-board path where newBoard read missing cells as undefined (or threw on a missing row). Confirmed against the client, which sends a 15x15 grid with empty cells converted from '' to null before submit, so legit turns and all-null passes still validate.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

services/turn.ts:156

• If userBoard is treated as containing null cells (and is validated that way), this explicit callback parameter type should also allow null; otherwise it can become a TypeScript type error / hide null-handling in this check.

          !userBoard.some((row, y) =>
            row.some(
              (letter: string, x) =>
                letter !== null && game.board[y][x] !== null

[paskal]

Fixed. RequestBody.userBoard is now typed (string | null)[][], matching that empty cells are null after validation.

[paskal]

Fixed. makeTurn's userBoard parameter (and the empty-cell callback annotation) are now (string | null)[][], so the type matches the runtime contract the validator enforces. Type-only change, no behaviour impact.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

[paskal]

Fixed. validateRequestBody now rejects a non-object body up front: if (!req.body || typeof req.body !== 'object' || Array.isArray(req.body)) return res.status(400)..., so a JSON null (or array/primitive) body gives a controlled 400 instead of throwing on the property access.

[paskal]

Fixed. When wildCardOnBoard is absent it now defaults to {} in the validator (and RequestBody.wildCardOnBoard is typed optional to match), so makeTurn's Object.keys(wildCardOnBoard) never receives undefined. A null value still returns a controlled 400.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[paskal]

Fixed. validateRequestBody now rejects arrays explicitly at both levels (Array.isArray(body.wildCardOnBoard) and Array.isArray(innerObj)), returning 400, consistent with the non-object body rejection. So an array can't reach makeTurn's Object.keys/index logic. (The swap guard already rejected such input via isValidSwap, but rejecting at the boundary is cleaner.)