Fix live tournament roster mutation guards

[cursor]

Bug and impact

After a tournament started, several server routes still allowed roster/team mutations: creating a team, changing a team's group index, and deleting a single guest player. A concrete organizer/API flow could dissolve or reshuffle teams during live classification/category play, corrupting fixtures/brackets and player roster state.

Root cause

Recent post-start guards covered entry updates, team deletion, and bulk guest deletion, but did not cover POST /api/teams, PATCH /api/teams/:id for groupIndex, or the deleteGuestPlayer tournament action.

Fix

• Reject team creation once isTournamentStarted is true.
• Reject team group changes after start, alongside the existing name/roster locks.
• Reject individual guest deletion after start before invoking the destructive guest cleanup path.
• Added focused regression tests for all three API guards.

Validation

• npm test -- --run tests/startedRosterGuards.test.ts
• npm run typecheck
• npm test

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
matchpoint	Ready	Preview, Comment	May 14, 2026 11:13am