Message on reload to hopefully stop the user.

Reviewed-on: #3

.env

@@ -25,7 +25,7 @@ APP_SECRET=
 #
 # DATABASE_URL="sqlite:///%kernel.project_dir%/var/data_%kernel.environment%.db"
 # DATABASE_URL="mysql://app:!ChangeMe!@127.0.0.1:3306/app?serverVersion=8.0.32&charset=utf8mb4"
-DATABASE_URL="mysql://app:!ChangeMe!@database:3306/app?serverVersion=8.0.32&charset=utf8mb4"
+DATABASE_URL="mysql://escapepage:b.0nqrxJ%%2FD%%2ALuf9N@localhost:3306/escapepage?serverVersion=8.0.32&charset=utf8mb4"
 ###< doctrine/doctrine-bundle ###
 
 ###> symfony/messenger ###

.gitignore

@@ -25,3 +25,5 @@
 npm-debug.log
 yarn-error.log
 ###< symfony/webpack-encore-bundle ###
+
+/.idea

.idea/escapepage.iml

@@ -138,6 +138,8 @@
       <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/mercure-bundle" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/sendgrid-mailer" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/webpack-encore-bundle" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/symfonycasts/reset-password-bundle" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/symfonycasts/verify-email-bundle" />
     </content>
     <orderEntry type="inheritedJdk" />
     <orderEntry type="sourceFolder" forTests="false" />

.idea/php.xml

@@ -151,11 +151,11 @@
       <path value="$PROJECT_DIR$/vendor/symfony/mercure" />
       <path value="$PROJECT_DIR$/vendor/symfony/mercure-bundle" />
       <path value="$PROJECT_DIR$/vendor/lcobucci/jwt" />
+      <path value="$PROJECT_DIR$/vendor/symfonycasts/verify-email-bundle" />
+      <path value="$PROJECT_DIR$/vendor/symfonycasts/reset-password-bundle" />
     </include_path>
   </component>
-  <component name="PhpProjectSharedConfiguration" php_language_level="8.5.1">
-    <option name="suggestChangeDefaultLanguageLevel" value="false" />
-  </component>
+  <component name="PhpProjectSharedConfiguration" php_language_level="8.2" />
   <component name="PhpStan">
     <PhpStan_settings>
       <phpstan_by_interpreter asDefaultInterpreter="true" interpreter_id="5505d524-8d4c-4fe7-a2cb-82e334156ed6" timeout="60000" />

assets/game1.js

@@ -60,6 +60,15 @@ document.addEventListener('DOMContentLoaded', async () => {
 
   // Look for config injected by Twig in the page
   const cfgEl = document.getElementById('mercure-config');
+
+  // Prevent/warn on page reload
+  window.addEventListener('beforeunload', (event) => {
+    // Standard way to trigger the browser's confirmation dialog
+    event.preventDefault();
+    // Included for compatibility with older browsers
+    event.returnValue = '';
+  });
+
   if (!cfgEl) {
     console.warn('[Mercure][game1] #mercure-config element not found on page');
     return;
@@ -88,7 +97,7 @@ document.addEventListener('DOMContentLoaded', async () => {
     if (apiEchoUrl) {
       const echo = await fetchJson(apiEchoUrl, {
         method: 'POST',
-        body: { hello: 'from game1.js', ts: new Date().toISOString() },
+        body: { message: 'from game1.js', ts: new Date().toISOString() },
       });
       console.log('[API][game1] echo →', echo);
     } else {
@@ -97,4 +106,67 @@ document.addEventListener('DOMContentLoaded', async () => {
   } catch (e) {
     console.error('[API][game1] Request failed:', e);
   }
+
+  // Add messages to message-container
+  const messageContainer = document.getElementById('message-container');
+  if (messageContainer) {
+    let messages = [
+        ['System initializing...', 500],
+        ['Connection established.', 200],
+        ['Welcome agent to the mainframe.', 1000],
+        ['Scanning...', 3000],
+        ['Virus detected.', 500],
+        ['Starting Mainframe help modus...', 2000],
+        ['Help modus activated.', 500],
+        ['Blocking virus activated', 0]
+    ];
+
+    let currentMessageIndex = 0;
+
+    const printNextMessage = () => {
+      if (currentMessageIndex < messages.length) {
+        const msg = messages[currentMessageIndex];
+        const msgEl = document.createElement('div');
+        msgEl.className = 'message';
+        msgEl.textContent = msg[0];
+        msgEl.style.color = '#F00';
+        msgEl.style.marginBottom = '10px';
+        messageContainer.appendChild(msgEl);
+
+        currentMessageIndex++;
+        setTimeout(printNextMessage, msg[1]);
+      } else {
+        // After it has printed a set of messages, it has to start a timer of 2 seconds
+        console.log('[Game1] All messages printed. Starting 2s timer to expand message-container height...');
+        setTimeout(() => {
+          messageContainer.style.height = '400vh';
+          const inputField = document.getElementById('input-message');
+          inputField.disabled = false;
+
+          // Add event listener for Enter key
+          inputField.addEventListener('keypress', async (e) => {
+            if (e.key === 'Enter') {
+              const message = inputField.value.trim();
+              if (message && apiEchoUrl) {
+                inputField.value = '';
+                try {
+                  const response = await fetchJson(apiEchoUrl, {
+                    method: 'POST',
+                    body: { message, ts: new Date().toISOString() },
+                  });
+                  console.log('[API][game1] message sent →', response);
+                } catch (err) {
+                  console.error('[API][game1] Failed to send message:', err);
+                }
+              }
+            }
+          });
+
+          console.log('[Game1] message-container height changed to 400vh and input enabled');
+        }, 2000);
+      }
+    };
+
+    printNextMessage();
+  }
 });

assets/game1/filesystem/var/rapports/001_145-93.txt

@@ -0,0 +1,10 @@
+Undercover Report – Case File 145-93
+Agent: Carver (cover identity)
+Date: 02/18 – 02/22
+
+Subject operates a rural safehouse rumored to shelter fugitives and serve as a transient waypoint. Agent’s cover as a drifter seeking work provided entry in exchange for chores. On 02/19, visitors with gang tattoos arrived after midnight and were housed in separate rooms. Vehicles were parked under tree cover, and license plates were mud‑smeared. On 02/20, the subject warned of “new heat in town” and began burning scrap papers in a barrel.
+
+Later that night, a duffel of documents was left unattended. The agent briefly photographed maps with marked back‑road routes and coded notes. The handwriting matches samples from a related case. On 02/21, the subject probed the agent’s story with pointed questions about prior arrests. Cover held after the agent recited the rehearsed backstory.
+
+Cover credible but time‑limited. Recommend immediate analysis of the photographed maps, ID of transient visitors via tattoos and vehicle features, and a synchronized warrant service before the location rotates to a fresh site.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/007_19-52.txt

@@ -0,0 +1,11 @@
+Undercover Report – Case File 19-52
+Agent: Harper (cover identity)
+Date: 07/22 – 07/26
+
+Subject controls a pawnshop that exhibits transaction volumes and cash handling inconsistent with normal retail activity. Cover identity as electronics repair tech granted backroom access to the testing bench, DVR cabinet, and inventory cage. On 07/23, the subject hosted a closed‑door meeting with four associates who arrived separately and staggered departures. Through the vent grate, agent heard references to “offshore wires,” “clean accounts,” and “quarter‑end flush.” Subject maintained a spiral ledger with denominations recorded in columns that do not match typical point‑of‑sale exports.
+
+On 07/24, the subject ordered cameras repositioned to avoid capturing the safe directly. Agent was subtly tested regarding loyalty—assigned an after‑hours soldering task while the subject counted bundled currency on the shop floor. Later that night, an unmarked van delivered two duffel bags that were moved to the vault without intake paperwork. Subject personally signed a receipt on blank stationery and pocketed the copy.
+
+On 07/25, subject complained about “Treasury heat” and instructed the bookkeeper to route payments through two new accounts, both named with common surnames. Names did not match any employee records. Agent retrieved partial account numbers from a discarded note.
+
+Cover remains credible. Recommend immediate financial task‑force review of the ledger, subpoena of the newly referenced accounts, and discreet license‑plate canvass for the van. Surveillance continuity is advised; subject exhibits rising paranoia yet continues to centralize cash at the location.

assets/game1/filesystem/var/rapports/011_130-62.txt

@@ -0,0 +1,10 @@
+Undercover Report – Case File 130-62
+Agent: Lennox (cover identity)
+Date: 12/02 – 12/06
+
+Subject runs an art gallery suspected of laundering through inflated valuations and forged provenance. Agent embedded as gallery assistant. On 12/03, the subject finalized a cash sale for a painting at five times market value to an anonymous buyer. On 12/04, the subject ordered an assistant to “adjust provenance papers,” instructing edits to dates and prior ownership. The font choice and printer bleed matched a stack of older certificates in a locked drawer.
+
+On 12/05, a private viewing hosted foreign clients who avoided staff contact. One carried a briefcase later exchanged for a wrapped canvas in the loading alcove. On 12/06, the subject cautioned staff not to speak with authorities and appeared tense while counting cash in the office.
+
+Cover secure. Recommend seizure of the forged documents, liaison with cultural‑property experts to authenticate inventory, and identification of the foreign clients via travel manifests and nearby CCTV.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/012_94-31.txt

@@ -0,0 +1,12 @@
+Undercover Report – Case File 94-31
+Agent: Donovan (cover identity)
+Date: 06/01 – 06/05
+
+Subject operates a private marina suspected of facilitating smuggling. Agent’s cover as a yacht mechanic provides daily access to slips and late‑night maintenance calls. On 06/02, the subject directed the agent to assist with unloading three sealed crates from a speedboat arriving past midnight. Crates bore generic “marine supplies” stickers; handlers treated them with unusual care. Opening was not feasible without tipping the crew.
+
+On 06/03, a heated exchange with a subordinate revealed concerns over “late payments” from overseas. The subject warned that debts must be cleared “before customs comes sniffing.” The tone suggested reliance on offshore accounts. On 06/04, the subject introduced an associate known only as “Captain,” who exhibited military bearing and carried a sidearm; conversation centered on moving delivery windows to avoid routine patrol sweeps.
+
+On 06/05, the subject carried a heavy duffel into the office and drew blinds for over an hour. Subsequent demeanor was relaxed, implying a successful cash reconciliation.
+
+Cover intact. Recommend forensic review of marina accounting, financial tracing of suspected offshore links, and coordination with harbor patrol to flag vessels matching the speedboat’s profile.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/016_98-07.txt

@@ -0,0 +1,10 @@
+Undercover Report – Case File 98-07
+Agent: Fletcher (cover identity)
+Date: 07/11 – 07/14
+
+Subject serves as a lieutenant managing a distribution hub inside an abandoned textile mill. Cover identity as a shell‑company delivery driver grants entrance to the loading dock and elevator cages. On 07/12, the subject assigned the agent to ferry sealed packages to a storage‑locker complex registered under a false name. Package weight and precautions suggest narcotics. Keys on a ring were photographed; several cuts matched lockers in Row C.
+
+On 07/13, the subject referenced “Chicago buyers,” instructing the crew to increase output despite law‑enforcement chatter. Morale appeared strained. On 07/14, the subject gathered the crew, delivered a loyalty speech about “traitors,” and scanned faces while the enforcer lingered by the door. No direct challenge to the agent, but suspicion is rising.
+
+Cover holds but the environment is volatile. Recommend warrants for the locker complex keyed to the photographed cuts, discreet traffic stops on the distribution couriers, and a contingency extraction plan should violence erupt at the mill.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/017_123-88.txt

@@ -0,0 +1,10 @@
+Undercover Report – Case File 123-88
+Agent: Holloway (cover identity)
+Date: 11/04 – 11/08
+
+Subject leverages a regional trucking firm to move contraband under cover of legitimate freight. Agent’s cover as a dispatcher assistant enables access to GPS routes and driver notes. On 11/05, routing orders labeled “detour deliveries” consistently bypassed weigh stations, and manifests showed weight mismatches. On 11/06, the subject instructed a driver to deliver “straight to the mountain cabin,” providing coordinates later confirmed by GPS ping.
+
+On 11/07, news of law‑enforcement activity near the interstate caused the subject to cancel multiple runs. Crew anxiety rose. On 11/08, the subject praised the agent for rerouting a truck around a checkpoint, further legitimizing the cover.
+
+Cover intact. Recommend aerial survey of the coordinates to identify storage, placement of covert trackers on the detour fleet, and financial review of the dispatch accounts to map the laundering flow.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/019_31-11.txt

@@ -0,0 +1,11 @@
+Undercover Report – Case File 31-11
+Agent: Vega (cover identity)
+Date: 09/04 – 09/07
+
+Subject runs a rural pharmacy with unusually high order volumes for specific controlled substances. Agent’s cover as a delivery technician enabled access to loading doors and packing slips. On 09/05, the subject accepted a pallet of blister packs outside normal receiving hours, directing it straight to a side room. Labels were legitimate, but lot numbers did not appear in the chain‑of‑custody app used elsewhere in the store. Staff avoided eye contact and deferred to the subject for every deviation.
+
+On 09/06, two sedan drivers arrived within minutes of each other, both collecting “returns” in sealed totes. Agent observed the subject bypassing the returns register and printing generic labels from a stand‑alone thermal unit. Drivers refused signatures and left via the alley. The subject later shredded a stack of thermal drafts without balancing the counts.
+
+On 09/07, agent overheard a phone call in which the subject referenced “doctor packs,” “holiday traffic,” and “quota pressure.” The cadence suggested coordination with a prescriber and an external distributor. The subject’s mood shifted sharply after the call; staff were told to “keep it to cash only” for the remainder of the day.
+
+Cover remains viable. Recommend a joint audit with state pharmacy regulators, review of the lot numbers observed, and controlled buys through the returns channel to document diversion.

assets/game1/filesystem/var/rapports/031_53-28.txt

@@ -0,0 +1,12 @@
+Undercover Report – Case File 53-28
+Agent: Navarro (cover identity)
+Date: 02/01 – 02/04
+
+Subject owns a private courier service that advertises same‑day delivery for tech firms. Shipment profiles and driver chatter suggest the operation moves high‑end electronics and crypto‑mining components off the books. Agent’s cover as a dispatch assistant provided map access and driver rotations. On 02/02, the subject created a route labeled “white run” that bypassed weigh stations and used alley handoffs. Driver later returned with a sealed envelope and no signature trail.
+
+On 02/03, a pallet bearing unfamiliar consignee codes was loaded into a van with interior panels removed—consistent with contraband concealment. Subject lectured staff about “never opening the blue totes,” then carried one into a locked server closet. Agent heard a fan spin‑up and a brief data sync tone from a nearby laptop, implying a quick‑clone procedure.
+
+On 02/04, the subject hinted the agent could “graduate to vest access” if weekend performance stayed quiet. A senior driver mentioned “hash boards” failing in transit and needing replacements before “the buyer from Reno flies out.”
+
+Cover stable. Recommend covert GPS beacons on the white‑run vans, subpoena of the courier’s API logs for the locked server closet, and coordination with air‑cargo teams for the Reno timeline.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/063_117-56.txt

@@ -0,0 +1,10 @@
+Undercover Report – Case File 117-56
+Agent: O’Connor (cover identity)
+Date: 10/15 – 10/18
+
+Subject operates an illegal backroom poker circuit that attracts mid‑tier executives and local power brokers. Agent’s cover as a wealthy gambler provided entry. On 10/16, buy‑ins far exceeded legal thresholds, and the subject boasted of protection from “friends in city hall.”
+
+On 10/17, an argument erupted between the subject and an enforcer over unpaid debts. Threats were made, but play resumed. On 10/18, the subject introduced an associate known as “Silver,” carrying a distinctive lighter described in other investigations. Presence of Silver indicates links to a broader network handling collections and intimidation.
+
+Cover stable. Recommend financial surveillance on the regular players, quiet corruption probe on the purported city contacts, and a tailored raid plan that mitigates risk to civilians at the gaming site.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/064_72-90.txt

@@ -0,0 +1,12 @@
+Undercover Report – Case File 72-90
+Agent: Quinn (cover identity)
+Date: 08/09 – 08/12
+
+Subject fronts a small software firm that has attracted high‑risk clients seeking data‑scraping and intrusion services. Agent embedded as a temporary QA tester, which offered proximity to build pipelines and the staging server. On 08/10, the subject approved a late‑night push titled “crawler‑plus” that contained modules for credential stuffing and proxy rotation. The code branch was kept off the main repository and shared via encrypted zip.
+
+On 08/11, two visitors arrived with no badges and were escorted directly to the conference room. Subject requested the agent run a “sandbox smoke test” while the visitors watched a dashboard of login attempts against third‑party targets. Conversation referenced “clean lists,” “UID harvest,” and “deliverables by Friday.”
+
+On 08/12, the subject floated a contract expansion involving a custom build for “telecom metadata capture.” When the agent hesitated, the subject advised to “just test the pipeline; leave the contracts to me.” Security posture inside the firm is lax; logs rotate every twenty‑four hours without retention.
+
+Cover credible. Recommend rapid legal hold to preserve server images, quiet outreach to targeted platforms to harden defenses, and preparation for a coordinated search warrant before the next deliverables window.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/072_61-05.txt

@@ -0,0 +1,12 @@
+Undercover Report – Case File 61-05
+Agent: Carter (cover identity)
+Date: 03/14 – 03/17
+
+Subject operates a livestock auction and feed cooperative used as a cash‑handling hub for a broader laundering scheme. Agent’s cover as a regional feed rep granted access to the back office and the weigh‑ticket printer. On 03/15, the subject directed staff to reprint weights for three lots and staple them over originals, inflating values by roughly thirty percent. Cash payouts were then split into smaller envelopes labeled as “hauler fees.”
+
+On 03/16, a trailer arrived after closing with no consignor paperwork. Subject ushered the driver to the scales, then recorded a manual weight entry without zeroing the platform. Later, agent noted the same trailer departed with bales stacked higher than safety guidelines, suggesting a swap on‑site.
+
+On 03/17, the subject met with a banker in the café booth. Heard fragments: “seasonal float,” “parcel deposits,” and “don’t trigger CTRs.” The banker left through the side door, avoiding cameras.
+
+Cover remains intact. Recommend forensic review of scale logs, unannounced compliance checks tied to animal‑welfare authorities as legitimate cover, and analysis of deposit structuring patterns that match the inflated weigh‑tickets.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/075_46-77.txt

@@ -0,0 +1,12 @@
+Undercover Report – Case File 46-77
+Agent: Ellis (cover identity)
+Date: 11/08 – 11/11
+
+Subject supervises a container‑yard subcontractor with access to high‑value import bays. Agent entered as a crane‑operator trainee assigned to night shifts. On 11/09, subject instructed the crew to reposition a forty‑footer from the manifest queue to an unnumbered slot behind the scrap pile. The container seal had a fresh dab of paint across the latch consistent with a re‑applied counterfeit seal. Yard cameras were left panning, creating reliable blind spots of twenty to thirty seconds.
+
+On 11/10, the subject met with two visitors at the fence line and exchanged a clipboard without approaching the office. Agent overheard them discuss “blank HS codes” and “holiday backlog.” The conversation implies a counterfeit‑electronics shipment misdeclared to avoid inspection. Later, subject distributed burner keycards for the east pedestrian gate, instructing workers to “switch badges” if stopped.
+
+On 11/11, a third party attempted to tip the agent to accept overtime in exchange for keeping a particular bay unsupervised. Agent declined while maintaining cover as rule‑bound but inexperienced. The subject appeared satisfied the lane would remain quiet.
+
+Cover intact. Recommend customs partnership to flag the suspect container by serial, deploy a mobile X‑ray with minimal yard disruption, and audit badge access logs for the east gate.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/079_89-47.txt

@@ -0,0 +1,12 @@
+Undercover Report – Case File 89-47
+Agent: Dalton (cover identity)
+Date: 10/05 – 10/08
+
+Subject leads a motorcycle club that moonlights as a gunrunning and protection outfit. Agent entered as an auto detailer offering cut‑rate work on club vehicles. On 10/06, the subject invited the agent to a back‑lot barbecue where patched members traded cash for small boxes moved from saddlebag to saddlebag. A prospect muttered about “.30 cal uppers” and a “desert range test.”
+
+On 10/07, the club sergeant‑at‑arms demanded that the agent fix a VIP’s truck immediately, creating a loyalty test. While retrieving tools, the agent observed a crate under a tarp with oil‑paper‑wrapped parts and a stencil for a defunct manufacturer. Numbers were partially filed. The subject later bragged about buyers “east of the pass.”
+
+On 10/08, a convoy departed in staggered pairs. The subject ordered phones in airplane mode and handed out paper maps with pre‑drawn detours. A follower crashed a bike on loose gravel; the group paused in a blind spot, repositioned a crate, and continued.
+
+Cover remains plausible. Recommend roadside interdiction coordinated with Highway Patrol, ballistics work on recovered parts, and asset development targeting the prospect who appears chatty under alcohol.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/083_25-39.txt

@@ -0,0 +1,11 @@
+Undercover Report – Case File 25-39
+Agent: Doyle (cover identity)
+Date: 04/03 – 04/06
+
+Subject operates a small river ferry and maintenance dock that appear to facilitate contraband transfers between barges at off‑schedule hours. Agent’s cover as an out‑of‑work boat mechanic provided routine access to bilge areas and tool lockers. On 04/04, subject instructed the crew to keep the north slip unlit after midnight and to disable the dock camera claiming a blown fuse. The camera was found unplugged rather than damaged. Two crates moved from a barge to a skiff without paperwork.
+
+On 04/05, agent overheard the subject arguing with a radio contact over “ore purity” and “assay timing.” The phrasing suggests smuggling of high‑value metals rather than typical street narcotics. Crew members wore gloves and avoided scraping the crates’ corners, reinforcing the inference of dense contents. A handheld Geiger counter case was observed in the tool cage, but no reading event was witnessed.
+
+On 04/06, the subject requested help fabricating a false engine‑repair ticket to explain downtime for Barge 12. Ticket was signed under a false corporate name and backdated. Subject appeared calm after the forgery, then paid crew in cash envelopes with inconsistent denominations.
+
+Cover intact. Recommend discreet sampling of riverbed residue near the north slip, cross‑checking barge manifests for Barge 12, and coordination with environmental regulators to justify covert inspections without alerting the subject.

assets/game1/filesystem/var/rapports/087_102-45.txt

@@ -0,0 +1,10 @@
+Undercover Report – Case File 102-45
+Agent: Sanders (cover identity)
+Date: 08/19 – 08/23
+
+Subject manages an upscale restaurant suspected of laundering illicit gambling proceeds. Agent embedded as a sommelier, granting access to private dining rooms and basement storage. On 08/20, the subject hosted three suited men; the room was sealed and guarded. While pouring, the agent heard references to “clearing accounts” and “west‑coast expansion.” The subject kept a handwritten ledger with columns that do not reconcile with the point‑of‑sale exports.
+
+On 08/22, a delivery van bypassed normal suppliers and offloaded crates into the walk‑in freezer with no perishables labeling. Handlers displayed tactical posture inconsistent with food service. On 08/23, the subject warned staff about inspections and emphasized silence, revealing controlled anxiety.
+
+Cover remains secure; agent perceived as competent and unthreatening. Recommend parallel financial audit, supplier‑chain verification, and a timed inspection aligned with the off‑cycle delivery pattern.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/091_81-33.txt

@@ -0,0 +1,12 @@
+Undercover Report – Case File 81-33
+Agent: Raines (cover identity)
+Date: 01/18 – 01/21
+
+Subject manages a boutique hotel that periodically closes floors for “private events.” Agent’s cover as night‑shift concierge grants exposure to guest registries and key‑encoder logs. On 01/19, the subject blocked out Level 5 under a shell company and delivered sealed envelopes to three suites. Noise and foot traffic suggested an invitation‑only auction. Staff were instructed to use service stairs only and disable the lobby feed for two hours citing maintenance.
+
+On 01/20, two SUVs with obscured plates arrived at the loading bay. Items resembling art crates and a locked pelican case were transferred to Suite 512. A known broker briefly appeared in the hallway, then vanished into the service lift. The minibar inventory showed no consumption despite the headcount—common during short, transactional gatherings.
+
+On 01/21, the subject praised the agent for “discretion” and hinted at a permanent role. Later, housekeeping turned over a discarded bidder paddlestick with handwritten totals. Figures exceeded declared room revenue by a wide margin.
+
+Cover holds. Recommend targeted warrants for the shell company, a parallel probe into the broker, and a controlled interruption on the next “private” floor closure to preserve evidence while minimizing guest disruption.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/093_138-24.txt

@@ -0,0 +1,10 @@
+Undercover Report – Case File 138-24
+Agent: Bennett (cover identity)
+Date: 01/12 – 01/15
+
+Subject manages a modest construction company that appears to use job sites for concealment and cash skimming. Agent hired as temporary labor. On 01/13, a hidden compartment beneath scaffolding yielded two heavy duffels that the subject moved to a pickup without logging materials. The foreman kept crew distant with a noise‑control pretext.
+
+On 01/14, the subject argued with a partner about “federal contracts” and “kickbacks,” implying bid‑rigging and public‑corruption exposure. On 01/15, the subject praised the agent’s work and hinted at “bigger projects,” a sign of attempted grooming for riskier tasks.
+
+Cover maintained. Recommend forensic review of procurement records, site searches keyed to concealed compartments, and interviews with subcontractors likely aware of the skimming practice.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/094_110-19.txt

@@ -0,0 +1,10 @@
+Undercover Report – Case File 110-19
+Agent: Mitchell (cover identity)
+Date: 09/07 – 09/10
+
+Subject runs a repair garage that doubles as a weapons workshop. Agent embedded as a part‑time apprentice. On 09/08, the subject modified rifles at a back bench outfitted with jigs, thread cutters, and solvent traps. Multiple unserialized receivers were visible. The subject bragged about clients who “pay for silence.”
+
+On 09/09, a phone call arranged delivery of “three crates” to a desert rendezvous, specifying urgency and “military‑grade parts.” On 09/10, the subject tested the agent with a drop of a box labeled scrap to an abandoned rail yard. The weight and rattle suggested mixed metal components. Delivery completed under surveillance without opening to preserve cover.
+
+Cover intact though scrutiny is increasing. Recommend immediate tracing of the rail‑yard contact, controlled intercept of the desert transfer, and NIBIN checks on recovered parts.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/095_07-14.txt

@@ -0,0 +1,11 @@
+Undercover Report – Case File 07-14
+Agent: Mason (cover identity)
+Date: 06/12 – 06/15
+
+Subject continues to operate a cash‑heavy nightclub believed to be central to mid‑level narcotics distribution in the northwest sector. Cover identity as part‑time bartender remains effective and provides nightly access to storeroom traffic and the restricted back hallway behind the stage. On 06/13, the subject supervised delivery of three sealed cartons labeled as beverage syrups. The weight and the handlers’ posture suggested dense contents inconsistent with that label. Subject instructed all staff to avoid contact and to log the cartons as vendor overstock without serials.
+
+On 06/14, the subject held a closed‑door conversation with a courier known locally as “Rico.” Portions overheard included references to a “Miami truck” and “east‑coast push.” Tone implied urgency and reliance on corrupt support, described as “our friend at permits.” Identity of the alleged official remains unknown. Later that evening, a floor manager tested staff loyalty by asking casual questions about police patrol patterns near 12th Street.
+
+On 06/15, subject gave the agent an envelope for a routine off‑site drop. Envelope was briefly photographed under pretext of retrieving car keys; contents included a short ledger with coded initials, tally marks, and four phone numbers written in alternating ink colors. Envelope was delivered intact to avoid suspicion. Subject’s post‑drop demeanor appeared relaxed, suggesting the transaction cleared immediate obligations.
+
+Cover remains intact, with agent perceived as reliable but peripheral. Recommend discreet financial analysis of the ledger numbers, targeted canvass for the unknown permits contact, and coordination with port‑of‑entry teams to watch for south‑to‑north freight aligning with subject’s timetable.

assets/game1/filesystem/var/rapports/098_92-14.txt

@@ -0,0 +1,12 @@
+Undercover Report – Case File 92-14
+Agent: Langston (cover identity)
+Date: 05/10 – 05/14
+
+Subject continues to expand operations through a network of import/export fronts in the industrial docklands. Cover identity as an independent freight consultant has provided access to routing meetings and late‑night inspections. On 05/11, the subject oversaw containers labeled “agricultural machinery” with weights above manifest and brand‑new locks. Handlers were armed and avoided eye contact. No safe chance to open containers without exposure.
+
+On 05/12, the subject introduced an associate, “Gallo,” who quizzed the agent on Gulf‑port customs routines and inspection frequencies. Questions implied an imminent push of high‑value contraband through maritime lanes with compromised timing windows. The crew canceled two runs after learning of a regional seizure, and the subject complained about “partners overseas losing patience.”
+
+On 05/14, a briefcase exchange at a dockside café lasted under two minutes; the subject accepted the case and passed it to Gallo without inspection. Both appeared tense but determined.
+
+Cover remains stable yet fragile. Recommend expanded surveillance at the targeted warehouses, customs liaisons to flag the specific manifest anomalies noted, and a rapid extraction plan if the crew pivots to violent vetting.
+ Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible. Cover remains intact. Recommend continued surveillance and coordinated warrants when feasible.

assets/game1/filesystem/var/rapports/index.txt

@@ -0,0 +1,20 @@
+095_07-14.txt – 07-14 – Mason
+007_19-52.txt – 19-52 – Harper
+083_25-39.txt – 25-39 – Doyle
+019_31-11.txt – 31-11 – Vega
+075_46-77.txt – 46-77 – Ellis
+031_53-28.txt – 53-28 – Navarro
+072_61-05.txt – 61-05 – Carter
+064_72-90.txt – 72-90 – Quinn
+091_81-33.txt – 81-33 – Raines
+079_89-47.txt – 89-47 – Dalton
+098_92-14.txt – 92-14 – Langston
+012_94-31.txt – 94-31 – Donovan
+016_98-07.txt – 98-07 – Fletcher
+087_102-45.txt – 102-45 – Sanders
+094_110-19.txt – 110-19 – Mitchell
+063_117-56.txt – 117-56 – O’Connor
+017_123-88.txt – 123-88 – Holloway
+011_130-62.txt – 130-62 – Lennox
+093_138-24.txt – 138-24 – Bennett
+001_145-93.txt – 145-93 – Carver

assets/styles/game1.css

@@ -1,17 +1,63 @@
 /* Styles specific to Game1 */
 
 /* page-level indicator to confirm CSS is loaded */
-body.game1-page {
-  /* subtle background tint so you can visually confirm on /game */
-  background-color: #f9fbff;
+/* Custom scrollbar for WebKit browsers */
+html::-webkit-scrollbar,
+body::-webkit-scrollbar {
+    width: 1px;
 }
 
-/* example component style */
-.game1-banner {
-  padding: 1rem 1.25rem;
-  border: 1px solid #cfe2ff;
-  background: #e9f2ff;
-  color: #0b5ed7;
-  border-radius: 8px;
-  margin: 1rem 0;
+html::-webkit-scrollbar-track,
+body::-webkit-scrollbar-track {
+    background: #000;
+}
+
+html::-webkit-scrollbar-thumb,
+body::-webkit-scrollbar-thumb {
+    background: #F00;
+}
+
+/* Standard properties for Firefox */
+body {
+    background-color: #000;
+    min-height: 100vh;
+    font-family: monospace;
+    margin: 0;
+    scrollbar-width: thin;
+    scrollbar-color: #F00 #000;
+}
+
+div#game-timer {
+    position: fixed;
+    top: 20px;
+    left: 20px;
+    color: #F00;
+    font-size: 28px;
+    z-index: 100;
+}
+
+div#message-container {
+    padding: 20px;
+    padding-top: 60px; /* Space for fixed timer */
+    display: flex;
+    flex-direction: column;
+    justify-content: flex-end;
+    min-height: calc(100vh - 100px); /* Fill most of the viewport initially */
+    box-sizing: border-box;
+    font-size: 20px;
+}
+
+div#input {
+    padding: 20px;
+}
+
+input#input-message {
+    width: 100%;
+    padding: 10px;
+    background: #000;
+    border: 1px solid #F00;
+    color: #F00;
+    font-size: 18px;
+    box-sizing: border-box;
+    font-family: monospace;
 }

composer.json

@@ -4,7 +4,7 @@
     "minimum-stability": "stable",
     "prefer-stable": true,
     "require": {
-        "php": ">=8.5.1",
+        "php": ">=8.2",
         "ext-ctype": "*",
         "ext-iconv": "*",
         "doctrine/dbal": "^3",
@@ -25,8 +25,8 @@
         "symfony/http-client": "7.3.*",
         "symfony/intl": "7.3.*",
         "symfony/mailer": "7.3.*",
+        "symfony/mercure-bundle": "^0.3",
         "symfony/mime": "7.3.*",
-        "symfony/sendgrid-mailer": "7.3.*",
         "symfony/monolog-bundle": "^3.0",
         "symfony/notifier": "7.3.*",
         "symfony/process": "7.3.*",
@@ -34,6 +34,7 @@
         "symfony/property-info": "7.3.*",
         "symfony/runtime": "7.3.*",
         "symfony/security-bundle": "7.3.*",
+        "symfony/sendgrid-mailer": "7.3.*",
         "symfony/serializer": "7.3.*",
         "symfony/stimulus-bundle": "^2.30",
         "symfony/string": "7.3.*",
@@ -42,11 +43,12 @@
         "symfony/ux-turbo": "^2.30",
         "symfony/validator": "7.3.*",
         "symfony/web-link": "7.3.*",
-        "symfony/yaml": "7.3.*",
-        "twig/extra-bundle": "^2.12|^3.0",
-        "twig/twig": "^2.12|^3.0",
         "symfony/webpack-encore-bundle": "^2.1",
-        "symfony/mercure-bundle": "^0.3"
+        "symfony/yaml": "7.3.*",
+        "symfonycasts/reset-password-bundle": "^1.24",
+        "symfonycasts/verify-email-bundle": "^1.18",
+        "twig/extra-bundle": "^2.12|^3.0",
+        "twig/twig": "^2.12|^3.0"
     },
     "config": {
         "allow-plugins": {

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "7b090cdc9768a74bdf1ef02cc14e5d8c",
+    "content-hash": "8e2419832c0841e325a5b748bde61a48",
     "packages": [
         {
             "name": "composer/semver",
@@ -7969,6 +7969,98 @@
             ],
             "time": "2025-12-04T18:07:52+00:00"
         },
+        {
+            "name": "symfonycasts/reset-password-bundle",
+            "version": "v1.24.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/SymfonyCasts/reset-password-bundle.git",
+                "reference": "8e5f8f821260ccfe8085563a93b418d3ef9af29f"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/SymfonyCasts/reset-password-bundle/zipball/8e5f8f821260ccfe8085563a93b418d3ef9af29f",
+                "reference": "8e5f8f821260ccfe8085563a93b418d3ef9af29f",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1.10",
+                "symfony/config": "^5.4 | ^6.0 | ^7.0 | ^8.0",
+                "symfony/dependency-injection": "^5.4 | ^6.0 | ^7.0 | ^8.0",
+                "symfony/deprecation-contracts": "^2.2 | ^3.0",
+                "symfony/http-kernel": "^5.4 | ^6.0 | ^7.0 | ^8.0"
+            },
+            "require-dev": {
+                "doctrine/annotations": "^1.0",
+                "doctrine/doctrine-bundle": "^2.8",
+                "doctrine/orm": "^2.13",
+                "symfony/framework-bundle": "^5.4 | ^6.0 | ^7.0 | ^8.0",
+                "symfony/phpunit-bridge": "^5.4 | ^6.0 | ^7.0 | ^8.0",
+                "symfony/process": "^6.4 | ^7.0 | ^8.0",
+                "symfonycasts/internal-test-helpers": "dev-main"
+            },
+            "type": "symfony-bundle",
+            "autoload": {
+                "psr-4": {
+                    "SymfonyCasts\\Bundle\\ResetPassword\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "description": "Symfony bundle that adds password reset functionality.",
+            "support": {
+                "issues": "https://github.com/SymfonyCasts/reset-password-bundle/issues",
+                "source": "https://github.com/SymfonyCasts/reset-password-bundle/tree/v1.24.0"
+            },
+            "time": "2025-11-29T13:26:50+00:00"
+        },
+        {
+            "name": "symfonycasts/verify-email-bundle",
+            "version": "v1.18.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/SymfonyCasts/verify-email-bundle.git",
+                "reference": "ae0e6228c240a3fa20f2df5528f2fed97b806cab"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/SymfonyCasts/verify-email-bundle/zipball/ae0e6228c240a3fa20f2df5528f2fed97b806cab",
+                "reference": "ae0e6228c240a3fa20f2df5528f2fed97b806cab",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1",
+                "symfony/config": "^5.4 | ^6.0 | ^7.0 | ^8.0",
+                "symfony/dependency-injection": "^5.4 | ^6.0 | ^7.0 | ^8.0",
+                "symfony/deprecation-contracts": "^2.2 | ^3.0",
+                "symfony/http-kernel": "^5.4 | ^6.0 | ^7.0 | ^8.0",
+                "symfony/routing": "^5.4 | ^6.0 | ^7.0 | ^8.0"
+            },
+            "require-dev": {
+                "doctrine/orm": "^2.7",
+                "doctrine/persistence": "^2.0",
+                "symfony/framework-bundle": "^5.4 | ^6.0 | ^7.0 | ^8.0",
+                "symfony/phpunit-bridge": "^5.4 | ^6.0 | ^7.0 | ^8.0"
+            },
+            "type": "symfony-bundle",
+            "autoload": {
+                "psr-4": {
+                    "SymfonyCasts\\Bundle\\VerifyEmail\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "description": "Simple, stylish Email Verification for Symfony",
+            "support": {
+                "issues": "https://github.com/SymfonyCasts/verify-email-bundle/issues",
+                "source": "https://github.com/SymfonyCasts/verify-email-bundle/tree/v1.18.0"
+            },
+            "time": "2025-11-29T11:53:37+00:00"
+        },
         {
             "name": "twig/extra-bundle",
             "version": "v3.22.2",
@@ -10502,7 +10594,7 @@
     "prefer-stable": true,
     "prefer-lowest": false,
     "platform": {
-        "php": ">=8.5.1",
+        "php": ">=8.2",
         "ext-ctype": "*",
         "ext-iconv": "*"
     },

config/bundles.php

@@ -15,4 +15,6 @@ return [
     Symfony\Bundle\MakerBundle\MakerBundle::class => ['dev' => true],
     Symfony\WebpackEncoreBundle\WebpackEncoreBundle::class => ['all' => true],
     Symfony\Bundle\MercureBundle\MercureBundle::class => ['all' => true],
+    SymfonyCasts\Bundle\VerifyEmail\SymfonyCastsVerifyEmailBundle::class => ['all' => true],
+    SymfonyCasts\Bundle\ResetPassword\SymfonyCastsResetPasswordBundle::class => ['all' => true],
 ];

config/packages/messenger.yaml

@@ -26,4 +26,4 @@ framework:
             Symfony\Component\Notifier\Message\SmsMessage: async
 
             # Route your messages to the transports
-            # 'App\Message\YourMessage': async
+            'App\Tech\Message\ProcessTaskMessage': async

config/packages/reset_password.yaml

@@ -0,0 +1,2 @@
+symfonycasts_reset_password:
+    request_password_repository: App\Tech\Repository\ResetPasswordRequestRepository

config/packages/security.yaml

@@ -4,20 +4,28 @@ security:
         Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
     # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
     providers:
-        users_in_memory: { memory: null }
+        app_user_provider:
+            entity:
+                class: App\Tech\Entity\User
+                property: username
     firewalls:
         dev:
             pattern: ^/(_(profiler|wdt)|css|images|js)/
             security: false
         main:
             lazy: true
-            provider: users_in_memory
-
-            # activate different ways to authenticate
-            # https://symfony.com/doc/current/security.html#the-firewall
-
-            # https://symfony.com/doc/current/security/impersonating_user.html
-            # switch_user: true
+            provider: app_user_provider
+            user_checker: App\Tech\Service\UserChecker
+            form_login:
+                login_path: app_login
+                check_path: app_login
+                enable_csrf: true
+                username_parameter: username
+                password_parameter: password
+            logout:
+                path: app_logout
+                # where to redirect after logout
+                # target: app_any_route
 
     # Easy way to control access for large sections of your site
     # Note: Only the *first* access control that matches will be used

config/routes.yaml

@@ -13,6 +13,12 @@ game_controllers:
     type: attribute
     prefix: /game
 
+tech_controllers:
+    resource:
+        path: ../src/Tech/Controller/
+        namespace: App\Tech\Controller
+    type: attribute
+
 # Uncomment when you add base controllers
 # base_controllers:
 #     resource:

docker/compose.yaml

@@ -5,7 +5,7 @@ services:
   php:
     build:
       context: ..
-      dockerfile: php/Dockerfile
+      dockerfile: docker/php/Dockerfile
     container_name: escapepage-php
     volumes:
       - ../:/var/www/html:delegated
@@ -18,6 +18,23 @@ services:
       - backend
     restart: unless-stopped
 
+  php-worker:
+    build:
+      context: ..
+      dockerfile: docker/php/Dockerfile
+    container_name: escapepage-php-worker
+    volumes:
+      - ../:/var/www/html:delegated
+    environment:
+      APP_ENV: dev
+    depends_on:
+      - database
+      - mercure
+    command: ["php", "bin/console", "messenger:consume", "async", "-vv"]
+    networks:
+      - backend
+    restart: unless-stopped
+
   nginx:
     image: nginx:1.29.4-alpine
     container_name: escapepage-nginx

docker/php/Dockerfile

@@ -1,11 +1,20 @@
-FROM php:8.5.1-fpm-alpine3.23
+FROM php:8.3-fpm-alpine
 
 # Install system deps
-RUN apk add --no-cache bash git icu-dev libzip-dev oniguruma-dev
+RUN apk add --no-cache \
+    bash \
+    git \
+    icu-dev \
+    libzip-dev \
+    oniguruma-dev \
+    g++ \
+    make \
+    nodejs \
+    npm
 
 # Install PHP extensions
 RUN docker-php-ext-configure intl \
-    && docker-php-ext-install -j$(nproc) intl pdo pdo_mysql opcache
+    && docker-php-ext-install -j$(nproc) intl pdo pdo_mysql opcache zip
 
 # Install composer
 ENV COMPOSER_ALLOW_SUPERUSER=1 \
@@ -13,7 +22,7 @@ ENV COMPOSER_ALLOW_SUPERUSER=1 \
 COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
 
 # Configure PHP
-COPY php.ini $PHP_INI_DIR/conf.d/zz-custom.ini
+COPY docker/php/php.ini $PHP_INI_DIR/conf.d/zz-custom.ini
 
 WORKDIR /var/www/html
 

docker/setup.sh

@@ -66,12 +66,15 @@ dc up "${BUILD_ARGS[@]}"
 # Helper to run commands in php container
 pexec() { dc exec -T php "$@"; }
 
-# Wait for database to be healthy (mariadb)
+# Wait for database to be healthy (mariadb/mysql)
 printf "Waiting for database to be healthy..."
 # Use docker inspect health status
 DB_HEALTH=""
 for i in {1..60}; do
-  DB_HEALTH=$(docker inspect -f '{{.State.Health.Status}}' "$(docker ps --filter name=_database_ --format '{{.ID}}' | head -n1)" 2>/dev/null || true)
+  DB_ID=$(dc ps -q database 2>/dev/null || true)
+  if [ -n "$DB_ID" ]; then
+    DB_HEALTH=$(docker inspect -f '{{.State.Health.Status}}' "$DB_ID" 2>/dev/null || true)
+  fi
   if [ "$DB_HEALTH" = "healthy" ]; then
     echo " OK"
     break
@@ -79,7 +82,7 @@ for i in {1..60}; do
   printf "."
   sleep 2
   if [ "$i" -eq 60 ]; then
-    echo "\nWarning: database health check not healthy yet, continuing anyway."
+    echo -e "\nWarning: database health check not healthy yet, continuing anyway."
   fi
 done
 
@@ -100,11 +103,23 @@ if grep -q '^APP_SECRET=$' "$ROOT_DIR/.env" 2>/dev/null; then
 fi
 
 # Prepare DB
-pexec php bin/console doctrine:database:create --if-not-exists || true
-pexec php bin/console doctrine:migrations:migrate -n || true
+echo "Creating database if it doesn't exist..."
+pexec php bin/console doctrine:database:create --if-not-exists
+echo "Running migrations..."
+pexec php bin/console doctrine:migrations:migrate -n
 
 # Import JS deps (Importmap/Asset Mapper)
-pexec php bin/console importmap:install || true
+if [ -f "$ROOT_DIR/importmap.php" ]; then
+  pexec php bin/console importmap:install || true
+fi
+
+# Build assets if using Webpack Encore
+if [ -f "$ROOT_DIR/package.json" ]; then
+  echo "Installing npm dependencies..."
+  pexec npm install
+  echo "Building assets..."
+  pexec npm run build
+fi
 
 APP_URL=http://localhost:8080
 MAILPIT_URL=http://localhost:8025
@@ -117,10 +132,12 @@ Open the app:      $APP_URL
 Mailpit (dev):     $MAILPIT_URL
 
 Common commands:
-  (cd docker && $DOCKER_COMPOSE logs -f nginx)
-  (cd docker && $DOCKER_COMPOSE logs -f php)
-  (cd docker && $DOCKER_COMPOSE exec php bash)
-  (cd docker && $DOCKER_COMPOSE down)
+  (cd "$DOCKER_DIR" && $DOCKER_COMPOSE logs -f nginx)
+  (cd "$DOCKER_DIR" && $DOCKER_COMPOSE logs -f php)
+  (cd "$DOCKER_DIR" && $DOCKER_COMPOSE logs -f php-worker)
+  (cd "$DOCKER_DIR" && $DOCKER_COMPOSE exec php bash)
+  (cd "$DOCKER_DIR" && $DOCKER_COMPOSE exec php npm run watch)
+  (cd "$DOCKER_DIR" && $DOCKER_COMPOSE down)
 
 You can re-run this script any time. Use --no-build to skip rebuilding images.
 EOT

migrations/Version20260103210448.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260103210448 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('CREATE TABLE `user` (id INT AUTO_INCREMENT NOT NULL, email VARCHAR(180) NOT NULL, roles JSON NOT NULL, password VARCHAR(255) NOT NULL, is_verified TINYINT(1) NOT NULL, UNIQUE INDEX UNIQ_IDENTIFIER_EMAIL (email), PRIMARY KEY(id)) DEFAULT CHARACTER SET utf8mb4 COLLATE `utf8mb4_unicode_ci` ENGINE = InnoDB');
+        $this->addSql('CREATE TABLE messenger_messages (id BIGINT AUTO_INCREMENT NOT NULL, body LONGTEXT NOT NULL, headers LONGTEXT NOT NULL, queue_name VARCHAR(190) NOT NULL, created_at DATETIME NOT NULL COMMENT \'(DC2Type:datetime_immutable)\', available_at DATETIME NOT NULL COMMENT \'(DC2Type:datetime_immutable)\', delivered_at DATETIME DEFAULT NULL COMMENT \'(DC2Type:datetime_immutable)\', INDEX IDX_75EA56E0FB7336F0E3BD61CE16BA31DBBF396750 (queue_name, available_at, delivered_at, id), PRIMARY KEY(id)) DEFAULT CHARACTER SET utf8mb4 COLLATE `utf8mb4_unicode_ci` ENGINE = InnoDB');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('DROP TABLE `user`');
+        $this->addSql('DROP TABLE messenger_messages');
+    }
+}

migrations/Version20260103212025.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260103212025 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('CREATE TABLE email_log (id INT AUTO_INCREMENT NOT NULL, user_id INT NOT NULL, email_identifier VARCHAR(255) NOT NULL, sent_at DATETIME NOT NULL COMMENT \'(DC2Type:datetime_immutable)\', INDEX IDX_6FB4883A76ED395 (user_id), PRIMARY KEY(id)) DEFAULT CHARACTER SET utf8mb4 COLLATE `utf8mb4_unicode_ci` ENGINE = InnoDB');
+        $this->addSql('ALTER TABLE email_log ADD CONSTRAINT FK_6FB4883A76ED395 FOREIGN KEY (user_id) REFERENCES `user` (id)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE email_log DROP FOREIGN KEY FK_6FB4883A76ED395');
+        $this->addSql('DROP TABLE email_log');
+    }
+}

migrations/Version20260103214856.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260103214856 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE user ADD username VARCHAR(180) NOT NULL');
+        $this->addSql('CREATE UNIQUE INDEX UNIQ_IDENTIFIER_USERNAME ON user (username)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('DROP INDEX UNIQ_IDENTIFIER_USERNAME ON `user`');
+        $this->addSql('ALTER TABLE `user` DROP username');
+    }
+}

migrations/Version20260103215543.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260103215543 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('CREATE TABLE reset_password_request (id INT AUTO_INCREMENT NOT NULL, user_id INT NOT NULL, selector VARCHAR(20) NOT NULL, hashed_token VARCHAR(100) NOT NULL, requested_at DATETIME NOT NULL COMMENT \'(DC2Type:datetime_immutable)\', expires_at DATETIME NOT NULL COMMENT \'(DC2Type:datetime_immutable)\', INDEX IDX_7CE748AA76ED395 (user_id), PRIMARY KEY(id)) DEFAULT CHARACTER SET utf8mb4 COLLATE `utf8mb4_unicode_ci` ENGINE = InnoDB');
+        $this->addSql('ALTER TABLE reset_password_request ADD CONSTRAINT FK_7CE748AA76ED395 FOREIGN KEY (user_id) REFERENCES `user` (id)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE reset_password_request DROP FOREIGN KEY FK_7CE748AA76ED395');
+        $this->addSql('DROP TABLE reset_password_request');
+    }
+}

migrations/Version20260105113139.php

@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260105113139 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('CREATE TABLE game (id INT AUTO_INCREMENT NOT NULL, name VARCHAR(255) NOT NULL, number_of_players INT NOT NULL, status VARCHAR(20) NOT NULL, PRIMARY KEY(id)) DEFAULT CHARACTER SET utf8mb4 COLLATE `utf8mb4_unicode_ci` ENGINE = InnoDB');
+        $this->addSql('CREATE TABLE player (id INT AUTO_INCREMENT NOT NULL, session_id INT NOT NULL, user_id INT NOT NULL, screen INT NOT NULL, INDEX IDX_98197A65613FECDF (session_id), INDEX IDX_98197A65A76ED395 (user_id), PRIMARY KEY(id)) DEFAULT CHARACTER SET utf8mb4 COLLATE `utf8mb4_unicode_ci` ENGINE = InnoDB');
+        $this->addSql('CREATE TABLE session (id INT AUTO_INCREMENT NOT NULL, game_id INT NOT NULL, status VARCHAR(20) NOT NULL, timer INT NOT NULL, created DATETIME NOT NULL, INDEX IDX_D044D5D4E48FD905 (game_id), PRIMARY KEY(id)) DEFAULT CHARACTER SET utf8mb4 COLLATE `utf8mb4_unicode_ci` ENGINE = InnoDB');
+        $this->addSql('ALTER TABLE player ADD CONSTRAINT FK_98197A65613FECDF FOREIGN KEY (session_id) REFERENCES session (id)');
+        $this->addSql('ALTER TABLE player ADD CONSTRAINT FK_98197A65A76ED395 FOREIGN KEY (user_id) REFERENCES `user` (id)');
+        $this->addSql('ALTER TABLE session ADD CONSTRAINT FK_D044D5D4E48FD905 FOREIGN KEY (game_id) REFERENCES game (id)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE player DROP FOREIGN KEY FK_98197A65613FECDF');
+        $this->addSql('ALTER TABLE player DROP FOREIGN KEY FK_98197A65A76ED395');
+        $this->addSql('ALTER TABLE session DROP FOREIGN KEY FK_D044D5D4E48FD905');
+        $this->addSql('DROP TABLE game');
+        $this->addSql('DROP TABLE player');
+        $this->addSql('DROP TABLE session');
+    }
+}

migrations/Version20260105121159.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260105121159 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE player ADD level JSON DEFAULT NULL');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE player DROP level');
+    }
+}

migrations/Version20260105155949.php

@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260105155949 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('CREATE TABLE game_setting (id INT AUTO_INCREMENT NOT NULL, game_id INT NOT NULL, name VARCHAR(255) NOT NULL, value LONGTEXT DEFAULT NULL, INDEX IDX_AB6C7B7E48FD905 (game_id), PRIMARY KEY(id)) DEFAULT CHARACTER SET utf8mb4 COLLATE `utf8mb4_unicode_ci` ENGINE = InnoDB');
+        $this->addSql('CREATE TABLE session_setting (id INT AUTO_INCREMENT NOT NULL, session_id INT NOT NULL, player_id INT DEFAULT NULL, name VARCHAR(255) NOT NULL, value LONGTEXT DEFAULT NULL, INDEX IDX_8DAC3AC2613FECDF (session_id), INDEX IDX_8DAC3AC299E6F5DF (player_id), PRIMARY KEY(id)) DEFAULT CHARACTER SET utf8mb4 COLLATE `utf8mb4_unicode_ci` ENGINE = InnoDB');
+        $this->addSql('ALTER TABLE game_setting ADD CONSTRAINT FK_AB6C7B7E48FD905 FOREIGN KEY (game_id) REFERENCES game (id)');
+        $this->addSql('ALTER TABLE session_setting ADD CONSTRAINT FK_8DAC3AC2613FECDF FOREIGN KEY (session_id) REFERENCES session (id)');
+        $this->addSql('ALTER TABLE session_setting ADD CONSTRAINT FK_8DAC3AC299E6F5DF FOREIGN KEY (player_id) REFERENCES player (id)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE game_setting DROP FOREIGN KEY FK_AB6C7B7E48FD905');
+        $this->addSql('ALTER TABLE session_setting DROP FOREIGN KEY FK_8DAC3AC2613FECDF');
+        $this->addSql('ALTER TABLE session_setting DROP FOREIGN KEY FK_8DAC3AC299E6F5DF');
+        $this->addSql('DROP TABLE game_setting');
+        $this->addSql('DROP TABLE session_setting');
+    }
+}

migrations/Version20260105160603.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260105160603 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE player DROP level');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE player ADD level JSON DEFAULT NULL');
+    }
+}

src/Game/Controller/GameApiController.php

@@ -3,6 +3,7 @@ declare(strict_types=1);
 
 namespace App\Game\Controller;
 
+use App\Game\Service\GameResponseService;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
@@ -12,6 +13,12 @@ use Symfony\Component\Routing\Annotation\Route;
 #[Route('/game/api', name: 'game_api_')]
 final class GameApiController extends AbstractController
 {
+
+    public function __construct(
+            protected GameResponseService $gameResponseService) {
+
+    }
+
     #[Route('/ping', name: 'ping', methods: ['GET'])]
     public function ping(): JsonResponse
     {
@@ -22,27 +29,18 @@ final class GameApiController extends AbstractController
         ]);
     }
 
-    #[Route('/echo', name: 'echo', methods: ['POST'])]
-    public function echo(Request $request): JsonResponse
+    #[Route('/message', name: 'message', methods: ['POST'])]
+    public function message(Request $request): JsonResponse
     {
         $raw = (string) $request->getContent();
         $data = null;
         if ($raw !== '') {
-            try {
-                /** @var array<string,mixed>|null $decoded */
-                $decoded = json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
-                $data = $decoded;
-            } catch (\Throwable $e) {
-                return $this->json([
-                    'ok' => false,
-                    'error' => 'Invalid JSON: ' . $e->getMessage(),
-                ], Response::HTTP_BAD_REQUEST);
-            }
+            $data = $this->gameResponseService->getGameResponse($raw);
         }
 
         return $this->json([
             'ok' => true,
-            'received' => $data,
+            'result' => $data,
             'ts' => date('c'),
         ]);
     }

src/Game/Controller/GameController.php

@@ -12,6 +12,8 @@ final class GameController extends AbstractController
     #[Route(path: '', name: 'game')]
     public function index(): Response
     {
-        return $this->render('game/index.html.twig');
+        return $this->render('game/index.html.twig', [
+            'user_id' => $this->getUser()?->getId(),
+        ]);
     }
 }

src/Game/Entity/Game.php

@@ -0,0 +1,141 @@
+<?php
+
+namespace App\Game\Entity;
+
+use App\Game\Enum\GameStatus;
+use App\Game\Repository\GameRepository;
+use Doctrine\Common\Collections\ArrayCollection;
+use Doctrine\Common\Collections\Collection;
+use Doctrine\ORM\Mapping as ORM;
+
+#[ORM\Entity(repositoryClass: GameRepository::class)]
+#[ORM\Table(name: 'game')]
+class Game
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    private ?int $id = null;
+
+    #[ORM\Column(length: 255)]
+    private ?string $name = null;
+
+    #[ORM\Column]
+    private ?int $numberOfPlayers = null;
+
+    #[ORM\Column(type: 'string', length: 20, enumType: GameStatus::class)]
+    private ?GameStatus $status = null;
+
+    #[ORM\OneToMany(mappedBy: 'game', targetEntity: Session::class)]
+    private Collection $sessions;
+
+    #[ORM\OneToMany(mappedBy: 'game', targetEntity: GameSetting::class)]
+    private Collection $settings;
+
+    public function __construct()
+    {
+        $this->sessions = new ArrayCollection();
+        $this->settings = new ArrayCollection();
+    }
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getName(): ?string
+    {
+        return $this->name;
+    }
+
+    public function setName(string $name): static
+    {
+        $this->name = $name;
+
+        return $this;
+    }
+
+    public function getNumberOfPlayers(): ?int
+    {
+        return $this->numberOfPlayers;
+    }
+
+    public function setNumberOfPlayers(int $numberOfPlayers): static
+    {
+        $this->numberOfPlayers = $numberOfPlayers;
+
+        return $this;
+    }
+
+    public function getStatus(): ?GameStatus
+    {
+        return $this->status;
+    }
+
+    public function setStatus(GameStatus $status): static
+    {
+        $this->status = $status;
+
+        return $this;
+    }
+
+    /**
+     * @return Collection<int, Session>
+     */
+    public function getSessions(): Collection
+    {
+        return $this->sessions;
+    }
+
+    public function addSession(Session $session): static
+    {
+        if (!$this->sessions->contains($session)) {
+            $this->sessions->add($session);
+            $session->setGame($this);
+        }
+
+        return $this;
+    }
+
+    public function removeSession(Session $session): static
+    {
+        if ($this->sessions->removeElement($session)) {
+            // set the owning side to null (unless already changed)
+            if ($session->getGame() === $this) {
+                $session->setGame(null);
+            }
+        }
+
+        return $this;
+    }
+
+    /**
+     * @return Collection<int, GameSetting>
+     */
+    public function getSettings(): Collection
+    {
+        return $this->settings;
+    }
+
+    public function addSetting(GameSetting $setting): static
+    {
+        if (!$this->settings->contains($setting)) {
+            $this->settings->add($setting);
+            $setting->setGame($this);
+        }
+
+        return $this;
+    }
+
+    public function removeSetting(GameSetting $setting): static
+    {
+        if ($this->settings->removeElement($setting)) {
+            // set the owning side to null (unless already changed)
+            if ($setting->getGame() === $this) {
+                $setting->setGame(null);
+            }
+        }
+
+        return $this;
+    }
+}

src/Game/Entity/GameSetting.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace App\Game\Entity;
+
+use App\Game\Enum\GameSettingType;
+use App\Game\Repository\GameSettingRepository;
+use Doctrine\ORM\Mapping as ORM;
+
+#[ORM\Entity(repositoryClass: GameSettingRepository::class)]
+#[ORM\Table(name: 'game_setting')]
+class GameSetting
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    private ?int $id = null;
+
+    #[ORM\ManyToOne(targetEntity: Game::class)]
+    #[ORM\JoinColumn(nullable: false)]
+    private ?Game $game = null;
+
+    #[ORM\Column(type: 'string', length: 255, enumType: GameSettingType::class)]
+    private ?GameSettingType $name = null;
+
+    #[ORM\Column(type: 'text', nullable: true)]
+    private ?string $value = null;
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getGame(): ?Game
+    {
+        return $this->game;
+    }
+
+    public function setGame(?Game $game): static
+    {
+        $this->game = $game;
+
+        return $this;
+    }
+
+    public function getName(): ?GameSettingType
+    {
+        return $this->name;
+    }
+
+    public function setName(GameSettingType $name): static
+    {
+        $this->name = $name;
+
+        return $this;
+    }
+
+    public function getValue(): ?string
+    {
+        return $this->value;
+    }
+
+    public function setValue(?string $value): static
+    {
+        $this->value = $value;
+
+        return $this;
+    }
+}

src/Game/Entity/Player.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Game\Entity;
+
+use App\Game\Repository\PlayerRepository;
+use App\Tech\Entity\User;
+use Doctrine\ORM\Mapping as ORM;
+
+#[ORM\Entity(repositoryClass: PlayerRepository::class)]
+#[ORM\Table(name: 'player')]
+class Player
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    private ?int $id = null;
+
+    #[ORM\ManyToOne(targetEntity: Session::class)]
+    #[ORM\JoinColumn(nullable: false)]
+    private ?Session $session = null;
+
+    #[ORM\ManyToOne(targetEntity: User::class)]
+    #[ORM\JoinColumn(nullable: false)]
+    private ?User $user = null;
+
+    #[ORM\Column]
+    private ?int $screen = null;
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getSession(): ?Session
+    {
+        return $this->session;
+    }
+
+    public function setSession(?Session $session): static
+    {
+        $this->session = $session;
+
+        return $this;
+    }
+
+    public function getUser(): ?User
+    {
+        return $this->user;
+    }
+
+    public function setUser(?User $user): static
+    {
+        $this->user = $user;
+
+        return $this;
+    }
+
+    public function getScreen(): ?int
+    {
+        return $this->screen;
+    }
+
+    public function setScreen(int $screen): static
+    {
+        $this->screen = $screen;
+
+        return $this;
+    }
+}

src/Game/Entity/Session.php

@@ -0,0 +1,159 @@
+<?php
+
+namespace App\Game\Entity;
+
+use App\Game\Enum\SessionStatus;
+use App\Game\Repository\SessionRepository;
+use Doctrine\Common\Collections\ArrayCollection;
+use Doctrine\Common\Collections\Collection;
+use Doctrine\DBAL\Types\Types;
+use Doctrine\ORM\Mapping as ORM;
+
+#[ORM\Entity(repositoryClass: SessionRepository::class)]
+#[ORM\Table(name: 'session')]
+class Session
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    private ?int $id = null;
+
+    #[ORM\ManyToOne(targetEntity: Game::class, inversedBy: 'sessions')]
+    #[ORM\JoinColumn(nullable: false)]
+    private ?Game $game = null;
+
+    #[ORM\Column(type: 'string', length: 20, enumType: SessionStatus::class)]
+    private ?SessionStatus $status = null;
+
+    #[ORM\Column]
+    private ?int $timer = null;
+
+    #[ORM\Column(type: Types::DATETIME_MUTABLE)]
+    private ?\DateTimeInterface $created = null;
+
+    #[ORM\OneToMany(mappedBy: 'session', targetEntity: Player::class)]
+    private Collection $players;
+
+    #[ORM\OneToMany(mappedBy: 'session', targetEntity: SessionSetting::class)]
+    private Collection $settings;
+
+    public function __construct()
+    {
+        $this->created = new \DateTime();
+        $this->players = new ArrayCollection();
+        $this->settings = new ArrayCollection();
+    }
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getGame(): ?Game
+    {
+        return $this->game;
+    }
+
+    public function setGame(?Game $game): static
+    {
+        $this->game = $game;
+
+        return $this;
+    }
+
+    public function getStatus(): ?SessionStatus
+    {
+        return $this->status;
+    }
+
+    public function setStatus(SessionStatus $status): static
+    {
+        $this->status = $status;
+
+        return $this;
+    }
+
+    public function getTimer(): ?int
+    {
+        return $this->timer;
+    }
+
+    public function setTimer(int $timer): static
+    {
+        $this->timer = $timer;
+
+        return $this;
+    }
+
+    public function getCreated(): ?\DateTimeInterface
+    {
+        return $this->created;
+    }
+
+    public function setCreated(\DateTimeInterface $created): static
+    {
+        $this->created = $created;
+
+        return $this;
+    }
+
+    /**
+     * @return Collection<int, Player>
+     */
+    public function getPlayers(): Collection
+    {
+        return $this->players;
+    }
+
+    public function addPlayer(Player $player): static
+    {
+        if (!$this->players->contains($player)) {
+            $this->players->add($player);
+            $player->setSession($this);
+        }
+
+        return $this;
+    }
+
+    public function removePlayer(Player $player): static
+    {
+        if ($this->players->removeElement($player)) {
+            // set the owning side to null (unless already changed)
+            if ($player->getSession() === $this) {
+                $player->setSession(null);
+            }
+        }
+
+        return $this;
+    }
+
+    /**
+     * @return Collection<int, SessionSetting>
+     */
+    public function getSettings(): Collection
+    {
+        return $this->settings;
+    }
+
+    public function addSetting(SessionSetting $setting): static
+    {
+        if (!$this->settings->contains($setting)) {
+            $this->settings->add($setting);
+            $setting->setSession($this);
+        }
+
+        return $this;
+    }
+
+    public function removeSetting(SessionSetting $setting): static
+    {
+        if ($this->settings->removeElement($setting)) {
+            // set the owning side to null (unless already changed)
+            if ($setting->getSession() === $this) {
+                $setting->setSession(null);
+            }
+        }
+
+        return $this;
+    }
+}

src/Game/Entity/SessionSetting.php

@@ -0,0 +1,84 @@
+<?php
+
+namespace App\Game\Entity;
+
+use App\Game\Enum\SessionSettingType;
+use App\Game\Repository\SessionSettingRepository;
+use Doctrine\ORM\Mapping as ORM;
+
+#[ORM\Entity(repositoryClass: SessionSettingRepository::class)]
+#[ORM\Table(name: 'session_setting')]
+class SessionSetting
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    private ?int $id = null;
+
+    #[ORM\ManyToOne(targetEntity: Session::class)]
+    #[ORM\JoinColumn(nullable: false)]
+    private ?Session $session = null;
+
+    #[ORM\ManyToOne(targetEntity: Player::class)]
+    #[ORM\JoinColumn(nullable: true)]
+    private ?Player $player = null;
+
+    #[ORM\Column(type: 'string', length: 255, enumType: SessionSettingType::class)]
+    private ?SessionSettingType $name = null;
+
+    #[ORM\Column(type: 'text', nullable: true)]
+    private ?string $value = null;
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getSession(): ?Session
+    {
+        return $this->session;
+    }
+
+    public function setSession(?Session $session): static
+    {
+        $this->session = $session;
+
+        return $this;
+    }
+
+    public function getPlayer(): ?Player
+    {
+        return $this->player;
+    }
+
+    public function setPlayer(?Player $player): static
+    {
+        $this->player = $player;
+
+        return $this;
+    }
+
+    public function getName(): ?SessionSettingType
+    {
+        return $this->name;
+    }
+
+    public function setName(SessionSettingType $name): static
+    {
+        $this->name = $name;
+
+        return $this;
+    }
+
+    public function getValue(): ?string
+    {
+        return $this->value;
+    }
+
+    public function setValue(?string $value): static
+    {
+        $this->value = $value;
+
+        return $this;
+    }
+}

src/Game/Enum/DecodeMessage.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Game\Enum;
+
+enum DecodeMessage: string
+{
+    case TEST = 'This is a test decoding message.';
+    case SECRET = 'The secret code is 42.';
+    case WELCOME = 'Welcome to the system, agent.';
+}

src/Game/Enum/GameSettingType.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Game\Enum;
+
+enum GameSettingType: string
+{
+    case TOTAL_TIME = 'totalTime';
+}

src/Game/Enum/GameStatus.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Game\Enum;
+
+enum GameStatus: string
+{
+    case IN_DEVELOPMENT = 'inDevelopment';
+    case LOCKED = 'locked';
+    case OPEN = 'open';
+}

src/Game/Enum/SessionSettingType.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace App\Game\Enum;
+
+enum SessionSettingType: string
+{
+    case PWD_FOR_PLAYER1 = 'PwdForPlayer1';
+    case PWD_FOR_PLAYER2 = 'PwdForPlayer2';
+    case PWD_FOR_PLAYER3 = 'PwdForPlayer3';
+    case RIGHTS_FOR_PLAYER1 = 'RightsForPlayer1';
+    case RIGHTS_FOR_PLAYER2 = 'RightsForPlayer2';
+    case RIGHTS_FOR_PLAYER3 = 'RightsForPlayer3';
+}

src/Game/Enum/SessionStatus.php

@@ -0,0 +1,12 @@
+<?php
+
+namespace App\Game\Enum;
+
+enum SessionStatus: string
+{
+    case CREATED = 'created';
+    case READY = 'ready';
+    case PLAYING = 'playing';
+    case WON = 'won';
+    case LOST = 'lost';
+}

src/Game/Repository/GameRepository.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Game\Repository;
+
+use App\Game\Entity\Game;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<Game>
+ */
+class GameRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, Game::class);
+    }
+}

src/Game/Repository/GameSettingRepository.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Game\Repository;
+
+use App\Game\Entity\Game;
+use App\Game\Entity\GameSetting;
+use App\Game\Enum\GameSettingType;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<GameSetting>
+ */
+class GameSettingRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, GameSetting::class);
+    }
+
+    public function getSetting(Game $game, GameSettingType $name): ?GameSetting
+    {
+        return $this->findOneBy([
+            'game' => $game,
+            'name' => $name,
+        ]);
+    }
+}

src/Game/Repository/PlayerRepository.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Game\Repository;
+
+use App\Game\Entity\Player;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<Player>
+ */
+class PlayerRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, Player::class);
+    }
+}

src/Game/Repository/SessionRepository.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Game\Repository;
+
+use App\Game\Entity\Session;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<Session>
+ */
+class SessionRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, Session::class);
+    }
+}

src/Game/Repository/SessionSettingRepository.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Game\Repository;
+
+use App\Game\Enum\SessionSettingType;
+use App\Game\Entity\Player;
+use App\Game\Entity\Session;
+use App\Game\Entity\SessionSetting;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<SessionSetting>
+ */
+class SessionSettingRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, SessionSetting::class);
+    }
+
+    public function getSetting(Session $session, SessionSettingType $name, ?Player $player = null): ?SessionSetting
+    {
+        $qb = $this->createQueryBuilder('s')
+            ->where('s.session = :session')
+            ->andWhere('s.name = :name')
+            ->setParameter('session', $session)
+            ->setParameter('name', $name->value);
+
+        if ($player) {
+            $qb->andWhere('s.player = :player')
+                ->setParameter('player', $player);
+        } else {
+            $qb->andWhere('s.player IS NULL');
+        }
+
+        return $qb->getQuery()->getOneOrNullResult();
+    }
+}

src/Game/Service/GameResponseService.php

@@ -0,0 +1,332 @@
+<?php
+
+namespace App\Game\Service;
+
+use App\Game\Enum\DecodeMessage;
+use App\Game\Enum\SessionSettingType;
+use App\Game\Entity\Player;
+use App\Game\Repository\SessionSettingRepository;
+use App\Tech\Entity\User;
+use Symfony\Bundle\SecurityBundle\Security;
+
+class GameResponseService
+{
+    public function __construct(
+        private Security $security,
+        private PlayerService $playerService,
+        private SessionSettingRepository $sessionSettingRepository,
+    ) {
+    }
+
+    public function getGameResponse(string $raw)
+    {
+        $info = json_decode($raw, true);
+
+        $message = $info['message'] ?? '';
+        $ts = $info['ts'] ?? '';
+
+        if(!is_string($message))
+            return ['error' => 'Invalid message.'];
+
+        $user = $this->security->getUser();
+
+        if(!$user instanceof User)
+            return ['error' => 'You are not logged in.'];
+
+        $player = $this->playerService->GetCurrentlyActiveAsPlayer($user);
+
+        if(!$player)
+            return ['error' => 'You are not in a game.'];
+
+        // TODO: Here i need to add a message handler to save the message in a big log.
+
+        $data = [];
+
+        if(str_starts_with($message, '/')) {
+            $data = $this->checkGameCommando($message, $player);
+        } else {
+            $data = $this->checkConsoleCommando($message, $player);
+        }
+
+        return $data;
+    }
+
+    private function getRechten(Player $player): array
+    {
+        $settingName = match($player->getScreen()) {
+            1 => SessionSettingType::RIGHTS_FOR_PLAYER1,
+            2 => SessionSettingType::RIGHTS_FOR_PLAYER2,
+            3 => SessionSettingType::RIGHTS_FOR_PLAYER3,
+            default => null,
+        };
+
+        if (!$settingName) {
+            return [];
+        }
+
+        $setting = $this->sessionSettingRepository->getSetting($player->getSession(), $settingName, $player);
+        if (!$setting || !$setting->getValue()) {
+            return [];
+        }
+
+        return json_decode($setting->getValue(), true) ?? [];
+    }
+
+    private function checkGameCommando(string $message, Player $player) : array
+    {
+        $messagePart = explode(' ', $message);
+
+        $rechten = $this->getRechten($player);
+
+        switch($messagePart[0]) {
+            case '/chat':
+                if(!in_array('chat', $rechten))
+                    return ['result' => ['Unknown command']];
+
+                $this->handleChatMessage($message);
+                break;
+            case '/help':
+                return ['result' => $this->getHelpCommand($rechten)];
+            case '/decode':
+                if(!in_array('decode', $rechten))
+                    return ['result' => ['Unknown command']];
+
+                return ['result' => [$this->handleDecodeMessage($messagePart[1], $player)]];
+            case '/verify':
+                if(!in_array('verify', $rechten))
+                    return ['result' => ['Unknown command']];
+
+                $result = $this->handleVerifyMessage($message);
+                return ['result' => [$result]];
+            default:
+                return ['result' => ['Unknown command']];
+        }
+        return [];
+    }
+
+    private function checkConsoleCommando(string $message, Player $player, bool $sudo = false) : array
+    {
+        $messagePart = explode(' ', $message);
+        $rechten = $this->getRechten($player);
+        switch($messagePart[0]) {
+            case 'help':
+                return ['result' => $this->getHelpCommand($rechten)];
+            case 'ls':
+                break;
+            case 'cd':
+                $pwd = $this->playerService->getCurrentPwdOfPlayer($player);
+                if(!$pwd)
+                    return ['result' => ['Unknown command']];
+                $newLocation = $this->goToNewDir($pwd, $messagePart[1], $player);
+
+                if($newLocation === false)
+                    return ['result' => ['Unknown path']];
+
+                $this->playerService->saveCurrentPwdOfPlayer($player, $newLocation);
+                return ['result' => ['Path: ' . $newLocation]];
+            case 'rm':
+                break;
+            case 'sudo':
+                break;
+            default:
+                return ['result' => ['Unknown command']];
+        }
+        return [];
+    }
+
+    private function getHelpCommand(mixed $rechten) : array
+    {
+        $messages = [];
+
+        foreach($rechten as $recht) {
+            switch($recht) {
+                case 'chat':
+                    $messages[] = '/chat';
+                    $messages[] = '   Use /chat {message} to send the message to the other agents.';
+                    $messages[] = '   If you want to send a message specifically to one other agent, use the id of the agent after /chat, like /chat 6 {message}';
+                    $messages[] = '   This will send the message only to agent with id 6.';
+                    $messages[] = '   USAGE: /chat {message}';
+                    $messages[] = '';
+                    break;
+                case 'help':
+                    $messages[] = '/help';
+                    $messages[] = '   This shows this help.';
+                    $messages[] = '   USAGE: /help';
+                    $messages[] = '';
+                    break;
+                case 'decode':
+                    $messages[] = '/decode';
+                    $messages[] = '   This message will decode the message followed by it.';
+                    $messages[] = '   Every agent has a different way to decode messages. This is a security measure. The AI Virus has no access to all decoders.';
+                    $messages[] = '   USAGE: /decode {message}';
+                    $messages[] = '';
+                    break;
+                case 'cat':
+                    $messages[] = 'cat';
+                    $messages[] = '   To read a file, use cat {filename}.';
+                    $messages[] = '   This will print the full content of the file on the screen.';
+                    $messages[] = '   USAGE: cat {filename}';
+                    $messages[] = '';
+                    break;
+                case 'ls':
+                    $messages[] = 'ls';
+                    $messages[] = '   To show all the files in the current directory, use ls.';
+                    $messages[] = '   This will print the full list of directories and files of the current location on your screen.';
+                    $messages[] = '   USAGE: ls';
+                    $messages[] = '';
+                    break;
+                case 'rm':
+                    $messages[] = 'rm';
+                    $messages[] = '   Use rm to delete a file.';
+                    $messages[] = '   Be careful with this command. It can not be undone and we do not want to lose any valuable data.';
+                    $messages[] = '   USAGE: rm {filename}';
+                    $messages[] = '';
+                    break;
+                case 'cd':
+                    $messages[] = 'cd';
+                    $messages[] = '   Use cd to move to a different directory.';
+                    $messages[] = '   You can go into a folder by using cd {foldername}, or a folder up by using "cd ..".';
+                    $messages[] = '   Using cd / moves you to the root directory.';
+                    $messages[] = '   USAGE: cd {directory}';
+                    $messages[] = '';
+                    break;
+                case 'sudo':
+                    $messages[] = 'sudo';
+                    $messages[] = '   If you do not have enough rights to execute a command, you can use sudo to execute it as root.';
+                    $messages[] = '   This is only possible for verified users. To verify yourself, use the /verify command.';
+                    $messages[] = '   USAGE: sudo {command}';
+                    $messages[] = '';
+                    break;
+                case 'verify':
+                    $messages[] = '/verify';
+                    $messages[] = '   You can verify yourself by using this command.';
+                    $messages[] = '   Use this command and follow instructions to verify yourself.';
+                    $messages[] = '   USAGE: /verify';
+                    $messages[] = '';
+                    break;
+            }
+        }
+
+        return $messages;
+    }
+
+    private function handleChatMessage(string $message)
+    {
+
+    }
+
+    private function handleDecodeMessage(string $message, Player $player)
+    {
+        $userNumber = $player->getScreen();
+
+        preg_match('/\d+/', $message, $matches);
+        $num = $matches[0] ?? null;
+        $randomString = $this->generateRandomString(250, 500);
+
+        if(is_null($num) || $num != $userNumber)
+            return $randomString;
+
+        foreach (DecodeMessage::cases() as $decodeMessage) {
+            if ($decodeMessage->name === $message) {
+                return $decodeMessage->value;
+            }
+        }
+
+        return $randomString;
+    }
+
+    private function generateRandomString(int $min, int $max): string
+    {
+        $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ ';
+        $charactersLength = strlen($characters);
+        $randomString = '';
+        $length = random_int($min, $max);
+        for ($i = 0; $i < $length; $i++) {
+            $randomString .= $characters[random_int(0, $charactersLength - 1)];
+        }
+        return $randomString;
+    }
+
+    private function handleVerifyMessage(string $message) : string
+    {
+        return '';
+    }
+
+    private function goToNewDir(string $pwd, string $newPwd, Player $player) : string|bool
+    {
+        $allPossiblePaths = $this->getAllPossiblePaths($player);
+
+        $dirParts = explode('/', $newPwd);
+
+        $int = count($dirParts);
+
+        if($dirParts[0] == '') {
+            $newDir = '';
+            $startPart = 1;
+        } else {
+            $newDir = $pwd;
+            $startPart = 0;
+        }
+
+        for($i = $startPart; $i < $int; $i++) {
+            if($dirParts[$i] == '..')
+                $newDir = $this->getPrevPath($newDir);
+            else
+                $newDir .= '/' . $dirParts[$i];
+
+            if(!in_array($newDir, $allPossiblePaths))
+                return false;
+        }
+
+        return $newDir;
+    }
+
+    private function getPrevPath(string $pwd) : string
+    {
+        $pwdParts = explode('/', $pwd);
+        array_pop($pwdParts);
+        $pwd = implode('/', $pwdParts);
+        return $pwd;
+    }
+
+    private function getAllPossiblePaths(Player $player) : array
+    {
+        $paths = [];
+
+        $paths[] = '/';
+        $paths[] = '/var';
+        $paths[] = '/var/arrest';
+        $paths[] = '/var/www';
+        $paths[] = '/var/marriage';
+        $paths[] = '/var/rapports';
+        $paths[] = '/var/linking';
+
+        $paths[] = '/etc';
+        $paths[] = '/etc/short';
+        $paths[] = '/etc/long';
+        $paths[] = '/etc/arrest';
+        $paths[] = '/etc/power';
+        $paths[] = '/etc/break';
+        $paths[] = '/etc/handle';
+        $paths[] = '/etc/freak';
+        $paths[] = '/etc/host';
+
+        $paths[] = '/home';
+
+        $playerNames = ['root', 'Luke', 'Charles', 'William', 'Peter'];
+
+        $players = $player->getSession()->getPlayers();
+
+        foreach($players as $player) {
+            $playerNames[] = $player->getUser()->getUsername();
+        }
+
+        $playerNames = array_unique($playerNames);
+
+        foreach($playerNames as $name) {
+            $paths[] = '/home/' . $name;
+        }
+
+        return $paths;
+    }
+}

src/Game/Service/PlayerService.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Game\Service;
+
+use App\Game\Entity\Game;
+use App\Game\Entity\Player;
+use App\Game\Enum\SessionSettingType;
+use App\Game\Enum\SessionStatus;
+use App\Game\Repository\PlayerRepository;
+use App\Game\Repository\SessionSettingRepository;
+use App\Tech\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+
+class PlayerService
+{
+    public function __construct(
+        private PlayerRepository $playerRepository,
+        private SessionSettingRepository $sessionSettingRepository,
+        private EntityManagerInterface $entityManager,
+    ) {
+    }
+
+    public function GetCurrentlyActiveAsPlayer(User $user): ?Player
+    {
+        $player = $this->playerRepository->createQueryBuilder('p')
+            ->join('p.session', 's')
+            ->where('p.user = :user')
+            ->andWhere('s.status IN (:statuses)')
+            ->setParameter('user', $user)
+            ->setParameter('statuses', [
+                SessionStatus::READY,
+                SessionStatus::PLAYING,
+            ])
+            ->setMaxResults(1)
+            ->getQuery()
+            ->getOneOrNullResult();
+
+        return $player;
+    }
+
+    public function getCurrentPwdOfPlayer(Player $player) : ?string {
+        $settingName = match($player->getScreen()) {
+            1 => SessionSettingType::PWD_FOR_PLAYER1,
+            2 => SessionSettingType::PWD_FOR_PLAYER2,
+            3 => SessionSettingType::PWD_FOR_PLAYER3,
+            default => null,
+        };
+
+        if (!$settingName) {
+            return null;
+        }
+
+        $setting = $this->sessionSettingRepository->getSetting($player->getSession(), $settingName, $player);
+        return $setting?->getValue();
+    }
+
+    public function saveCurrentPwdOfPlayer(Player $player, string $newLocation)
+    {
+        $settingName = match($player->getScreen()) {
+            1 => SessionSettingType::PWD_FOR_PLAYER1,
+            2 => SessionSettingType::PWD_FOR_PLAYER2,
+            3 => SessionSettingType::PWD_FOR_PLAYER3,
+            default => null,
+        };
+
+        if (!$settingName) {
+            return;
+        }
+
+        $setting = $this->sessionSettingRepository->getSetting($player->getSession(), $settingName, $player);
+        $setting->setValue($newLocation);
+
+        $this->entityManager->persist($setting);
+        $this->entityManager->flush();
+    }
+}

src/Tech/Controller/ActivationController.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Tech\Controller;
+
+use App\Tech\Repository\UserRepository;
+use App\Tech\Service\EmailVerifier;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Annotation\Route;
+use SymfonyCasts\Bundle\VerifyEmail\Exception\VerifyEmailExceptionInterface;
+
+class ActivationController extends AbstractController
+{
+    #[Route('/verify/email', name: 'app_verify_email')]
+    public function verifyUserEmail(Request $request, UserRepository $userRepository, EmailVerifier $emailVerifier): Response
+    {
+        $id = $request->query->get('id');
+
+        if (null === $id) {
+            return $this->redirectToRoute('app_register');
+        }
+
+        $user = $userRepository->find($id);
+
+        if (null === $user) {
+            return $this->redirectToRoute('app_register');
+        }
+
+        // validate email confirmation link, sets User::isVerified=true and persists
+        try {
+            $emailVerifier->handleEmailConfirmation($request, $user);
+        } catch (VerifyEmailExceptionInterface $exception) {
+            $this->addFlash('error', $exception->getReason());
+
+            return $this->redirectToRoute('app_register');
+        }
+
+        $this->addFlash('success', 'Your email address has been verified. You can now log in.');
+
+        return $this->redirectToRoute('app_login');
+    }
+}

src/Tech/Controller/RegistrationController.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Tech\Controller;
+
+use App\Tech\Entity\User;
+use App\Tech\Form\RegistrationFormType;
+use App\Tech\Service\EmailVerifier;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bridge\Twig\Mime\TemplatedEmail;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+use Symfony\Component\Routing\Annotation\Route;
+
+class RegistrationController extends AbstractController
+{
+    #[Route('/register', name: 'app_register')]
+    public function register(Request $request, UserPasswordHasherInterface $userPasswordHasher, EntityManagerInterface $entityManager, EmailVerifier $emailVerifier): Response
+    {
+        $user = new User();
+        $form = $this->createForm(RegistrationFormType::class, $user);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            // encode the plain password
+            $user->setPassword(
+                $userPasswordHasher->hashPassword(
+                    $user,
+                    $form->get('plainPassword')->getData()
+                )
+            );
+
+            $entityManager->persist($user);
+            $entityManager->flush();
+
+            // generate a signed url and email it to the user
+            $emailVerifier->sendEmailConfirmation('app_verify_email', $user,
+                (new TemplatedEmail())
+                    ->from('noreply@escapepage.dev')
+                    ->to($user->getEmail())
+                    ->subject('Please Confirm your Email')
+                    ->htmlTemplate('tech/registration/confirmation_email.html.twig')
+            );
+
+            $this->addFlash('success', 'A confirmation email has been sent to your email address.');
+
+            return $this->redirectToRoute('website_home');
+        }
+
+        return $this->render('tech/registration/register.html.twig', [
+            'registrationForm' => $form->createView(),
+        ]);
+    }
+}

src/Tech/Controller/ResetPasswordController.php

@@ -0,0 +1,176 @@
+<?php
+
+namespace App\Tech\Controller;
+
+use App\Tech\Form\ChangePasswordFormType;
+use App\Tech\Form\ResetPasswordRequestFormType;
+use App\Tech\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bridge\Twig\Mime\TemplatedEmail;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Mailer\MailerInterface;
+use Symfony\Component\Mime\Address;
+use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Contracts\Translation\TranslatorInterface;
+use SymfonyCasts\Bundle\ResetPassword\Controller\ResetPasswordControllerTrait;
+use SymfonyCasts\Bundle\ResetPassword\Exception\ResetPasswordExceptionInterface;
+use SymfonyCasts\Bundle\ResetPassword\ResetPasswordHelperInterface;
+
+#[Route('/reset-password')]
+class ResetPasswordController extends AbstractController
+{
+    use ResetPasswordControllerTrait;
+
+    public function __construct(
+        private ResetPasswordHelperInterface $resetPasswordHelper,
+        private EntityManagerInterface $entityManager
+    ) {
+    }
+
+    /**
+     * Display & process form to request a password reset.
+     */
+    #[Route('', name: 'app_forgot_password_request')]
+    public function request(Request $request, MailerInterface $mailer, TranslatorInterface $translator): Response
+    {
+        $form = $this->createForm(ResetPasswordRequestFormType::class);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            /** @var string $email */
+            $email = $form->get('email')->getData();
+
+            return $this->processSendingPasswordResetEmail($email, $mailer, $translator
+            );
+        }
+
+        return $this->render('tech/reset_password/request.html.twig', [
+            'requestForm' => $form,
+        ]);
+    }
+
+    /**
+     * Confirmation page after a user has requested a password reset.
+     */
+    #[Route('/check-email', name: 'app_check_email')]
+    public function checkEmail(): Response
+    {
+        // Generate a fake token if the user does not exist or someone hit this page directly.
+        // This prevents exposing whether or not a user was found with the given email address or not
+        if (null === ($resetToken = $this->getTokenObjectFromSession())) {
+            $resetToken = $this->resetPasswordHelper->generateFakeResetToken();
+        }
+
+        return $this->render('tech/reset_password/check_email.html.twig', [
+            'resetToken' => $resetToken,
+        ]);
+    }
+
+    /**
+     * Validates and process the reset URL that the user clicked in their email.
+     */
+    #[Route('/reset/{token}', name: 'app_reset_password')]
+    public function reset(Request $request, UserPasswordHasherInterface $passwordHasher, TranslatorInterface $translator, ?string $token = null): Response
+    {
+        if ($token) {
+            // We store the token in session and remove it from the URL, to avoid the URL being
+            // loaded in a browser and potentially leaking the token to 3rd party JavaScript.
+            $this->storeTokenInSession($token);
+
+            return $this->redirectToRoute('app_reset_password');
+        }
+
+        $token = $this->getTokenFromSession();
+
+        if (null === $token) {
+            throw $this->createNotFoundException('No reset password token found in the URL or in the session.');
+        }
+
+        try {
+            /** @var User $user */
+            $user = $this->resetPasswordHelper->validateTokenAndFetchUser($token);
+        } catch (ResetPasswordExceptionInterface $e) {
+            $this->addFlash('reset_password_error', sprintf(
+                '%s - %s',
+                $translator->trans(ResetPasswordExceptionInterface::MESSAGE_PROBLEM_VALIDATE, [], 'ResetPasswordBundle'),
+                $translator->trans($e->getReason(), [], 'ResetPasswordBundle')
+            ));
+
+            return $this->redirectToRoute('app_forgot_password_request');
+        }
+
+        // The token is valid; allow the user to change their password.
+        $form = $this->createForm(ChangePasswordFormType::class);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            // A password reset token should be used only once, remove it.
+            $this->resetPasswordHelper->removeResetRequest($token);
+
+            /** @var string $plainPassword */
+            $plainPassword = $form->get('plainPassword')->getData();
+
+            // Encode(hash) the plain password, and set it.
+            $user->setPassword($passwordHasher->hashPassword($user, $plainPassword));
+            $this->entityManager->flush();
+
+            // The session is cleaned up after the password has been changed.
+            $this->cleanSessionAfterReset();
+
+            return $this->redirectToRoute('website_home');
+        }
+
+        return $this->render('tech/reset_password/reset.html.twig', [
+            'resetForm' => $form,
+        ]);
+    }
+
+    private function processSendingPasswordResetEmail(string $emailFormData, MailerInterface $mailer, TranslatorInterface $translator): RedirectResponse
+    {
+        $user = $this->entityManager->getRepository(User::class)->findOneBy([
+            'email' => $emailFormData,
+        ]);
+
+        // Do not reveal whether a user account was found or not.
+        if (!$user) {
+            return $this->redirectToRoute('app_check_email');
+        }
+
+        try {
+            $resetToken = $this->resetPasswordHelper->generateResetToken($user);
+        } catch (ResetPasswordExceptionInterface $e) {
+            // If you want to tell the user why a reset email was not sent, uncomment
+            // the lines below and change the redirect to 'app_forgot_password_request'.
+            // Caution: This may reveal if a user is registered or not.
+            //
+            // $this->addFlash('reset_password_error', sprintf(
+            //     '%s - %s',
+            //     $translator->trans(ResetPasswordExceptionInterface::MESSAGE_PROBLEM_HANDLE, [], 'ResetPasswordBundle'),
+            //     $translator->trans($e->getReason(), [], 'ResetPasswordBundle')
+            // ));
+
+            return $this->redirectToRoute('app_check_email');
+        }
+
+        $email = (new TemplatedEmail())
+            ->from(new Address('noreply@escapepage.com', 'Escapepage'))
+            ->to((string) $user->getEmail())
+            ->subject('Your password reset request')
+            ->htmlTemplate('tech/reset_password/email.html.twig')
+            ->context([
+                'resetToken' => $resetToken,
+            ])
+        ;
+
+        $mailer->send($email);
+
+        // Store the token object in session for retrieval in check-email route.
+        $this->setTokenObjectInSession($resetToken);
+
+        return $this->redirectToRoute('app_check_email');
+    }
+}

src/Tech/Controller/SecurityController.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Tech\Controller;
+
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Annotation\Route;
+use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
+
+class SecurityController extends AbstractController
+{
+    #[Route(path: '/login', name: 'app_login')]
+    public function login(AuthenticationUtils $authenticationUtils): Response
+    {
+        // if ($this->getUser()) {
+        //     return $this->redirectToRoute('target_path');
+        // }
+
+        // get the login error if there is one
+        $error = $authenticationUtils->getLastAuthenticationError();
+        // last username entered by the user
+        $lastUsername = $authenticationUtils->getLastUsername();
+
+        return $this->render('tech/security/login.html.twig', ['last_username' => $lastUsername, 'error' => $error]);
+    }
+
+    #[Route(path: '/logout', name: 'app_logout')]
+    public function logout(): void
+    {
+        throw new \LogicException('This method can be blank - it will be intercepted by the logout key on your firewall.');
+    }
+}

src/Tech/Entity/EmailLog.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace App\Tech\Entity;
+
+use App\Tech\Repository\EmailLogRepository;
+use Doctrine\DBAL\Types\Types;
+use Doctrine\ORM\Mapping as ORM;
+
+#[ORM\Entity(repositoryClass: EmailLogRepository::class)]
+#[ORM\Table(name: 'email_log')]
+class EmailLog
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    private ?int $id = null;
+
+    #[ORM\ManyToOne(targetEntity: User::class)]
+    #[ORM\JoinColumn(nullable: false)]
+    private ?User $user = null;
+
+    #[ORM\Column(length: 255)]
+    private ?string $emailIdentifier = null;
+
+    #[ORM\Column(type: Types::DATETIME_IMMUTABLE)]
+    private ?\DateTimeImmutable $sentAt = null;
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getUser(): ?User
+    {
+        return $this->user;
+    }
+
+    public function setUser(?User $user): static
+    {
+        $this->user = $user;
+
+        return $this;
+    }
+
+    public function getEmailIdentifier(): ?string
+    {
+        return $this->emailIdentifier;
+    }
+
+    public function setEmailIdentifier(string $emailIdentifier): static
+    {
+        $this->emailIdentifier = $emailIdentifier;
+
+        return $this;
+    }
+
+    public function getSentAt(): ?\DateTimeImmutable
+    {
+        return $this->sentAt;
+    }
+
+    public function setSentAt(\DateTimeImmutable $sentAt): static
+    {
+        $this->sentAt = $sentAt;
+
+        return $this;
+    }
+}

src/Tech/Entity/ResetPasswordRequest.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Tech\Entity;
+
+use App\Tech\Repository\ResetPasswordRequestRepository;
+use App\Tech\Entity\User;
+use Doctrine\ORM\Mapping as ORM;
+use SymfonyCasts\Bundle\ResetPassword\Model\ResetPasswordRequestInterface;
+use SymfonyCasts\Bundle\ResetPassword\Model\ResetPasswordRequestTrait;
+
+#[ORM\Entity(repositoryClass: ResetPasswordRequestRepository::class)]
+class ResetPasswordRequest implements ResetPasswordRequestInterface
+{
+    use ResetPasswordRequestTrait;
+
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    private ?int $id = null;
+
+    #[ORM\ManyToOne]
+    #[ORM\JoinColumn(nullable: false)]
+    private ?User $user = null;
+
+    public function __construct(User $user, \DateTimeInterface $expiresAt, string $selector, string $hashedToken)
+    {
+        $this->user = $user;
+        $this->initialize($expiresAt, $selector, $hashedToken);
+    }
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getUser(): User
+    {
+        return $this->user;
+    }
+}

src/Tech/Entity/User.php

@@ -0,0 +1,140 @@
+<?php
+
+namespace App\Tech\Entity;
+
+use App\Tech\Repository\UserRepository;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+#[ORM\Entity(repositoryClass: UserRepository::class)]
+#[ORM\Table(name: '`user`')]
+#[ORM\UniqueConstraint(name: 'UNIQ_IDENTIFIER_EMAIL', fields: ['email'])]
+#[ORM\UniqueConstraint(name: 'UNIQ_IDENTIFIER_USERNAME', fields: ['username'])]
+class User implements UserInterface, PasswordAuthenticatedUserInterface
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    private ?int $id = null;
+
+    #[ORM\Column(length: 180)]
+    private ?string $email = null;
+
+    #[ORM\Column(length: 180)]
+    private ?string $username = null;
+
+    /**
+     * @var list<string> The user roles
+     */
+    #[ORM\Column]
+    private array $roles = [];
+
+    /**
+     * @var string The hashed password
+     */
+    #[ORM\Column]
+    private ?string $password = null;
+
+    #[ORM\Column(type: 'boolean')]
+    private bool $isVerified = false;
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getEmail(): ?string
+    {
+        return $this->email;
+    }
+
+    public function setEmail(string $email): static
+    {
+        $this->email = $email;
+
+        return $this;
+    }
+
+    public function getUsername(): ?string
+    {
+        return $this->username;
+    }
+
+    public function setUsername(string $username): static
+    {
+        $this->username = $username;
+
+        return $this;
+    }
+
+    /**
+     * A visual identifier that represents this user.
+     *
+     * @see UserInterface
+     */
+    public function getUserIdentifier(): string
+    {
+        return (string) $this->username;
+    }
+
+    /**
+     * @see UserInterface
+     *
+     * @return list<string>
+     */
+    public function getRoles(): array
+    {
+        $roles = $this->roles;
+        // guarantee every user at least has ROLE_USER
+        $roles[] = 'ROLE_USER';
+
+        return array_unique($roles);
+    }
+
+    /**
+     * @param list<string> $roles
+     */
+    public function setRoles(array $roles): static
+    {
+        $this->roles = $roles;
+
+        return $this;
+    }
+
+    /**
+     * @see PasswordAuthenticatedUserInterface
+     */
+    public function getPassword(): ?string
+    {
+        return $this->password;
+    }
+
+    public function setPassword(string $password): static
+    {
+        $this->password = $password;
+
+        return $this;
+    }
+
+    /**
+     * @see UserInterface
+     */
+    public function eraseCredentials(): void
+    {
+        // If you store any temporary, sensitive data on the user, clear it here
+        // $this->plainPassword = null;
+    }
+
+    public function isVerified(): bool
+    {
+        return $this->isVerified;
+    }
+
+    public function setIsVerified(bool $isVerified): static
+    {
+        $this->isVerified = $isVerified;
+
+        return $this;
+    }
+}

src/Tech/EventListener/EmailLoggerListener.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Tech\EventListener;
+
+use App\Tech\Entity\EmailLog;
+use App\Tech\Entity\User;
+use App\Tech\Repository\UserRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bridge\Twig\Mime\TemplatedEmail;
+use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
+use Symfony\Component\Mailer\Event\MessageEvent;
+use Symfony\Component\Mime\Address;
+
+#[AsEventListener(event: MessageEvent::class, method: 'onMessage')]
+class EmailLoggerListener
+{
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+        private UserRepository $userRepository
+    ) {
+    }
+
+    public function onMessage(MessageEvent $event): void
+    {
+        $message = $event->getMessage();
+        if (!$message instanceof TemplatedEmail) {
+            return;
+        }
+
+        $recipients = $message->getTo();
+        foreach ($recipients as $recipient) {
+            if (!$recipient instanceof Address) {
+                continue;
+            }
+
+            $user = $this->userRepository->findOneBy(['email' => $recipient->getAddress()]);
+            if (!$user) {
+                continue;
+            }
+
+            $emailLog = new EmailLog();
+            $emailLog->setUser($user);
+            $emailLog->setSentAt(new \DateTimeImmutable());
+
+            // Try to get the template name, or use the subject as identifier
+            $identifier = $message->getHtmlTemplate() ?: $message->getTextTemplate() ?: $message->getSubject();
+            $emailLog->setEmailIdentifier($identifier);
+
+            $this->entityManager->persist($emailLog);
+        }
+
+        $this->entityManager->flush();
+    }
+}

src/Tech/Form/ChangePasswordFormType.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Tech\Form;
+
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\PasswordType;
+use Symfony\Component\Form\Extension\Core\Type\RepeatedType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use Symfony\Component\Validator\Constraints\Length;
+use Symfony\Component\Validator\Constraints\NotBlank;
+use Symfony\Component\Validator\Constraints\NotCompromisedPassword;
+use Symfony\Component\Validator\Constraints\PasswordStrength;
+
+class ChangePasswordFormType extends AbstractType
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        $builder
+            ->add('plainPassword', RepeatedType::class, [
+                'type' => PasswordType::class,
+                'options' => [
+                    'attr' => [
+                        'autocomplete' => 'new-password',
+                    ],
+                ],
+                'first_options' => [
+                    'constraints' => [
+                        new NotBlank([
+                            'message' => 'Please enter a password',
+                        ]),
+                        new Length([
+                            'min' => 12,
+                            'minMessage' => 'Your password should be at least {{ limit }} characters',
+                            // max length allowed by Symfony for security reasons
+                            'max' => 4096,
+                        ]),
+                        new PasswordStrength(),
+                        new NotCompromisedPassword(),
+                    ],
+                    'label' => 'New password',
+                ],
+                'second_options' => [
+                    'label' => 'Repeat Password',
+                ],
+                'invalid_message' => 'The password fields must match.',
+                // Instead of being set onto the object directly,
+                // this is read and encoded in the controller
+                'mapped' => false,
+            ])
+        ;
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([]);
+    }
+}

src/Tech/Form/RegistrationFormType.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Tech\Form;
+
+use App\Tech\Entity\User;
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\EmailType;
+use Symfony\Component\Form\Extension\Core\Type\TextType;
+use Symfony\Component\Form\Extension\Core\Type\PasswordType;
+use Symfony\Component\Form\Extension\Core\Type\RepeatedType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use Symfony\Component\Validator\Constraints\Length;
+use Symfony\Component\Validator\Constraints\NotBlank;
+
+class RegistrationFormType extends AbstractType
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        $builder
+            ->add('email', EmailType::class)
+            ->add('username', TextType::class, [
+                'constraints' => [
+                    new NotBlank([
+                        'message' => 'Please enter a username',
+                    ]),
+                ],
+            ])
+            ->add('plainPassword', RepeatedType::class, [
+                'type' => PasswordType::class,
+                'mapped' => false,
+                'attr' => ['autocomplete' => 'new-password'],
+                'first_options'  => ['label' => 'Password'],
+                'second_options' => ['label' => 'Repeat Password'],
+                'constraints' => [
+                    new NotBlank([
+                        'message' => 'Please enter a password',
+                    ]),
+                    new Length([
+                        'min' => 6,
+                        'minMessage' => 'Your password should be at least {{ limit }} characters',
+                        // max length allowed by Symfony for security reasons
+                        'max' => 4096,
+                    ]),
+                ],
+            ])
+        ;
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+            'data_class' => User::class,
+        ]);
+    }
+}

src/Tech/Form/ResetPasswordRequestFormType.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Tech\Form;
+
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\EmailType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use Symfony\Component\Validator\Constraints\NotBlank;
+
+class ResetPasswordRequestFormType extends AbstractType
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        $builder
+            ->add('email', EmailType::class, [
+                'attr' => ['autocomplete' => 'email'],
+                'constraints' => [
+                    new NotBlank([
+                        'message' => 'Please enter your email',
+                    ]),
+                ],
+            ])
+        ;
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([]);
+    }
+}

src/Tech/Message/ProcessTaskMessage.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Tech\Message;
+
+class ProcessTaskMessage
+{
+    public function __construct(
+        private string $taskName,
+        private array $payload = [],
+    ) {
+    }
+
+    public function getTaskName(): string
+    {
+        return $this->taskName;
+    }
+
+    public function getPayload(): array
+    {
+        return $this->payload;
+    }
+}

src/Tech/MessageHandler/ProcessTaskMessageHandler.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Tech\MessageHandler;
+
+use App\Tech\Message\ProcessTaskMessage;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Messenger\Attribute\AsMessageHandler;
+
+#[AsMessageHandler]
+class ProcessTaskMessageHandler
+{
+    public function __construct(
+        private LoggerInterface $logger,
+    ) {
+    }
+
+    public function __invoke(ProcessTaskMessage $message): void
+    {
+        $this->logger->info('Processing task: ' . $message->getTaskName(), [
+            'payload' => $message->getPayload(),
+        ]);
+
+        // Implement logic based on taskName here
+    }
+}

src/Tech/Repository/EmailLogRepository.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Tech\Repository;
+
+use App\Tech\Entity\EmailLog;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<EmailLog>
+ */
+class EmailLogRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, EmailLog::class);
+    }
+}

src/Tech/Repository/ResetPasswordRequestRepository.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Tech\Repository;
+
+use App\Tech\Entity\ResetPasswordRequest;
+use App\Tech\Entity\User;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+use SymfonyCasts\Bundle\ResetPassword\Model\ResetPasswordRequestInterface;
+use SymfonyCasts\Bundle\ResetPassword\Persistence\Repository\ResetPasswordRequestRepositoryTrait;
+use SymfonyCasts\Bundle\ResetPassword\Persistence\ResetPasswordRequestRepositoryInterface;
+
+/**
+ * @extends ServiceEntityRepository<ResetPasswordRequest>
+ */
+class ResetPasswordRequestRepository extends ServiceEntityRepository implements ResetPasswordRequestRepositoryInterface
+{
+    use ResetPasswordRequestRepositoryTrait;
+
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, ResetPasswordRequest::class);
+    }
+
+    /**
+     * @param User $user
+     */
+    public function createResetPasswordRequest(object $user, \DateTimeInterface $expiresAt, string $selector, string $hashedToken): ResetPasswordRequestInterface
+    {
+        return new ResetPasswordRequest($user, $expiresAt, $selector, $hashedToken);
+    }
+}

src/Tech/Repository/UserRepository.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Tech\Repository;
+
+use App\Tech\Entity\User;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
+use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
+use Symfony\Component\Security\Core\User\PasswordUpgraderInterface;
+
+/**
+ * @extends ServiceEntityRepository<User>
+ */
+class UserRepository extends ServiceEntityRepository implements PasswordUpgraderInterface
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, User::class);
+    }
+
+    /**
+     * Used to upgrade (rehash) the user's password automatically over time.
+     */
+    public function upgradePassword(PasswordAuthenticatedUserInterface $user, string $newHashedPassword): void
+    {
+        if (!$user instanceof User) {
+            throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.', $user::class));
+        }
+
+        $user->setPassword($newHashedPassword);
+        $this->getEntityManager()->persist($user);
+        $this->getEntityManager()->flush();
+    }
+}

src/Tech/Service/EmailVerifier.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Tech\Service;
+
+use App\Tech\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bridge\Twig\Mime\TemplatedEmail;
+use Symfony\Component\Mailer\MailerInterface;
+use Symfony\Component\HttpFoundation\Request;
+use SymfonyCasts\Bundle\VerifyEmail\Exception\VerifyEmailExceptionInterface;
+use SymfonyCasts\Bundle\VerifyEmail\VerifyEmailHelperInterface;
+
+class EmailVerifier
+{
+    public function __construct(
+        private VerifyEmailHelperInterface $verifyEmailHelper,
+        private MailerInterface $mailer,
+        private EntityManagerInterface $entityManager
+    ) {
+    }
+
+    public function sendEmailConfirmation(string $verifyEmailRouteName, User $user, TemplatedEmail $email): void
+    {
+        $signatureComponents = $this->verifyEmailHelper->generateSignature(
+            $verifyEmailRouteName,
+            (string) $user->getId(),
+            $user->getEmail(),
+            ['id' => $user->getId()]
+        );
+
+        $context = $email->getContext();
+        $context['signedUrl'] = $signatureComponents->getSignedUrl();
+        $context['expiresAtMessageKey'] = $signatureComponents->getExpirationMessageKey();
+        $context['expiresAtMessageData'] = $signatureComponents->getExpirationMessageData();
+
+        $email->context($context);
+
+        $this->mailer->send($email);
+    }
+
+    /**
+     * @throws VerifyEmailExceptionInterface
+     */
+    public function handleEmailConfirmation(Request $request, User $user): void
+    {
+        $this->verifyEmailHelper->validateEmailConfirmation($request->getUri(), (string) $user->getId(), $user->getEmail());
+
+        $user->setIsVerified(true);
+
+        $this->entityManager->persist($user);
+        $this->entityManager->flush();
+    }
+}

src/Tech/Service/UserChecker.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Tech\Service;
+
+use App\Tech\Entity\User;
+use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
+use Symfony\Component\Security\Core\User\UserCheckerInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+class UserChecker implements UserCheckerInterface
+{
+    public function checkPreAuth(UserInterface $user): void
+    {
+        if (!$user instanceof User) {
+            return;
+        }
+
+        if (!$user->isVerified()) {
+            throw new CustomUserMessageAuthenticationException('Your email address is not verified.');
+        }
+    }
+
+    public function checkPostAuth(UserInterface $user): void
+    {
+    }
+}

symfony.lock

@@ -356,6 +356,21 @@
             "./webpack.config.js"
         ]
     },
+    "symfonycasts/reset-password-bundle": {
+        "version": "1.24",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "1.0",
+            "ref": "97c1627c0384534997ae1047b93be517ca16de43"
+        },
+        "files": [
+            "./config/packages/reset_password.yaml"
+        ]
+    },
+    "symfonycasts/verify-email-bundle": {
+        "version": "v1.18.0"
+    },
     "twig/extra-bundle": {
         "version": "v3.21.0"
     }

templates/base.html.twig

@@ -14,10 +14,23 @@
     <nav>
         {% set pathinfo = app.request.pathinfo %}
         <a href="/">{{ 'nav.home'|trans }}</a> |
-        <a href="/game">{{ 'nav.game'|trans }}</a>
+        <a href="/game">{{ 'nav.game'|trans }}</a> |
+        {% if app.user %}
+            <a href="{{ path('app_logout') }}">Logout</a>
+        {% else %}
+            <a href="{{ path('app_register') }}">Register</a> |
+            <a href="{{ path('app_login') }}">Login</a>
+        {% endif %}
     </nav>
 </header>
 <main>
+    {% for label, messages in app.flashes %}
+        {% for message in messages %}
+            <div class="alert alert-{{ label }}">
+                {{ message }}
+            </div>
+        {% endfor %}
+    {% endfor %}
     {% block body %}{% endblock %}
 </main>
 <footer>

templates/game/index.html.twig

@@ -1,32 +1,41 @@
-{% extends 'base.html.twig' %}
-
-{% block title %}{{ 'game.title'|trans({'%site%': ('site.name'|trans)}) }}{% endblock %}
+<!DOCTYPE html>
+<html lang="{{ app.request.locale|default(app.request.defaultLocale|default('en')) }}">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{{ 'game.title'|trans({'%site%': ('site.name'|trans)}) }}</title>
 
 {# Include Game1-specific CSS in addition to the base app assets #}
-{% block stylesheets %}
-    {{ parent() }}
-    {{ encore_entry_link_tags('game1') }}
-{% endblock %}
+    {% block stylesheets %}
+        {{ encore_entry_link_tags('app') }}
+        {{ encore_entry_link_tags('game1') }}
+    {% endblock %}
+</head>
+<body>
+    <div id="game-container">
+        <div id="mercure-config"
+             data-mercure-public-url="{{ mercure_public_url|e('html_attr') }}"
+             data-topic="{{ (mercure_topic_base ~ '/game/hub')|e('html_attr') }}"
+             data-api-ping-url="{{ path('game_api_ping')|e('html_attr') }}"
+             data-api-echo-url="{{ path('game_api_message')|e('html_attr') }}"
+             data-user-id="{{ user_id|e('html_attr') }}"
+             style="display:none">
+        </div>
 
-{% block body %}
-<h1>{{ 'game.h1'|trans }}</h1>
-<p>{{ 'game.description'|trans }}</p>
-<div class="game1-banner">Game 1 assets are active. Enjoy the challenge!</div>
+        <div id="game-timer">
+            00:30:00
+        </div>
+        <div id="message-container">
 
-{# Hidden config element read by assets/game1.js #}
-<div id="mercure-config"
-     data-mercure-public-url="{{ mercure_public_url|e('html_attr') }}"
-     data-topic="{{ (mercure_topic_base ~ '/game/hub')|e('html_attr') }}"
-     data-api-ping-url="{{ path('game_api_ping')|e('html_attr') }}"
-     data-api-echo-url="{{ path('game_api_echo')|e('html_attr') }}"
-     style="display:none">
-</div>
-
-<p><a href="{{ path('website_home') }}">{{ 'link.back_to_website'|trans }}</a></p>
-{% endblock %}
+        </div>
+        <div id="input">
+            <input type="text" disabled id="input-message">
+        </div>
+    </div>
+</body>
 
 {# Include Game1-specific JS in addition to the base app assets #}
 {% block javascripts %}
-    {{ parent() }}
+    {{ encore_entry_script_tags('app') }}
     {{ encore_entry_script_tags('game1') }}
 {% endblock %}

templates/tech/registration/confirmation_email.html.twig

@@ -0,0 +1,11 @@
+<h1>Hi! Please confirm your email!</h1>
+
+<p>
+    Please confirm your email address by clicking the following link: <br><br>
+    <a href="{{ signedUrl }}">Confirm my Email</a>.
+    This link will expire in {{ expiresAtMessageKey|trans(expiresAtMessageData, 'VerifyEmailBundle') }}.
+</p>
+
+<p>
+    Cheers!
+</p>

templates/tech/registration/register.html.twig

@@ -0,0 +1,17 @@
+{% extends 'base.html.twig' %}
+
+{% block title %}Register{% endblock %}
+
+{% block body %}
+    <h1>Register</h1>
+
+    {{ form_errors(registrationForm) }}
+
+    {{ form_start(registrationForm) }}
+        {{ form_row(registrationForm.email) }}
+        {{ form_row(registrationForm.username) }}
+        {{ form_row(registrationForm.plainPassword) }}
+
+        <button type="submit" class="btn">Register</button>
+    {{ form_end(registrationForm) }}
+{% endblock %}

templates/tech/reset_password/check_email.html.twig

@@ -0,0 +1,11 @@
+{% extends 'base.html.twig' %}
+
+{% block title %}Password Reset Email Sent{% endblock %}
+
+{% block body %}
+    <p>
+        If an account matching your email exists, then an email was just sent that contains a link that you can use to reset your password.
+        This link will expire in {{ resetToken.expirationMessageKey|trans(resetToken.expirationMessageData, 'ResetPasswordBundle') }}.
+    </p>
+    <p>If you don't receive an email please check your spam folder or <a href="{{ path('app_forgot_password_request') }}">try again</a>.</p>
+{% endblock %}

templates/tech/reset_password/email.html.twig

@@ -0,0 +1,9 @@
+<h1>Hi!</h1>
+
+<p>To reset your password, please visit the following link</p>
+
+<a href="{{ url('app_reset_password', {token: resetToken.token}) }}">{{ url('app_reset_password', {token: resetToken.token}) }}</a>
+
+<p>This link will expire in {{ resetToken.expirationMessageKey|trans(resetToken.expirationMessageData, 'ResetPasswordBundle') }}.</p>
+
+<p>Cheers!</p>

templates/tech/reset_password/request.html.twig

@@ -0,0 +1,22 @@
+{% extends 'base.html.twig' %}
+
+{% block title %}Reset your password{% endblock %}
+
+{% block body %}
+    {% for flash_error in app.flashes('reset_password_error') %}
+        <div class="alert alert-danger" role="alert">{{ flash_error }}</div>
+    {% endfor %}
+    <h1>Reset your password</h1>
+
+    {{ form_start(requestForm) }}
+        {{ form_row(requestForm.email) }}
+        <div>
+            <small>
+                Enter your email address, and we will send you a
+                link to reset your password.
+            </small>
+        </div>
+
+        <button class="btn btn-primary">Send password reset email</button>
+    {{ form_end(requestForm) }}
+{% endblock %}

templates/tech/reset_password/reset.html.twig

@@ -0,0 +1,12 @@
+{% extends 'base.html.twig' %}
+
+{% block title %}Reset your password{% endblock %}
+
+{% block body %}
+    <h1>Reset your password</h1>
+
+    {{ form_start(resetForm) }}
+        {{ form_row(resetForm.plainPassword) }}
+        <button class="btn btn-primary">Reset password</button>
+    {{ form_end(resetForm) }}
+{% endblock %}

templates/tech/security/login.html.twig

@@ -0,0 +1,45 @@
+{% extends 'base.html.twig' %}
+
+{% block title %}Log in!{% endblock %}
+
+{% block body %}
+<form method="post">
+    {% if error %}
+        <div class="alert alert-danger">{{ error.messageKey|trans(error.messageData, 'security') }}</div>
+    {% endif %}
+
+    {% if app.user %}
+        <div class="mb-3">
+            You are logged in as {{ app.user.userIdentifier }}, <a href="{{ path('app_logout') }}">Logout</a>
+        </div>
+    {% endif %}
+
+    <h1 class="h3 mb-3 font-weight-normal">Please sign in</h1>
+    <label for="inputUsername">Username</label>
+    <input type="text" value="{{ last_username }}" name="username" id="inputUsername" class="form-control" autocomplete="username" required autofocus>
+    <label for="inputPassword">Password</label>
+    <input type="password" name="password" id="inputPassword" class="form-control" autocomplete="current-password" required>
+
+    <input type="hidden" name="_csrf_token"
+           value="{{ csrf_token('authenticate') }}"
+    >
+
+    {#
+        Uncomment this section and add a remember_me option below your firewall to activate remember me functionality.
+        See https://symfony.com/doc/current/security/remember_me.html
+
+        <div class="checkbox mb-3">
+            <label>
+                <input type="checkbox" name="_remember_me"> Remember me
+            </label>
+        </div>
+    #}
+
+    <button class="btn btn-lg btn-primary" type="submit">
+        Sign in
+    </button>
+    <div class="mt-3">
+        <a href="{{ path('app_forgot_password_request') }}">Forgot your password?</a>
+    </div>
+</form>
+{% endblock %}

templates/website/home/index.html.twig

@@ -5,5 +5,5 @@
 {% block body %}
 <h1>{{ 'home.h1'|trans({'%site%': ('site.name'|trans)}) }}</h1>
 <p>{{ 'home.description'|trans }}</p>
-<p><a href="{{ path('game_hub') }}">{{ 'link.enter_game'|trans }}</a></p>
+<p><a href="{{ path('game') }}">{{ 'link.enter_game'|trans }}</a></p>
 {% endblock %}