Remove |raw from login error message rendering

Not exploitable today - the only custom auth message data is a
hardcoded resend link - but |raw on a translated exception message is
a latent XSS pattern if a future change ever threads user input
through the auth exception's message data. Twig's default
autoescaping is sufficient here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

assets/admin-session-tabs.js

@@ -0,0 +1,27 @@
+document.addEventListener('DOMContentLoaded', () => {
+    const buttons = document.querySelectorAll('[data-tab-target]');
+    if (!buttons.length) {
+        return;
+    }
+
+    const activate = (id) => {
+        document.querySelectorAll('.admin-tab-panel').forEach(el => el.style.display = 'none');
+        const target = document.getElementById(id);
+        if (target) {
+            target.style.display = 'block';
+        }
+
+        buttons.forEach(btn => {
+            const active = btn.dataset.tabTarget === id;
+            btn.style.background = active ? '#fff' : '#f8fafc';
+            btn.style.color = active ? '#1e40af' : '#64748b';
+            btn.style.fontWeight = active ? '600' : '400';
+            btn.style.borderColor = active ? '#3b82f6' : '#e2e8f0';
+            btn.style.borderBottom = active ? '1px solid #fff' : '1px solid #e2e8f0';
+        });
+    };
+
+    buttons.forEach(btn => {
+        btn.addEventListener('click', () => activate(btn.dataset.tabTarget));
+    });
+});

assets/app.js

@@ -5,3 +5,6 @@ import './styles/app.scss';
 import 'bootstrap/js/dist/collapse';
 import 'bootstrap/js/dist/alert';
 import 'bootstrap/js/dist/dropdown';
+import './game-waiting';
+import './game-lobby';
+import './admin-session-tabs';

assets/game-lobby.js

@@ -0,0 +1,62 @@
+document.addEventListener('DOMContentLoaded', () => {
+    const config = document.getElementById('game-lobby-config');
+    if (!config) {
+        return;
+    }
+
+    const publicUrl = config.dataset.mercurePublicUrl;
+    const topic = config.dataset.topic;
+    const chatLog = document.getElementById('lobby-chat-log');
+
+    function appendLobbyMessage(username, content, createdAt) {
+        if (!chatLog) {
+            return;
+        }
+        const emptyNotice = document.getElementById('lobby-chat-empty');
+        if (emptyNotice) {
+            emptyNotice.remove();
+        }
+
+        const time = createdAt
+            ? new Date(createdAt).toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' })
+            : '';
+
+        const wrapper = document.createElement('div');
+        wrapper.className = 'lobby-message';
+
+        const author = document.createElement('strong');
+        author.textContent = username;
+
+        const timestamp = document.createElement('span');
+        timestamp.className = 'text-muted small';
+        timestamp.textContent = ' ' + time;
+
+        const body = document.createElement('div');
+        body.textContent = content;
+
+        wrapper.appendChild(author);
+        wrapper.appendChild(timestamp);
+        wrapper.appendChild(body);
+        chatLog.appendChild(wrapper);
+        chatLog.scrollTop = chatLog.scrollHeight;
+    }
+
+    if (publicUrl && topic) {
+        const url = new URL(publicUrl);
+        url.searchParams.append('topic', topic);
+
+        const eventSource = new EventSource(url);
+        eventSource.onmessage = event => {
+            const data = JSON.parse(event.data);
+            if (data.type === 'lobby_message') {
+                appendLobbyMessage(data.username, data.content, data.createdAt);
+            } else if (data.type === 'player_joined' || data.type === 'session_started') {
+                window.location.reload();
+            }
+        };
+    }
+
+    if (chatLog) {
+        chatLog.scrollTop = chatLog.scrollHeight;
+    }
+});

assets/game-waiting.js

@@ -0,0 +1,68 @@
+document.addEventListener('DOMContentLoaded', () => {
+    const config = document.getElementById('game-waiting-config');
+    if (!config) {
+        return;
+    }
+
+    const publicUrl = config.dataset.mercurePublicUrl;
+    const topic = config.dataset.topic;
+    const readyAt = config.dataset.readyAt;
+
+    let reloading = false;
+    const reloadOnce = (eventSource) => {
+        if (reloading) {
+            return;
+        }
+        reloading = true;
+        if (eventSource) {
+            eventSource.close();
+        }
+        window.location.reload();
+    };
+
+    if (publicUrl && topic) {
+        const url = new URL(publicUrl);
+        url.searchParams.append('topic', topic);
+
+        const eventSource = new EventSource(url);
+        eventSource.onmessage = event => {
+            const data = JSON.parse(event.data);
+            if (data.type === 'all_ready' || data.type === 'player_ready') {
+                reloadOnce(eventSource);
+            }
+        };
+    }
+
+    // Our own ready status expires 60s after we set it - proactively tell the
+    // server as close to that deadline as possible, so the other players find
+    // out live instead of only whenever someone else's request happens to
+    // trigger the lazy check.
+    if (readyAt) {
+        const timeoutMs = 61000; // slightly more than the server-side 60s
+        const readyAtMs = readyAt * 1000;
+        const countdownEl = document.getElementById('ready-countdown');
+        const expireForm = document.getElementById('expire-ready-form');
+
+        const updateCountdown = () => {
+            const remaining = Math.max(0, Math.ceil((readyAtMs + timeoutMs - Date.now()) / 1000));
+            if (countdownEl) {
+                const m = Math.floor(remaining / 60);
+                const s = remaining % 60;
+                countdownEl.textContent = m + ':' + s.toString().padStart(2, '0');
+            }
+            return remaining;
+        };
+
+        const remaining = updateCountdown();
+        if (remaining <= 0) {
+            expireForm?.submit();
+        } else {
+            const countdownInterval = setInterval(() => {
+                if (updateCountdown() <= 0) {
+                    clearInterval(countdownInterval);
+                    expireForm?.submit();
+                }
+            }, 1000);
+        }
+    }
+});

composer.json

@@ -34,6 +34,7 @@
         "symfony/process": "7.4.*",
         "symfony/property-access": "7.4.*",
         "symfony/property-info": "7.4.*",
+        "symfony/rate-limiter": "7.4.*",
         "symfony/runtime": "7.4.*",
         "symfony/security-bundle": "7.4.*",
         "symfony/serializer": "7.4.*",

config/packages/framework.yaml

@@ -15,6 +15,12 @@ framework:
         storage_factory_id: session.storage.factory.native
         save_path: '%kernel.project_dir%/var/sessions/%kernel.environment%'
 
+    rate_limiter:
+        invite_code_join:
+            policy: 'sliding_window'
+            limit: 10
+            interval: '1 minute'
+
 when@prod:
     framework:
         session:

config/packages/notifier.yaml

@@ -2,7 +2,6 @@ framework:
     notifier:
         chatter_transports:
         texter_transports:␍
-            sendgrid: '%env(MAILER_DSN)%'
         channel_policy:
             # use chat/slack, chat/telegram, sms/twilio or sms/nexmo
             urgent: ['email']

config/packages/security.yaml

@@ -22,6 +22,9 @@ security:
                 enable_csrf: true
                 username_parameter: username
                 password_parameter: password
+            login_throttling:
+                max_attempts: 5
+                interval: '15 minutes'
             logout:
                 path: app_logout
                 # where to redirect after logout

migrations/Version20260810120000.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260810120000 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add lobby_message table for pre-game lobby chat';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('CREATE TABLE lobby_message (id INT AUTO_INCREMENT NOT NULL, session_id INT NOT NULL, player_id INT NOT NULL, content VARCHAR(500) NOT NULL, created_at DATETIME NOT NULL, INDEX IDX_LOBBY_MESSAGE_SESSION (session_id), INDEX IDX_LOBBY_MESSAGE_PLAYER (player_id), PRIMARY KEY(id)) DEFAULT CHARACTER SET utf8mb4 COLLATE `utf8mb4_unicode_ci` ENGINE = InnoDB');
+        $this->addSql('ALTER TABLE lobby_message ADD CONSTRAINT FK_LOBBY_MESSAGE_SESSION FOREIGN KEY (session_id) REFERENCES session (id)');
+        $this->addSql('ALTER TABLE lobby_message ADD CONSTRAINT FK_LOBBY_MESSAGE_PLAYER FOREIGN KEY (player_id) REFERENCES player (id)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE lobby_message DROP FOREIGN KEY FK_LOBBY_MESSAGE_SESSION');
+        $this->addSql('ALTER TABLE lobby_message DROP FOREIGN KEY FK_LOBBY_MESSAGE_PLAYER');
+        $this->addSql('DROP TABLE lobby_message');
+    }
+}

migrations/Version20260810130000.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260810130000 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add finished_at column to session table';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE session ADD finished_at DATETIME DEFAULT NULL');
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE session DROP finished_at');
+    }
+}

src/Game/Controller/GameAdminController.php

@@ -7,6 +7,7 @@ namespace App\Game\Controller;
 use App\Game\Entity\Session;
 use App\Game\Enum\SessionStatus;
 use App\Game\Repository\GameRepository;
+use App\Game\Repository\LobbyMessageRepository;
 use App\Game\Repository\SessionRepository;
 use App\Tech\Repository\UserRepository;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
@@ -49,15 +50,14 @@ final class GameAdminController extends AbstractController
     }
 
     #[Route('/session/{session}', name: 'game_admin_view_session', methods: ['GET'])]
-    public function viewSession(Session $session): Response
+    public function viewSession(Session $session, LobbyMessageRepository $lobbyMessageRepository): Response
     {
         $playersLogs = [];
         foreach ($session->getPlayers() as $player) {
-            $username = $player->getUser()->getUsername();
-            $logFile = $this->projectDir . '/var/log/sessions/' . $session->getId() . '/' . $username . '.txt';
+            $logFile = $this->projectDir . '/var/log/sessions/' . $session->getId() . '/' . $player->getLogFileBasename() . '.txt';
 
             $playersLogs[] = [
-                'username' => $username,
+                'username' => $player->getUser()->getUsername(),
                 'logs' => file_exists($logFile) ? file_get_contents($logFile) : '',
             ];
         }
@@ -65,6 +65,7 @@ final class GameAdminController extends AbstractController
         return $this->render('game/admin/sessions/view.html.twig', [
             'session' => $session,
             'playersLogs' => $playersLogs,
+            'lobbyMessages' => $lobbyMessageRepository->findForSession($session),
         ]);
     }
 }

src/Game/Controller/GameAdminSessionController.php

@@ -35,6 +35,7 @@ final class GameAdminSessionController extends AbstractController
         }
 
         $session->setStatus(SessionStatus::LOST);
+        $session->setFinishedAt(new \DateTime());
         $em->flush();
 
         $this->addFlash('success', sprintf('Session #%d closed.', $session->getId()));

src/Game/Controller/GameApiController.php

@@ -43,6 +43,7 @@ final class GameApiController extends AbstractController
         if ($session->getStatus() === SessionStatus::PLAYING) {
             if ($session->getTimer() !== null && $now >= $session->getTimer()) {
                 $session->setStatus(SessionStatus::LOST);
+                $session->setFinishedAt(new \DateTime());
                 $this->entityManager->persist($session);
                 $this->entityManager->flush();
                 $isFinished = true;

src/Game/Controller/GameController.php

@@ -22,6 +22,8 @@ use Symfony\Component\Routing\Annotation\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Component\ExpressionLanguage\Expression;
 use Symfony\Component\DependencyInjection\Attribute\Autowire;
+use Symfony\Component\DependencyInjection\Attribute\Target;
+use Symfony\Component\RateLimiter\RateLimiterFactoryInterface;
 
 final class GameController extends AbstractController
 {
@@ -39,13 +41,20 @@ final class GameController extends AbstractController
         GameRepository $gameRepository,
         SessionRepository $sessionRepository,
         GameDashboardService $dashboardService,
-        Security $security
+        Security $security,
+        #[Target('invite_code_join')]
+        RateLimiterFactoryInterface $inviteCodeJoinLimiter
     ): Response {
         $user = $security->getUser();
         $isAdmin = $this->isGranted('ROLE_ADMIN');
 
         if ($request->isMethod('POST')) {
             if ($request->request->has('create_session')) {
+                if (!$this->isCsrfTokenValid('create_session', $request->request->get('_token'))) {
+                    $this->addFlash('error', 'Invalid CSRF token.');
+                    return $this->redirectToRoute('game_dashboard');
+                }
+
                 $gameId = $request->request->get('game_id');
                 $game = $gameRepository->find($gameId);
 
@@ -55,6 +64,17 @@ final class GameController extends AbstractController
                     }
                 }
             } elseif ($request->request->has('join_session')) {
+                if (!$this->isCsrfTokenValid('join_session', $request->request->get('_token'))) {
+                    $this->addFlash('error', 'Invalid CSRF token.');
+                    return $this->redirectToRoute('game_dashboard');
+                }
+
+                $limiter = $inviteCodeJoinLimiter->create($user->getUserIdentifier());
+                if (!$limiter->consume(1)->isAccepted()) {
+                    $this->addFlash('error', 'Too many attempts. Please wait a moment and try again.');
+                    return $this->redirectToRoute('game_dashboard');
+                }
+
                 $inviteCode = $request->request->get('invite_code');
                 if ($dashboardService->joinSession($inviteCode, $user)) {
                     $this->addFlash('success', 'Joined session successfully!');
@@ -70,6 +90,11 @@ final class GameController extends AbstractController
                     return $this->redirectToRoute('game_dashboard');
                 }
 
+                if (!$this->isCsrfTokenValid('create_invite_' . $session->getId(), $request->request->get('_token'))) {
+                    $this->addFlash('error', 'Invalid CSRF token.');
+                    return $this->redirectToRoute('game_dashboard');
+                }
+
                 $inviteCode = $dashboardService->generateInviteCode($session, $user, $isAdmin);
                 if ($inviteCode) {
                     $this->addFlash('success', 'Invite link created: ' . $inviteCode);
@@ -79,6 +104,11 @@ final class GameController extends AbstractController
                 $session = $sessionRepository->find($sessionId);
 
                 if ($session) {
+                    if (!$this->isCsrfTokenValid('leave_session_' . $session->getId(), $request->request->get('_token'))) {
+                        $this->addFlash('error', 'Invalid CSRF token.');
+                        return $this->redirectToRoute('game_dashboard');
+                    }
+
                     if ($dashboardService->leaveSession($session, $user)) {
                         $this->addFlash('success', 'Left session successfully.');
                     } else {
@@ -90,6 +120,11 @@ final class GameController extends AbstractController
                 $session = $sessionRepository->find($sessionId);
 
                 if ($session) {
+                    if (!$this->isCsrfTokenValid('start_session_' . $session->getId(), $request->request->get('_token'))) {
+                        $this->addFlash('error', 'Invalid CSRF token.');
+                        return $this->redirectToRoute('game_dashboard');
+                    }
+
                     if ($dashboardService->startSession($session)) {
                         $this->addFlash('success', 'Session started! Screens have been assigned.');
                     } else {
@@ -127,7 +162,9 @@ final class GameController extends AbstractController
         $player = $playerRepository->findOneBy(['session' => $session, 'user' => $user]);
 
         if ($request->isMethod('POST') && $request->request->has('toggle_ready')) {
-            if (!$user->isVerified()) {
+            if (!$this->isCsrfTokenValid('toggle_ready_' . $session->getId(), $request->request->get('_token'))) {
+                $this->addFlash('error', 'Invalid CSRF token.');
+            } elseif (!$user->isVerified()) {
                 $this->addFlash('error', 'You must verify your email address before you can mark yourself as ready.');
             } else {
                 $dashboardService->toggleReady($session, $user);
@@ -137,16 +174,29 @@ final class GameController extends AbstractController
         }
 
         if ($request->isMethod('POST') && $request->request->has('expire_ready')) {
+            if ($this->isCsrfTokenValid('expire_ready_' . $session->getId(), $request->request->get('_token'))) {
                 $dashboardService->expireOwnReadyIfDue($session, $user);
+            }
+            return $this->redirectToRoute('game', ['session' => $session->getId()]);
+        }
+
+        if ($request->isMethod('POST') && $request->request->has('send_message')) {
+            if ($this->isCsrfTokenValid('send_message_' . $session->getId(), $request->request->get('_token'))) {
+                $dashboardService->postLobbyMessage($session, $user, (string) $request->request->get('content', ''));
+            }
             return $this->redirectToRoute('game', ['session' => $session->getId()]);
         }
 
         // Lazily pick up readiness changes from other players since our last request
         $dashboardService->checkAllPlayersReady($session);
 
-        if ($session->getStatus() === SessionStatus::CREATED) {
-            $this->addFlash('info', 'This session is still waiting for more players to join.');
-            return $this->redirectToRoute('game_dashboard');
+        if ($dashboardService->isLobbyChatOpen($session)) {
+            return $this->render('game/lobby.html.twig', [
+                'session' => $session,
+                'messages' => $dashboardService->getLobbyMessages($session),
+                'player' => $player,
+                'mercure_public_url' => $this->mercurePublicUrl,
+            ]);
         }
 
         if ($session->getStatus() === SessionStatus::WON) {
@@ -206,7 +256,7 @@ final class GameController extends AbstractController
         $user = $security->getUser();
         $player = $playerRepository->findOneBy(['session' => $session, 'user' => $user]);
 
-        if ($request->isMethod('POST')) {
+        if ($request->isMethod('POST') && $this->isCsrfTokenValid('game_feedback_' . $session->getId(), $request->request->get('_token'))) {
             $difficulty = $request->request->get('difficulty');
             $entertaining = $request->request->get('entertaining');
             $theme = $request->request->get('theme');
@@ -238,7 +288,7 @@ final class GameController extends AbstractController
         $user = $security->getUser();
         $player = $playerRepository->findOneBy(['session' => $session, 'user' => $user]);
 
-        if ($request->isMethod('POST')) {
+        if ($request->isMethod('POST') && $this->isCsrfTokenValid('game_feedback_' . $session->getId(), $request->request->get('_token'))) {
             $difficulty = $request->request->get('difficulty');
             $entertaining = $request->request->get('entertaining');
             $theme = $request->request->get('theme');

src/Game/Entity/LobbyMessage.php

@@ -0,0 +1,88 @@
+<?php
+
+namespace App\Game\Entity;
+
+use App\Game\Repository\LobbyMessageRepository;
+use Doctrine\ORM\Mapping as ORM;
+
+#[ORM\Entity(repositoryClass: LobbyMessageRepository::class)]
+#[ORM\Table(name: 'lobby_message')]
+class LobbyMessage
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    private ?int $id = null;
+
+    #[ORM\ManyToOne(targetEntity: Session::class)]
+    #[ORM\JoinColumn(nullable: false)]
+    private ?Session $session = null;
+
+    #[ORM\ManyToOne(targetEntity: Player::class)]
+    #[ORM\JoinColumn(nullable: false)]
+    private ?Player $player = null;
+
+    #[ORM\Column(length: 500)]
+    private ?string $content = null;
+
+    #[ORM\Column(type: 'datetime')]
+    private ?\DateTimeInterface $createdAt = null;
+
+    public function __construct()
+    {
+        $this->createdAt = new \DateTime();
+    }
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getSession(): ?Session
+    {
+        return $this->session;
+    }
+
+    public function setSession(?Session $session): static
+    {
+        $this->session = $session;
+
+        return $this;
+    }
+
+    public function getPlayer(): ?Player
+    {
+        return $this->player;
+    }
+
+    public function setPlayer(?Player $player): static
+    {
+        $this->player = $player;
+
+        return $this;
+    }
+
+    public function getContent(): ?string
+    {
+        return $this->content;
+    }
+
+    public function setContent(string $content): static
+    {
+        $this->content = $content;
+
+        return $this;
+    }
+
+    public function getCreatedAt(): ?\DateTimeInterface
+    {
+        return $this->createdAt;
+    }
+
+    public function setCreatedAt(\DateTimeInterface $createdAt): static
+    {
+        $this->createdAt = $createdAt;
+
+        return $this;
+    }
+}

src/Game/Entity/Player.php

@@ -66,4 +66,19 @@ class Player
 
         return $this;
     }
+
+    /**
+     * A filesystem-safe basename derived from the player's username, for use when
+     * building per-player log file paths. Usernames are validated to only contain
+     * safe characters at registration time, but this sanitizes defensively too, so
+     * a path segment can never traverse outside its intended directory regardless
+     * of what ends up stored on the user.
+     */
+    public function getLogFileBasename(): string
+    {
+        $username = $this->user?->getUsername() ?? '';
+        $safe = preg_replace('/[^A-Za-z0-9_-]/', '_', $username);
+
+        return $safe !== null && $safe !== '' ? $safe : ('player-' . $this->id);
+    }
 }

src/Game/Entity/Session.php

@@ -31,6 +31,9 @@ class Session
     #[ORM\Column(type: Types::DATETIME_MUTABLE)]
     private ?\DateTimeInterface $created = null;
 
+    #[ORM\Column(type: Types::DATETIME_MUTABLE, nullable: true)]
+    private ?\DateTimeInterface $finishedAt = null;
+
     #[ORM\OneToMany(mappedBy: 'session', targetEntity: Player::class)]
     private Collection $players;
 
@@ -97,6 +100,18 @@ class Session
         return $this;
     }
 
+    public function getFinishedAt(): ?\DateTimeInterface
+    {
+        return $this->finishedAt;
+    }
+
+    public function setFinishedAt(?\DateTimeInterface $finishedAt): static
+    {
+        $this->finishedAt = $finishedAt;
+
+        return $this;
+    }
+
     /**
      * @return Collection<int, Player>
      */

src/Game/Enum/SessionStatus.php

@@ -9,4 +9,15 @@ enum SessionStatus: string
     case PLAYING = 'playing';
     case WON = 'won';
     case LOST = 'lost';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::CREATED => 'Waiting for players',
+            self::READY => 'Waiting for players to be ready',
+            self::PLAYING => 'In progress',
+            self::WON => 'Completed - Won',
+            self::LOST => 'Completed - Lost',
+        };
+    }
 }

src/Game/Repository/LobbyMessageRepository.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Game\Repository;
+
+use App\Game\Entity\LobbyMessage;
+use App\Game\Entity\Session;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<LobbyMessage>
+ */
+class LobbyMessageRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, LobbyMessage::class);
+    }
+
+    /**
+     * @return LobbyMessage[]
+     */
+    public function findForSession(Session $session, int $limit = 100): array
+    {
+        return $this->createQueryBuilder('m')
+            ->andWhere('m.session = :session')
+            ->setParameter('session', $session)
+            ->orderBy('m.createdAt', 'ASC')
+            ->setMaxResults($limit)
+            ->getQuery()
+            ->getResult();
+    }
+}

src/Game/Service/GameDashboardService.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 namespace App\Game\Service;
 
 use App\Game\Entity\Game;
+use App\Game\Entity\LobbyMessage;
 use App\Game\Entity\Player;
 use App\Game\Entity\Session;
 use App\Game\Entity\SessionSetting;
@@ -11,6 +12,7 @@ use App\Game\Enum\GameStatus;
 use App\Game\Enum\SessionSettingType;
 use App\Game\Enum\SessionStatus;
 use App\Game\Repository\GameRepository;
+use App\Game\Repository\LobbyMessageRepository;
 use App\Game\Repository\SessionRepository;
 use App\Tech\Entity\User;
 use Doctrine\ORM\EntityManagerInterface;
@@ -21,10 +23,13 @@ use Symfony\Component\Mercure\Update;
 final class GameDashboardService
 {
     private const READY_TIMEOUT_SECONDS = 60;
+    private const LOBBY_MESSAGE_MAX_LENGTH = 500;
+    private const LOBBY_CHAT_GRACE_PERIOD_SECONDS = 3600;
 
     public function __construct(
         private readonly GameRepository $gameRepository,
         private readonly SessionRepository $sessionRepository,
+        private readonly LobbyMessageRepository $lobbyMessageRepository,
         private readonly EntityManagerInterface $entityManager,
         private readonly HubInterface $hub,
     ) {
@@ -122,6 +127,8 @@ final class GameDashboardService
 
         $this->entityManager->flush();
 
+        $this->publishLobbyEvent($session, 'player_joined');
+
         if (count($session->getPlayers()) === $session->getGame()->getNumberOfPlayers()) {
             $this->startSession($session);
         }
@@ -283,9 +290,83 @@ final class GameDashboardService
         $this->entityManager->persist($session);
         $this->entityManager->flush();
 
+        $this->publishLobbyEvent($session, 'session_started');
+
         return true;
     }
 
+    /**
+     * @return LobbyMessage[]
+     */
+    public function getLobbyMessages(Session $session): array
+    {
+        return $this->lobbyMessageRepository->findForSession($session);
+    }
+
+    /**
+     * The lobby chat is open while a session is still gathering players, and stays
+     * open for a grace period after the game ends so players can wrap up the
+     * conversation before it disappears.
+     */
+    public function isLobbyChatOpen(Session $session): bool
+    {
+        if ($session->getStatus() === SessionStatus::CREATED) {
+            return true;
+        }
+
+        if (!in_array($session->getStatus(), [SessionStatus::WON, SessionStatus::LOST], true)) {
+            return false;
+        }
+
+        $finishedAt = $session->getFinishedAt();
+        if ($finishedAt === null) {
+            return false;
+        }
+
+        return (new \DateTime())->getTimestamp() - $finishedAt->getTimestamp() < self::LOBBY_CHAT_GRACE_PERIOD_SECONDS;
+    }
+
+    public function postLobbyMessage(Session $session, User $user, string $content): ?LobbyMessage
+    {
+        if (!$this->isLobbyChatOpen($session)) {
+            return null;
+        }
+
+        $player = null;
+        foreach ($session->getPlayers() as $sessionPlayer) {
+            if ($sessionPlayer->getUser() === $user) {
+                $player = $sessionPlayer;
+                break;
+            }
+        }
+
+        if (!$player) {
+            return null;
+        }
+
+        $content = trim($content);
+        if ($content === '') {
+            return null;
+        }
+        $content = mb_substr($content, 0, self::LOBBY_MESSAGE_MAX_LENGTH);
+
+        $message = new LobbyMessage();
+        $message->setSession($session);
+        $message->setPlayer($player);
+        $message->setContent($content);
+
+        $this->entityManager->persist($message);
+        $this->entityManager->flush();
+
+        $this->publishLobbyEvent($session, 'lobby_message', [
+            'username' => $user->getUserIdentifier(),
+            'content' => $content,
+            'createdAt' => $message->getCreatedAt()->format(DATE_ATOM),
+        ]);
+
+        return $message;
+    }
+
     public function toggleReady(Session $session, User $user): bool
     {
         if ($session->getStatus() !== SessionStatus::READY) {
@@ -393,10 +474,15 @@ final class GameDashboardService
     }
 
     private function publishPlayerReady(Session $session, int $screen, bool $ready): void
+    {
+        $this->publishLobbyEvent($session, 'player_ready', ['player' => $screen, 'ready' => $ready]);
+    }
+
+    private function publishLobbyEvent(Session $session, string $type, array $extra = []): void
     {
         try {
             $topic = '/game/hub/' . $session->getId();
-            $this->hub->publish(new Update($topic, json_encode(['type' => 'player_ready', 'player' => $screen, 'ready' => $ready])));
+            $this->hub->publish(new Update($topic, json_encode(array_merge(['type' => $type], $extra))));
         } catch (\Exception $e) {
             // Mercure might be down, but we don't want to crash the game
         }

src/Game/Service/GameResponseService.php

@@ -107,14 +107,13 @@ class GameResponseService
     private function logSessionActivity(Player $player, string $content): void
     {
         $sessionId = $player->getSession()->getId();
-        $username = $player->getUser()->getUsername();
         $logDir = $this->projectDir . '/var/log/sessions/' . $sessionId;
 
         if (!is_dir($logDir)) {
             mkdir($logDir, 0777, true);
         }
 
-        $logFile = $logDir . '/' . $username . '.txt';
+        $logFile = $logDir . '/' . $player->getLogFileBasename() . '.txt';
         $timestamp = date('Y-m-d H:i:s');
         $logMessage = sprintf("[%s] %s\n", $timestamp, $content);
 
@@ -1118,6 +1117,7 @@ class GameResponseService
         }
 
         $session->setStatus(SessionStatus::WON);
+        $session->setFinishedAt(new \DateTime());
         $this->entityManager->persist($session);
         $this->entityManager->flush();
 

src/Tech/Form/AdminUserType.php

@@ -16,6 +16,7 @@ use Symfony\Component\OptionsResolver\OptionsResolver;
 use Symfony\Component\Validator\Constraints\Email;
 use Symfony\Component\Validator\Constraints\Length;
 use Symfony\Component\Validator\Constraints\NotBlank;
+use Symfony\Component\Validator\Constraints\Regex;
 
 class AdminUserType extends AbstractType
 {
@@ -26,7 +27,14 @@ class AdminUserType extends AbstractType
                 'constraints' => [new NotBlank(), new Email()],
             ])
             ->add('username', TextType::class, [
-                'constraints' => [new NotBlank(), new Length(min: 2, max: 180)],
+                'constraints' => [
+                    new NotBlank(),
+                    new Length(min: 2, max: 32),
+                    new Regex(
+                        pattern: '/^[A-Za-z0-9_-]+$/',
+                        message: 'Username may only contain letters, numbers, underscores, and hyphens.',
+                    ),
+                ],
             ])
             ->add('plainPassword', PasswordType::class, [
                 'mapped' => false,

src/Tech/Form/RegistrationFormType.php

@@ -16,6 +16,7 @@ use Symfony\Component\OptionsResolver\OptionsResolver;
 use Symfony\Component\Validator\Constraints\IsTrue;
 use Symfony\Component\Validator\Constraints\Length;
 use Symfony\Component\Validator\Constraints\NotBlank;
+use Symfony\Component\Validator\Constraints\Regex;
 
 class RegistrationFormType extends AbstractType
 {
@@ -26,6 +27,11 @@ class RegistrationFormType extends AbstractType
             ->add('username', TextType::class, [
                 'constraints' => [
                     new NotBlank(message: 'Please enter a username'),
+                    new Length(min: 3, max: 32, minMessage: 'Your username should be at least {{ limit }} characters', maxMessage: 'Your username cannot be longer than {{ limit }} characters'),
+                    new Regex(
+                        pattern: '/^[A-Za-z0-9_-]+$/',
+                        message: 'Your username may only contain letters, numbers, underscores, and hyphens.',
+                    ),
                 ],
             ])
             ->add('plainPassword', RepeatedType::class, [

symfony.lock

@@ -262,15 +262,6 @@
             "config/routes/security.yaml"
         ]
     },
-    "symfony/sendgrid-mailer": {
-        "version": "7.3",
-        "recipe": {
-            "repo": "github.com/symfony/recipes",
-            "branch": "main",
-            "version": "4.4",
-            "ref": "224aedffb66812dc2b0965dabc14d5f800941da6"
-        }
-    },
     "symfony/stimulus-bundle": {
         "version": "2.30",
         "recipe": {

templates/game/admin/base.html.twig

@@ -1,23 +1,99 @@
 {% extends 'layout/site.html.twig' %}
 
-{% block main %}
-<div style="display: flex; min-height: calc(100vh - 60px);">
-
-    {# ── Sidebar ──────────────────────────────────────────────────────── #}
-    <nav style="
+{% block stylesheets %}
+    {{ parent() }}
+    <style>
+        .admin-shell {
+            display: flex;
+            min-height: calc(100vh - 60px);
+        }
+        .admin-sidebar {
             width: 220px;
             flex-shrink: 0;
             background: #1e293b;
             color: #cbd5e1;
             display: flex;
             flex-direction: column;
-        padding: 0;
-    ">
-        <div style="padding: 1.25rem 1.5rem; border-bottom: 1px solid #334155;">
-            <span style="font-weight: 700; font-size: 1rem; color: #f1f5f9;">Game Admin</span>
-        </div>
+        }
+        .admin-sidebar-title {
+            padding: 1.25rem 1.5rem;
+            border-bottom: 1px solid #334155;
+            font-weight: 700;
+            font-size: 1rem;
+            color: #f1f5f9;
+        }
+        .admin-nav-list {
+            list-style: none;
+            margin: 0;
+            padding: 0.5rem 0;
+            flex: 1;
+        }
+        .admin-nav-link {
+            display: flex;
+            align-items: center;
+            gap: 0.6rem;
+            padding: 0.6rem 1.5rem;
+            text-decoration: none;
+            font-size: 0.9rem;
+        }
+        .admin-sidebar-footer {
+            padding: 1rem 1.5rem;
+            border-top: 1px solid #334155;
+        }
+        .admin-main {
+            flex: 1;
+            min-width: 0;
+            background: #f8fafc;
+            padding: 2rem;
+            overflow-x: auto;
+        }
 
-        <ul style="list-style: none; margin: 0; padding: 0.5rem 0; flex: 1;">
+        @media (max-width: 767.98px) {
+            .admin-shell {
+                flex-direction: column;
+                min-height: auto;
+            }
+            .admin-sidebar {
+                width: 100%;
+                flex-direction: row;
+                flex-wrap: wrap;
+            }
+            .admin-sidebar-title {
+                border-bottom: none;
+                padding: 0.75rem 1rem 0.25rem;
+            }
+            .admin-nav-list {
+                display: flex;
+                flex: 0 0 100%;
+                overflow-x: auto;
+                -webkit-overflow-scrolling: touch;
+                padding: 0.25rem 0.5rem 0.75rem;
+                gap: 0.25rem;
+            }
+            .admin-nav-link {
+                flex-shrink: 0;
+                white-space: nowrap;
+                padding: 0.5rem 0.9rem;
+                border-radius: 6px;
+            }
+            .admin-sidebar-footer {
+                display: none;
+            }
+            .admin-main {
+                padding: 1rem;
+            }
+        }
+    </style>
+{% endblock %}
+
+{% block main %}
+<div class="admin-shell">
+
+    {# ── Sidebar ──────────────────────────────────────────────────────── #}
+    <nav class="admin-sidebar">
+        <div class="admin-sidebar-title">Game Admin</div>
+
+        <ul class="admin-nav-list">
             {% set current = app.request.attributes.get('_route') %}
 
             {% set navItems = [
@@ -31,15 +107,9 @@
             {% for item in navItems %}
                 {% set isActive = current starts with item.route %}
                 <li>
-                    <a href="{{ path(item.route) }}" style="
-                        display: flex;
-                        align-items: center;
-                        gap: 0.6rem;
-                        padding: 0.6rem 1.5rem;
+                    <a href="{{ path(item.route) }}" class="admin-nav-link" style="
                         color: {{ isActive ? '#f1f5f9' : '#94a3b8' }};
                         background: {{ isActive ? '#334155' : 'transparent' }};
-                        text-decoration: none;
-                        font-size: 0.9rem;
                         border-left: 3px solid {{ isActive ? '#3b82f6' : 'transparent' }};
                     ">
                         <span>{{ item.icon }}</span>
@@ -49,7 +119,7 @@
             {% endfor %}
         </ul>
 
-        <div style="padding: 1rem 1.5rem; border-top: 1px solid #334155;">
+        <div class="admin-sidebar-footer">
             <a href="{{ path('game_dashboard') }}" style="color: #64748b; font-size: 0.8rem; text-decoration: none;">
                 ← Back to game
             </a>
@@ -57,7 +127,7 @@
     </nav>
 
     {# ── Content ──────────────────────────────────────────────────────── #}
-    <main style="flex: 1; background: #f8fafc; padding: 2rem; overflow-x: auto;">
+    <main class="admin-main">
         {% for label, messages in app.flashes %}
             {% for message in messages %}
                 <div style="

templates/game/admin/email_log/index.html.twig

@@ -9,7 +9,7 @@
     </div>
 
     <div style="background: #fff; border-radius: 8px; box-shadow: 0 1px 3px rgba(0,0,0,.07); overflow: hidden;">
-        <table style="width: 100%; border-collapse: collapse; font-size: 0.9rem;">
+        <table style="width: 100%; min-width: 620px; border-collapse: collapse; font-size: 0.9rem;">
             <thead>
                 <tr style="background: #f1f5f9; border-bottom: 1px solid #e2e8f0;">
                     <th style="padding: 0.75rem 1rem; text-align: left; color: #475569; font-weight: 600;">ID</th>

templates/game/admin/games/index.html.twig

@@ -9,7 +9,7 @@
     </div>
 
     <div style="background: #fff; border-radius: 8px; box-shadow: 0 1px 3px rgba(0,0,0,.07); overflow: hidden;">
-        <table style="width: 100%; border-collapse: collapse; font-size: 0.9rem;">
+        <table style="width: 100%; min-width: 620px; border-collapse: collapse; font-size: 0.9rem;">
             <thead>
                 <tr style="background: #f1f5f9; border-bottom: 1px solid #e2e8f0;">
                     <th style="padding: 0.75rem 1rem; text-align: left; color: #475569; font-weight: 600;">ID</th>

templates/game/admin/session.html.twig

@@ -1,49 +0,0 @@
-{% extends 'base.html.twig' %}
-
-{% block title %}View Session Logs - {{ session.id }}{% endblock %}
-
-{% block body %}
-    <h1>Session: {{ session.game.name }} (#{{ session.id }})</h1>
-    <p><a href="{{ path('game_admin_dashboard') }}">Back to Dashboard</a></p>
-
-    <div class="tabs">
-        <ul style="display: flex; list-style: none; padding: 0; border-bottom: 1px solid #ccc;">
-            {% for playerLog in playersLogs %}
-                <li style="margin-right: 10px;">
-                    <button
-                        onclick="openTab(event, 'player-{{ loop.index }}')"
-                        class="tablinks {{ loop.first ? 'active' : '' }}"
-                        style="padding: 10px; cursor: pointer; border: 1px solid #ccc; border-bottom: none; background: {{ loop.first ? '#eee' : '#fff' }};"
-                    >
-                        {{ playerLog.username }}
-                    </button>
-                </li>
-            {% endfor %}
-        </ul>
-    </div>
-
-    {% for playerLog in playersLogs %}
-        <div id="player-{{ loop.index }}" class="tabcontent" style="display: {{ loop.first ? 'block' : 'none' }}; border: 1px solid #ccc; border-top: none; padding: 20px;">
-            <h3>Logs for {{ playerLog.username }}</h3>
-            <pre style="background: #f4f4f4; padding: 15px; overflow-x: auto; white-space: pre-wrap; word-wrap: break-word;">{{ playerLog.logs ?: 'No logs found for this player.' }}</pre>
-        </div>
-    {% endfor %}
-
-    <script>
-        function openTab(evt, playerName) {
-            var i, tabcontent, tablinks;
-            tabcontent = document.getElementsByClassName("tabcontent");
-            for (i = 0; i < tabcontent.length; i++) {
-                tabcontent[i].style.display = "none";
-            }
-            tablinks = document.getElementsByClassName("tablinks");
-            for (i = 0; i < tablinks.length; i++) {
-                tablinks[i].className = tablinks[i].className.replace(" active", "");
-                tablinks[i].style.background = "#fff";
-            }
-            document.getElementById(playerName).style.display = "block";
-            evt.currentTarget.className += " active";
-            evt.currentTarget.style.background = "#eee";
-        }
-    </script>
-{% endblock %}

templates/game/admin/sessions/index.html.twig

@@ -9,7 +9,7 @@
     </div>
 
     <div style="background: #fff; border-radius: 8px; box-shadow: 0 1px 3px rgba(0,0,0,.07); overflow: hidden;">
-        <table style="width: 100%; border-collapse: collapse; font-size: 0.9rem;">
+        <table style="width: 100%; min-width: 700px; border-collapse: collapse; font-size: 0.9rem;">
             <thead>
                 <tr style="background: #f1f5f9; border-bottom: 1px solid #e2e8f0;">
                     <th style="padding: 0.75rem 1rem; text-align: left; color: #475569; font-weight: 600;">ID</th>

templates/game/admin/sessions/view.html.twig

@@ -10,25 +10,40 @@
     <h1 style="margin: 0 0 0.25rem; font-size: 1.5rem; color: #0f172a;">{{ session.game.name }} — Session #{{ session.id }}</h1>
     <p style="margin: 0 0 1.5rem; color: #64748b; font-size: 0.9rem;">{{ session.status.value }} · {{ session.players|length }} player(s) · Created {{ session.created|date('Y-m-d H:i') }}</p>
 
-    {% if playersLogs is empty %}
-        <div style="background: #fff; border-radius: 8px; padding: 2rem; text-align: center; color: #94a3b8; box-shadow: 0 1px 3px rgba(0,0,0,.07);">
-            No players in this session.
-        </div>
-    {% else %}
     {# Tab buttons #}
-        <div style="display: flex; gap: 0; margin-bottom: 0; border-bottom: 1px solid #e2e8f0;">
+    <div style="display: flex; gap: 0; margin-bottom: 0; border-bottom: 1px solid #e2e8f0; overflow-x: auto; -webkit-overflow-scrolling: touch;">
+        <button
+            data-tab-target="lobby-chat-tab"
+            id="tab-lobby-chat"
+            style="
+                flex-shrink: 0;
+                white-space: nowrap;
+                padding: 0.6rem 1.25rem;
+                border: 1px solid #3b82f6;
+                border-bottom: 1px solid #fff;
+                background: #fff;
+                color: #1e40af;
+                font-size: 0.9rem;
+                font-weight: 600;
+                cursor: pointer;
+                border-radius: 6px 6px 0 0;
+                margin-bottom: -1px;
+            "
+        >Lobby Chat</button>
         {% for playerLog in playersLogs %}
             <button
-                    onclick="openTab('player-{{ loop.index }}')"
+                data-tab-target="player-{{ loop.index }}"
                 id="tab-{{ loop.index }}"
                 style="
+                    flex-shrink: 0;
+                    white-space: nowrap;
                     padding: 0.6rem 1.25rem;
-                        border: 1px solid {{ loop.first ? '#3b82f6' : '#e2e8f0' }};
-                        border-bottom: {{ loop.first ? '1px solid #fff' : '1px solid #e2e8f0' }};
-                        background: {{ loop.first ? '#fff' : '#f8fafc' }};
-                        color: {{ loop.first ? '#1e40af' : '#64748b' }};
+                    border: 1px solid #e2e8f0;
+                    border-bottom: 1px solid #e2e8f0;
+                    background: #f8fafc;
+                    color: #64748b;
                     font-size: 0.9rem;
-                        font-weight: {{ loop.first ? '600' : '400' }};
+                    font-weight: 400;
                     cursor: pointer;
                     border-radius: 6px 6px 0 0;
                     margin-bottom: -1px;
@@ -38,9 +53,33 @@
     </div>
 
     {# Tab content #}
+    <div id="lobby-chat-tab" class="admin-tab-panel" style="
+        display: block;
+        background: #fff;
+        border: 1px solid #e2e8f0;
+        border-top: none;
+        border-radius: 0 0 8px 8px;
+        padding: 1.25rem;
+        box-shadow: 0 1px 3px rgba(0,0,0,.07);
+    ">
+        {% if lobbyMessages is empty %}
+            <p style="margin: 0; color: #94a3b8;">No lobby chat messages for this session.</p>
+        {% else %}
+            <div style="max-height: 320px; overflow-y: auto; display: flex; flex-direction: column; gap: 0.6rem;">
+                {% for message in lobbyMessages %}
+                    <div style="font-size: 0.9rem;">
+                        <strong style="color: #0f172a;">{{ message.player.user.username }}</strong>
+                        <span style="color: #94a3b8; font-size: 0.8rem;">{{ message.createdAt|date('Y-m-d H:i') }}</span>
+                        <div style="color: #334155;">{{ message.content }}</div>
+                    </div>
+                {% endfor %}
+            </div>
+        {% endif %}
+    </div>
+
     {% for playerLog in playersLogs %}
-            <div id="player-{{ loop.index }}" style="
-                display: {{ loop.first ? 'block' : 'none' }};
+        <div id="player-{{ loop.index }}" class="admin-tab-panel" style="
+            display: none;
             background: #fff;
             border: 1px solid #e2e8f0;
             border-top: none;
@@ -62,22 +101,4 @@
             ">{{ playerLog.logs ?: 'No logs found for this player.' }}</pre>
         </div>
     {% endfor %}
-    {% endif %}
-
-    <script>
-        function openTab(id) {
-            document.querySelectorAll('[id^="player-"]').forEach(el => el.style.display = 'none');
-            document.getElementById(id).style.display = 'block';
-
-            const idx = id.split('-')[1];
-            document.querySelectorAll('[id^="tab-"]').forEach((btn, i) => {
-                const active = String(i + 1) === idx;
-                btn.style.background = active ? '#fff' : '#f8fafc';
-                btn.style.color = active ? '#1e40af' : '#64748b';
-                btn.style.fontWeight = active ? '600' : '400';
-                btn.style.borderColor = active ? '#3b82f6' : '#e2e8f0';
-                btn.style.borderBottom = active ? '1px solid #fff' : '1px solid #e2e8f0';
-            });
-        }
-    </script>
 {% endblock %}

templates/game/admin/users/index.html.twig

@@ -9,7 +9,7 @@
     </div>
 
     <div style="background: #fff; border-radius: 8px; box-shadow: 0 1px 3px rgba(0,0,0,.07); overflow: hidden;">
-        <table style="width: 100%; border-collapse: collapse; font-size: 0.9rem;">
+        <table style="width: 100%; min-width: 760px; border-collapse: collapse; font-size: 0.9rem;">
             <thead>
                 <tr style="background: #f1f5f9; border-bottom: 1px solid #e2e8f0;">
                     <th style="padding: 0.75rem 1rem; text-align: left; color: #475569; font-weight: 600;">ID</th>

templates/game/dashboard.html.twig

@@ -17,6 +17,7 @@
                 <div class="card-body">
                     {% if availableGames is not empty %}
                         <form method="post">
+                            <input type="hidden" name="_token" value="{{ csrf_token('create_session') }}">
                             <select name="game_id" class="form-select mb-3">
                                 {% for game in availableGames %}
                                     <option value="{{ game.id }}">
@@ -40,6 +41,7 @@
                 <div class="card-header bg-secondary text-white">Join Session</div>
                 <div class="card-body">
                     <form method="post" class="d-flex gap-2">
+                        <input type="hidden" name="_token" value="{{ csrf_token('join_session') }}">
                         <input type="text" name="invite_code" class="form-control" placeholder="Enter Invite Code" required>
                         <button type="submit" name="join_session" class="btn btn-primary text-nowrap">Join Session</button>
                     </form>
@@ -67,7 +69,7 @@
                     <tr>
                         <td>{{ session.id }}</td>
                         <td>{{ session.game.name }}</td>
-                        <td><span class="badge bg-info text-dark">{{ session.status.value }}</span></td>
+                        <td><span class="badge bg-info text-dark">{{ session.status.label }}</span></td>
                         <td>{{ session.created|date('Y-m-d H:i') }}</td>
                         <td>
                             {% set inviteCode = '' %}
@@ -81,6 +83,7 @@
                                 <code>{{ inviteCode }}</code>
                             {% else %}
                                 <form method="post" class="d-inline">
+                                    <input type="hidden" name="_token" value="{{ csrf_token('create_invite_' ~ session.id) }}">
                                     <input type="hidden" name="session_id" value="{{ session.id }}">
                                     <button type="submit" name="create_invite" class="btn btn-sm btn-outline-secondary">Generate Invite</button>
                                 </form>
@@ -91,12 +94,14 @@
                             {% if session.status.value == 'created' %}
                                 {% if session.players|length >= session.game.numberOfPlayers %}
                                     <form method="post" class="d-inline">
+                                        <input type="hidden" name="_token" value="{{ csrf_token('start_session_' ~ session.id) }}">
                                         <input type="hidden" name="session_id" value="{{ session.id }}">
                                         <button type="submit" name="start_session" class="btn btn-sm btn-success">Start Session</button>
                                     </form>
                                 {% endif %}
                                 {% if session.timer == 0 %}
                                     <form method="post" class="d-inline">
+                                        <input type="hidden" name="_token" value="{{ csrf_token('leave_session_' ~ session.id) }}">
                                         <input type="hidden" name="session_id" value="{{ session.id }}">
                                         <button type="submit" name="leave_session" class="btn btn-sm btn-outline-danger" onclick="return confirm('Are you sure you want to leave this session?')">Leave Session</button>
                                     </form>

templates/game/lobby.html.twig

@@ -0,0 +1,92 @@
+{% extends 'layout/site.html.twig' %}
+
+{% set isCreated = session.status.value == 'created' %}
+{% set isFinished = session.status.value in ['won', 'lost'] %}
+
+{% block title %}{{ isCreated ? 'Waiting for players' : 'Post-game chat' }} - {{ session.game.name }}{% endblock %}
+
+{% block body %}
+<div class="row justify-content-center">
+    <div class="col-md-8">
+        {% if isCreated %}
+            <div class="card shadow-sm mb-4">
+                <div class="card-header bg-primary text-white">
+                    <h3 class="card-title mb-0">Waiting for more players to join</h3>
+                </div>
+                <div class="card-body">
+                    <h4>{{ session.game.name }}</h4>
+                    <p>Share the invite code with your friends. Feel free to chat below while you wait &mdash; no need to reload the page.</p>
+
+                    <div class="alert alert-info">
+                        <strong>Players joined:</strong> {{ session.players|length }} / {{ session.game.numberOfPlayers }}
+                    </div>
+
+                    <ul class="list-group mb-3">
+                        {% for sessionPlayer in session.players %}
+                            <li class="list-group-item">{{ sessionPlayer.user.username }}</li>
+                        {% endfor %}
+                    </ul>
+
+                    {% if session.players|length >= session.game.numberOfPlayers %}
+                        <form method="post" action="{{ path('game_dashboard') }}" class="mb-3">
+                            <input type="hidden" name="_token" value="{{ csrf_token('start_session_' ~ session.id) }}">
+                            <input type="hidden" name="session_id" value="{{ session.id }}">
+                            <button type="submit" name="start_session" class="btn btn-success">Start Session</button>
+                        </form>
+                    {% endif %}
+
+                    <a href="{{ path('game_dashboard') }}" class="btn btn-outline-secondary btn-sm">Back to Dashboard</a>
+                </div>
+            </div>
+        {% elseif isFinished %}
+            <div class="card shadow-sm mb-4">
+                <div class="card-header {{ session.status.value == 'won' ? 'bg-success' : 'bg-secondary' }} text-white">
+                    <h3 class="card-title mb-0">{{ session.status.value == 'won' ? 'You won!' : 'Game over' }}</h3>
+                </div>
+                <div class="card-body">
+                    <h4>{{ session.game.name }}</h4>
+                    <p>The game has ended, but the chat is still open for a little while &mdash; feel free to keep talking.</p>
+
+                    <a href="{{ path(session.status.value == 'won' ? 'game_won' : 'game_lost', {session: session.id}) }}" class="btn btn-primary btn-sm">View results</a>
+                    <a href="{{ path('game_dashboard') }}" class="btn btn-outline-secondary btn-sm">Back to Dashboard</a>
+                </div>
+            </div>
+        {% endif %}
+
+        <div class="card shadow-sm">
+            <div class="card-header">
+                <h5 class="mb-0">Lobby chat</h5>
+            </div>
+            <div class="card-body">
+                <div id="lobby-chat-log" class="mb-3 d-flex flex-column gap-2" style="max-height: 320px; overflow-y: auto;">
+                    {% for message in messages %}
+                        <div class="lobby-message">
+                            <strong>{{ message.player.user.username }}</strong>
+                            <span class="text-muted small">{{ message.createdAt|date('H:i') }}</span>
+                            <div>{{ message.content }}</div>
+                        </div>
+                    {% else %}
+                        <p class="text-muted mb-0" id="lobby-chat-empty">No messages yet. Say hi!</p>
+                    {% endfor %}
+                </div>
+
+                {% if player %}
+                    <form method="post" class="d-flex gap-2">
+                        <input type="hidden" name="_token" value="{{ csrf_token('send_message_' ~ session.id) }}">
+                        <input type="text" name="content" class="form-control" placeholder="Type a message&hellip;" maxlength="500" required autocomplete="off">
+                        <button type="submit" name="send_message" class="btn btn-primary">Send</button>
+                    </form>
+                {% else %}
+                    <p class="text-muted mb-0">Only players in this session can chat.</p>
+                {% endif %}
+            </div>
+        </div>
+    </div>
+</div>
+
+<div id="game-lobby-config"
+     data-mercure-public-url="{{ mercure_public_url|e('html_attr') }}"
+     data-topic="/game/hub/{{ session.id|e('html_attr') }}"
+     style="display:none">
+</div>
+{% endblock %}

templates/game/lost.html.twig

@@ -78,6 +78,7 @@
                     <div class="feedback-form mt-4">
                         <h5>Feedback</h5>
                         <form method="post">
+                            <input type="hidden" name="_token" value="{{ csrf_token('game_feedback_' ~ session.id) }}">
                             <div class="mb-3">
                                 <label for="difficulty" class="form-label">How would you rate the difficulty? (<span id="difficulty-val">5</span>/10)</label>
                                 <input type="range" class="form-range" min="1" max="10" step="1" id="difficulty" name="difficulty" value="5" oninput="document.getElementById('difficulty-val').innerText = this.value">

templates/game/waiting.html.twig

@@ -63,6 +63,7 @@
                     </div>
                 {% endif %}
                 <form method="post" class="mt-4">
+                    <input type="hidden" name="_token" value="{{ csrf_token('toggle_ready_' ~ session.id) }}">
                     <input type="hidden" name="toggle_ready" value="0">
                     <div class="form-check form-switch mb-3">
                         <input class="form-check-input" type="checkbox" id="toggle_ready" name="toggle_ready" value="1" onchange="this.form.submit()" {{ isReady ? 'checked' : '' }} {{ not app.user.verified ? 'disabled' : '' }}>
@@ -87,77 +88,14 @@
 </div>
 
 <form id="expire-ready-form" method="post" style="display:none">
+    <input type="hidden" name="_token" value="{{ csrf_token('expire_ready_' ~ session.id) }}">
     <input type="hidden" name="expire_ready" value="1">
 </form>
 
-<div id="mercure-config"
+<div id="game-waiting-config"
      data-mercure-public-url="{{ mercure_public_url|e('html_attr') }}"
      data-topic="/game/hub/{{ session.id|e('html_attr') }}"
      data-ready-at="{{ readyAt|e('html_attr') }}"
      style="display:none">
 </div>
-
-<script>
-    const config = document.getElementById('mercure-config');
-    const publicUrl = config.dataset.mercurePublicUrl;
-    const topic = config.dataset.topic;
-    const readyAt = config.dataset.readyAt;
-
-    let reloading = false;
-    const reloadOnce = (eventSource) => {
-        if (reloading) {
-            return;
-        }
-        reloading = true;
-        if (eventSource) {
-            eventSource.close();
-        }
-        window.location.reload();
-    };
-
-    if (publicUrl && topic) {
-        const url = new URL(publicUrl);
-        url.searchParams.append('topic', topic);
-
-        const eventSource = new EventSource(url);
-        eventSource.onmessage = event => {
-            const data = JSON.parse(event.data);
-            if (data.type === 'all_ready' || data.type === 'player_ready') {
-                reloadOnce(eventSource);
-            }
-        };
-    }
-
-    // Our own ready status expires 60s after we set it - proactively tell the
-    // server as close to that deadline as possible, so the other players find
-    // out live instead of only whenever someone else's request happens to
-    // trigger the lazy check.
-    if (readyAt) {
-        const timeoutMs = 61000; // slightly more than the server-side 60s
-        const readyAtMs = readyAt * 1000;
-        const countdownEl = document.getElementById('ready-countdown');
-
-        const updateCountdown = () => {
-            const remaining = Math.max(0, Math.ceil((readyAtMs + timeoutMs - Date.now()) / 1000));
-            if (countdownEl) {
-                const m = Math.floor(remaining / 60);
-                const s = remaining % 60;
-                countdownEl.textContent = m + ':' + s.toString().padStart(2, '0');
-            }
-            return remaining;
-        };
-
-        const remaining = updateCountdown();
-        if (remaining <= 0) {
-            document.getElementById('expire-ready-form').submit();
-        } else {
-            const countdownInterval = setInterval(() => {
-                if (updateCountdown() <= 0) {
-                    clearInterval(countdownInterval);
-                    document.getElementById('expire-ready-form').submit();
-                }
-            }, 1000);
-        }
-    }
-</script>
 {% endblock %}

templates/game/won.html.twig

@@ -78,6 +78,7 @@
                     <div class="feedback-form mt-4">
                         <h5>Feedback</h5>
                         <form method="post">
+                            <input type="hidden" name="_token" value="{{ csrf_token('game_feedback_' ~ session.id) }}">
                             <div class="mb-3">
                                 <label for="difficulty" class="form-label">How would you rate the difficulty? (<span id="difficulty-val">5</span>/10)</label>
                                 <input type="range" class="form-range" min="1" max="10" step="1" id="difficulty" name="difficulty" value="5" oninput="document.getElementById('difficulty-val').innerText = this.value">

templates/tech/security/login.html.twig

@@ -6,7 +6,7 @@
 <form method="post">
     {% if error %}
         <div class="alert alert-danger">
-            {{ error.messageKey|trans(error.messageData, 'security')|raw }}
+            {{ error.messageKey|trans(error.messageData, 'security') }}
             {% if error.messageData['%resend_link%'] is defined %}
                 <a href="{{ error.messageData['%resend_link%'] }}">Resend activation link</a>
             {% endif %}

tests/Game/GameDashboardServiceTest.php

@@ -10,6 +10,7 @@ use App\Game\Entity\SessionSetting;
 use App\Game\Enum\GameStatus;
 use App\Game\Enum\SessionStatus;
 use App\Game\Enum\SessionSettingType;
+use App\Game\Repository\LobbyMessageRepository;
 use App\Game\Service\GameDashboardService;
 use App\Tech\Entity\User;
 use Doctrine\ORM\EntityManagerInterface;
@@ -23,6 +24,7 @@ class GameDashboardServiceTest extends TestCase
     private $entityManager;
     private $gameRepository;
     private $sessionRepository;
+    private $lobbyMessageRepository;
     private $hub;
     private $service;
 
@@ -31,14 +33,15 @@ class GameDashboardServiceTest extends TestCase
         $this->entityManager = $this->createMock(EntityManagerInterface::class);
         $this->gameRepository = $this->createMock(GameRepository::class);
         $this->sessionRepository = $this->createMock(SessionRepository::class);
+        $this->lobbyMessageRepository = $this->createMock(LobbyMessageRepository::class);
         $this->hub = $this->createMock(HubInterface::class);
 
         $this->service = new GameDashboardService(
             $this->gameRepository,
             $this->sessionRepository,
+            $this->lobbyMessageRepository,
             $this->entityManager,
             $this->hub,
-            'http://localhost/topic'
         );
     }
 

tests/Game/SessionLoggingTest.php

@@ -74,6 +74,7 @@ class SessionLoggingTest extends TestCase
         $player->method('getUser')->willReturn($user);
         $player->method('getSession')->willReturn($session);
         $player->method('getScreen')->willReturn(1);
+        $player->method('getLogFileBasename')->willReturn('player1');
 
         $this->security->method('getUser')->willReturn($user);
         $this->playerService->method('GetCurrentlyActiveAsPlayer')->willReturn($player);