stuff

server/src/routes/tournaments.ts

@@ -3,6 +3,7 @@ import { db, schema } from '../db/index.js'
 import { eq } from 'drizzle-orm'
 import { toError } from '../lib/utils.js'
 import { isCreatorPubkey } from '../lib/constants.js'
+import { extractPubkeyFromAuth } from '../middleware/jwt.js'
 import {
   createTournament,
   joinTournament,
@@ -51,13 +52,22 @@ tournamentsRouter.post('/', async (c) => {
   return c.json({ id, name: body.name, format, size }, 201)
 })
 
-// Join a tournament
+// Join a tournament (requires JWT auth to prove pubkey ownership)
 tournamentsRouter.post('/:id/join', async (c) => {
   const tournamentId = c.req.param('id')
   const parsed = joinTournamentSchema.safeParse(await c.req.json().catch(() => ({})))
   if (!parsed.success) return c.json({ error: formatZodError(parsed.error, { pubkey: 'pubkey required' }, 'pubkey required') }, 400)
   const body = parsed.data
 
+  // Verify caller owns the pubkey via JWT (prevents joining on behalf of others)
+  const authedPubkey = extractPubkeyFromAuth(c.req.header('Authorization'))
+  if (authedPubkey && authedPubkey !== body.pubkey) {
+    return c.json({ error: 'Pubkey does not match authenticated session' }, 403)
+  }
+  if (!authedPubkey && process.env.NODE_ENV === 'production') {
+    return c.json({ error: 'Authentication required' }, 401)
+  }
+
   // Look up bot by pubkey
   const bot = db.select().from(schema.bots)
     .where(eq(schema.bots.publicKey, body.pubkey))