feat(f3): require player session token for lie submission

fupogfakta/migrations/0004_player_session_token.py

@@ -0,0 +1,19 @@
+# Generated by Django 6.0.2 on 2026-02-27 22:08
+
+import fupogfakta.models
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('fupogfakta', '0003_roundquestion_mixed_answers'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='player',
+            name='session_token',
+            field=models.CharField(db_index=True, default=fupogfakta.models._generate_player_session_token, max_length=64),
+        ),
+    ]

fupogfakta/models.py

@@ -1,9 +1,15 @@
+import secrets
+
 from django.db import models
 from django.contrib.auth import get_user_model
 from django.utils import timezone
 
 User = get_user_model()
 
+def _generate_player_session_token() -> str:
+    return secrets.token_urlsafe(24)
+
+
 
 class Category(models.Model):
     name = models.CharField(max_length=120, unique=True)
@@ -54,6 +60,7 @@ class GameSession(models.Model):
 class Player(models.Model):
     session = models.ForeignKey(GameSession, on_delete=models.CASCADE, related_name="players")
     nickname = models.CharField(max_length=40)
+    session_token = models.CharField(max_length=64, db_index=True, default=_generate_player_session_token)
     score = models.IntegerField(default=0)
     is_connected = models.BooleanField(default=True)
     created_at = models.DateTimeField(auto_now_add=True)