From 542d32661579bff526a24a9e31583f10917ebe52 Mon Sep 17 00:00:00 2001
From: DEV-bot <dev-no-reply@weircon.dk>
Date: Tue, 17 Mar 2026 06:21:00 +0000
Subject: [PATCH] fix(gameplay): gate next-round replay on prior transition

---
 lobby/tests.py | 21 +++++++++++++++++++++
 lobby/views.py |  3 +++
 2 files changed, 24 insertions(+)

diff --git a/lobby/tests.py b/lobby/tests.py
index 5dac6e8..0a72835 100644
--- a/lobby/tests.py
+++ b/lobby/tests.py
@@ -1326,6 +1326,27 @@ class RevealRoundFlowTests(TestCase):
         mock_sync_broadcast_phase_event.assert_called_once()
         self.assertEqual(mock_sync_broadcast_phase_event.call_args.args[1], "phase.lie_started")
 
+    def test_start_next_round_rejects_plain_first_round_lie_phase(self):
+        self.client.login(username="host_reveal", password="secret123")
+        self.session.status = GameSession.Status.LIE
+        self.session.save(update_fields=["status"])
+
+        response = self.client.post(
+            reverse(
+                "lobby:start_next_round",
+                kwargs={"code": self.session.code},
+            ),
+            HTTP_ACCEPT_LANGUAGE="en",
+        )
+
+        self.assertEqual(response.status_code, 400)
+        self.assertEqual(response.json()["error_code"], "next_round_invalid_phase")
+        self.session.refresh_from_db()
+        self.assertEqual(self.session.status, GameSession.Status.LIE)
+        self.assertEqual(self.session.current_round, 1)
+        self.assertEqual(RoundConfig.objects.filter(session=self.session, number=1).count(), 1)
+        self.assertEqual(RoundQuestion.objects.filter(session=self.session, round_number=1).count(), 1)
+
     def test_start_next_round_requires_host(self):
         self.session.status = GameSession.Status.SCOREBOARD
         self.session.save(update_fields=["status"])
diff --git a/lobby/views.py b/lobby/views.py
index 23afb39..2c0112d 100644
--- a/lobby/views.py
+++ b/lobby/views.py
@@ -1004,6 +1004,9 @@ def start_next_round(request: HttpRequest, code: str) -> JsonResponse:
             locked_session.save(update_fields=["current_round", "status"])
             should_broadcast = True
         elif locked_session.status == GameSession.Status.LIE:
+            if locked_session.current_round <= 1:
+                return api_error(request, code="next_round_invalid_phase", status=400)
+
             next_round_config = RoundConfig.objects.filter(
                 session=locked_session,
                 number=locked_session.current_round,