From a0562fa6a44322ce596e04d1c042e09d268da9d8 Mon Sep 17 00:00:00 2001
From: Asger Geel Weirsoee <asger@weircon.dk>
Date: Sat, 28 Feb 2026 00:05:31 +0100
Subject: [PATCH] ui: lock guess submit to rendered answer options

---
 lobby/templates/lobby/player_screen.html | 5 +++--
 lobby/tests.py                           | 2 ++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/lobby/templates/lobby/player_screen.html b/lobby/templates/lobby/player_screen.html
index 68ce98f..50a51bc 100644
--- a/lobby/templates/lobby/player_screen.html
+++ b/lobby/templates/lobby/player_screen.html
@@ -22,15 +22,16 @@
 <button onclick="sessionDetail()">Opdater session-status</button>
 <pre id="out">Klar.</pre>
 <script>
+var availableAnswers=[];
 function code(){return document.getElementById("code").value.trim().toUpperCase();}
 function pid(){return document.getElementById("playerId").value.trim();}
 function rq(){return document.getElementById("roundQuestionId").value.trim();}
 function setGuess(text){document.getElementById("guessText").value=text;var buttons=document.querySelectorAll("#answerOptions button");buttons.forEach(function(btn){btn.classList.toggle("active",btn.dataset.answer===text);});}
-function renderAnswerOptions(roundQuestion){var wrap=document.getElementById("answerOptions");wrap.innerHTML="";if(!roundQuestion||!Array.isArray(roundQuestion.answers)){return;}roundQuestion.answers.forEach(function(item){if(!item||!item.text){return;}var btn=document.createElement("button");btn.type="button";btn.dataset.answer=item.text;btn.textContent=item.text;btn.onclick=function(){setGuess(item.text);};wrap.appendChild(btn);});}
+function renderAnswerOptions(roundQuestion){var wrap=document.getElementById("answerOptions");wrap.innerHTML="";availableAnswers=[];setGuess("");if(!roundQuestion||!Array.isArray(roundQuestion.answers)){return;}roundQuestion.answers.forEach(function(item){if(!item||!item.text){return;}availableAnswers.push(item.text);var btn=document.createElement("button");btn.type="button";btn.dataset.answer=item.text;btn.textContent=item.text;btn.onclick=function(){setGuess(item.text);};wrap.appendChild(btn);});}
 async function api(path,method,payload){var o={method:method||"GET",headers:{"Accept":"application/json"}};if(payload!==null){o.headers["Content-Type"]="application/json";o.body=JSON.stringify(payload);}var r=await fetch(path,o);var d=await r.json().catch(function(){return {};});document.getElementById("out").textContent=JSON.stringify({status:r.status,data:d},null,2);if(d.player&&d.player.id){document.getElementById("playerId").value=d.player.id;}if(d.player&&d.player.session_token){document.getElementById("sessionToken").value=d.player.session_token;}if(d.round_question&&d.round_question.id){document.getElementById("roundQuestionId").value=d.round_question.id;}if(d.round_question){renderAnswerOptions(d.round_question);}return d;}
 function joinSession(){return api("/lobby/sessions/join","POST",{code:code(),nickname:document.getElementById("nickname").value.trim()});}
 function sessionDetail(){return api("/lobby/sessions/"+code(),"GET",null);} 
 function submitLie(){return api("/lobby/sessions/"+code()+"/questions/"+rq()+"/lies/submit","POST",{player_id:parseInt(pid(),10),session_token:document.getElementById("sessionToken").value,text:document.getElementById("lieText").value});}
-function submitGuess(){return api("/lobby/sessions/"+code()+"/questions/"+rq()+"/guesses/submit","POST",{player_id:parseInt(pid(),10),session_token:document.getElementById("sessionToken").value,selected_text:document.getElementById("guessText").value});}
+function submitGuess(){var selected=document.getElementById("guessText").value;if(availableAnswers.length>0&&availableAnswers.indexOf(selected)===-1){document.getElementById("out").textContent=JSON.stringify({status:400,data:{error:"Vælg et af de viste svarmuligheder"}},null,2);return Promise.resolve({error:"invalid_client_guess"});}return api("/lobby/sessions/"+code()+"/questions/"+rq()+"/guesses/submit","POST",{player_id:parseInt(pid(),10),session_token:document.getElementById("sessionToken").value,selected_text:selected});}
 </script>
 </body></html>
diff --git a/lobby/tests.py b/lobby/tests.py
index 1954f4d..270381c 100644
--- a/lobby/tests.py
+++ b/lobby/tests.py
@@ -782,6 +782,8 @@ class UiScreenTests(TestCase):
         self.assertContains(response, "session_token")
         self.assertContains(response, "id=\"answerOptions\"")
         self.assertContains(response, "renderAnswerOptions")
+        self.assertContains(response, "availableAnswers")
+        self.assertContains(response, "invalid_client_guess")
 
 
 class SessionDetailRoundQuestionTests(TestCase):