feat: add TTL to GameSessionStore, replay protection and session cleanup to evaluateAnswer

apps/api/src/services/gameService.test.ts

@@ -219,4 +219,55 @@ describe("evaluateAnswer", () => {
       "Question not found",
     );
   });
+
+  it("throws NotFoundError when the same question is submitted twice", async () => {
+    const session = await createGameSession(validRequest, store);
+    const question = session.questions[0]!;
+
+    await evaluateAnswer(
+      {
+        sessionId: session.sessionId,
+        questionId: question.questionId,
+        selectedOptionId: 0,
+      },
+      store,
+    );
+
+    await expect(
+      evaluateAnswer(
+        {
+          sessionId: session.sessionId,
+          questionId: question.questionId,
+          selectedOptionId: 0,
+        },
+        store,
+      ),
+    ).rejects.toThrow("Question not found");
+  });
+
+  it("deletes the session after the last question is answered", async () => {
+    const session = await createGameSession(validRequest, store);
+
+    for (const question of session.questions) {
+      await evaluateAnswer(
+        {
+          sessionId: session.sessionId,
+          questionId: question.questionId,
+          selectedOptionId: 0,
+        },
+        store,
+      );
+    }
+
+    await expect(
+      evaluateAnswer(
+        {
+          sessionId: session.sessionId,
+          questionId: session.questions[0]!.questionId,
+          selectedOptionId: 0,
+        },
+        store,
+      ),
+    ).rejects.toThrow("Game session not found");
+  });
 });

apps/api/src/services/gameService.ts

@@ -59,7 +59,7 @@ export const createGameSession = async (
   );
 
   const sessionId = randomUUID();
-  await store.create(sessionId, { answers: answerKey });
+  await store.create(sessionId, { answers: answerKey }, 30 * 60 * 1000);
 
   return { sessionId, questions };
 };
@@ -80,6 +80,12 @@ export const evaluateAnswer = async (
     throw new NotFoundError(`Question not found: ${submission.questionId}`);
   }
 
+  session.answers.delete(submission.questionId);
+
+  if (session.answers.size === 0) {
+    await store.delete(submission.sessionId);
+  }
+
   return {
     questionId: submission.questionId,
     isCorrect: submission.selectedOptionId === correctOptionId,