Tech-Debt-Cleanup: Doku, Security-Hardening, Server-Validierung, Client-Stabilitaet

Doku/Repo:
- README.md mit Setup, Run-Anleitung, Konfiguration und Sprachpolicy neu geschrieben
- appsettings.json: committed JWT-Key und irreführende LocalDB-Connection-String entfernt
- appsettings.Development.json: expliziter Dev-Only JWT-Key hinterlegt
- build.yml: Build-CI für master/PRs hinzugefügt
- slnx/aspire.config.json: Pfad-Casing korrigiert (Linux-kompatibel)
- .gitignore: Kommentar zu den Legacy-SQLite-Einträgen

Server:
- Jwt:Key ist in Production Pflicht (Fail-fast statt Fallback-Secret)
- Passwort-Mindestlänge 8 Zeichen bei Registrierung
- StartGame: nur aus Lobby, mindestens 2 Spieler
- SetPlayerReady: gameId/Status geprüft
- SubmitSlip: Game-/Round-Status, Round-Membership, IsUsed validiert
- CreateChallenge: Round-Bindung, kein Self-Challenge, nur gespielte Karten, keine Doppel-Challenges
- ResolveChallenge: Pending-Guard, Scoring (Score/SuccessfulSlips/FailedSlips), Approved-Transfer gefixt
- GetPlayerHand: nur Karten der aktiven Runde
- RoundTimeRemaining: StartedAt wird bei Round-Aktivierung gesetzt
- Lobby-Code: crypto-random mit Kollisions-Retry
- EF: explizite NpgsqlDataSource-Auflösung aus DI
- Hub: Reconnect-Gruppenbeitritt, ConnectionId-Cleanup beim Disconnect, ChallengingPlayerName gesetzt, SlipChallenged/ChallengeResolved konsistent

Client:
- Offline-Start löscht Session nicht mehr (NetworkError vs. Invalid unterschieden)
- ResolveChallenge geht durch die Offline-Queue (kein Crash mehr bei Disconnect)
- Queue: Poison-Entries werden nach 3 Retries verworfen statt die Queue ewig zu blockieren
- SignalR: Verbindung wird sauber disposed/rebuildet, Token immer zur Laufzeit gelesen, Connect-Lock gegen parallele Starts
- ViewModels: Thread-Marshaling in allen Receive-Handlern, kein async void mehr
- LobbyViewModel: Logout deaktiviert den Singleton (kein stale-Navigation mehr), Reaktivierung via Activate()
- GameBoard: lokaler 1s-Timer für RoundTimeRemaining
- Overlay: x:DataType für kompilierte Bindings, Frame→Border
- csproj: Preview-Logging-Package auf 10.0.10, Template-Cruft entfernt

SlipItIn.Server/Services/GameService.cs

@@ -2,6 +2,7 @@ using Microsoft.EntityFrameworkCore;
 using SlipItIn.Server.Data;
 using SlipItIn.Shared.DTOs;
 using SlipItIn.Shared.Models;
+using System.Security.Cryptography;
 
 namespace SlipItIn.Server.Services;
 
@@ -21,7 +22,7 @@ public class GameService : IGameService
         using var context = _contextFactory.CreateDbContext();
 
         var host = await context.Users.FirstOrDefaultAsync(u => u.Id == hostUserId) ?? throw new InvalidOperationException("Host not found");
-        var lobbyCode = GenerateLobbyCode();
+        var lobbyCode = await GenerateUniqueLobbyCodeAsync(context);
         var game = new Game
         {
             LobbyCode = lobbyCode,
@@ -70,7 +71,16 @@ public class GameService : IGameService
     {
         using var context = _contextFactory.CreateDbContext();
 
-        var game = await context.Games.FirstOrDefaultAsync(g => g.Id == gameId) ?? throw new InvalidOperationException("Game not found");
+        var game = await context.Games
+            .Include(g => g.Players)
+            .FirstOrDefaultAsync(g => g.Id == gameId) ?? throw new InvalidOperationException("Game not found");
+
+        if (game.Status != GameStatus.Lobby)
+            throw new InvalidOperationException("Game has already started or ended");
+
+        if (game.Players.Count < 2)
+            throw new InvalidOperationException("At least 2 players are required to start the game");
+
         game.Status = GameStatus.InProgress;
         game.StartedAt = DateTime.UtcNow;
 
@@ -85,12 +95,16 @@ public class GameService : IGameService
     {
         using var context = _contextFactory.CreateDbContext();
 
-        var player = await context.Players.FirstOrDefaultAsync(p => p.Id == playerId) ?? throw new InvalidOperationException("Player not found");
+        var game = await context.Games.FirstOrDefaultAsync(g => g.Id == gameId) ?? throw new InvalidOperationException("Game not found");
+        if (game.Status != GameStatus.Lobby)
+            throw new InvalidOperationException("Game is not in lobby status");
+
+        var player = await context.Players.FirstOrDefaultAsync(p => p.Id == playerId && p.GameId == gameId)
+            ?? throw new InvalidOperationException("Player not found in this game");
         player.IsReady = true;
         await context.SaveChangesAsync();
 
-        return await context.Games.FirstOrDefaultAsync(g => g.Id == gameId) 
-            ?? throw new InvalidOperationException("Game not found");
+        return game;
     }
 
     public async Task<List<PlayerCard>> DealCardsAsync(int gameId)
@@ -108,7 +122,7 @@ public class GameService : IGameService
 
         foreach (var player in players)
         {
-            var selectedPhrases = allPhrases.OrderBy(_ => Random.Shared.Next()).Take(5);
+            var selectedPhrases = allPhrases.OrderBy(_ => RandomNumberGenerator.GetInt32(int.MaxValue)).Take(5);
 
             foreach (var phrase in selectedPhrases)
             {
@@ -125,6 +139,7 @@ public class GameService : IGameService
         }
 
         currentRound.Status = RoundStatus.Active;
+        currentRound.StartedAt = DateTime.UtcNow;
         await context.SaveChangesAsync();
 
         return dealtCards;
@@ -134,10 +149,18 @@ public class GameService : IGameService
     {
         using var context = _contextFactory.CreateDbContext();
 
+        var game = await context.Games.FirstOrDefaultAsync(g => g.Id == gameId) ?? throw new InvalidOperationException("Game not found");
+        if (game.Status != GameStatus.InProgress)
+            throw new InvalidOperationException("Game is not in progress");
+
         var card = await context.PlayerCards
-            .Include(pc => pc.Player)
+            .Include(pc => pc.GameRound)
             .FirstOrDefaultAsync(pc => pc.Id == cardId) ?? throw new InvalidOperationException("Card not found");
+
         if (card.PlayerId != playerId) throw new UnauthorizedAccessException("Card does not belong to player");
+        if (card.GameRound.GameId != gameId) throw new InvalidOperationException("Card does not belong to this game");
+        if (card.GameRound.Status != RoundStatus.Active) throw new InvalidOperationException("Round is not active");
+        if (card.IsUsed) throw new InvalidOperationException("Card has already been used");
 
         card.IsUsed = true;
         await context.SaveChangesAsync();
@@ -149,13 +172,24 @@ public class GameService : IGameService
     {
         using var context = _contextFactory.CreateDbContext();
 
-        var targetCard = await context.PlayerCards.FirstOrDefaultAsync(pc => pc.Id == targetCardId) ?? throw new InvalidOperationException("Target card not found");
-
         var currentRound = await context.GameRounds
             .Where(gr => gr.GameId == gameId && gr.Status == RoundStatus.Active)
             .FirstOrDefaultAsync() ?? throw new InvalidOperationException("No active round found");
 
-        if (currentRound == null) throw new InvalidOperationException("No active round found");
+        var targetCard = await context.PlayerCards
+            .FirstOrDefaultAsync(pc => pc.Id == targetCardId) ?? throw new InvalidOperationException("Target card not found");
+
+        if (targetCard.GameRoundId != currentRound.Id)
+            throw new InvalidOperationException("Card does not belong to the active round");
+        if (targetCard.PlayerId == challengingPlayerId)
+            throw new InvalidOperationException("Cannot challenge your own card");
+        if (!targetCard.IsUsed)
+            throw new InvalidOperationException("Card has not been played yet");
+
+        var pendingExists = await context.SlipChallenges
+            .AnyAsync(c => c.TargetCardId == targetCardId && c.Status == ChallengeStatus.Pending);
+        if (pendingExists)
+            throw new InvalidOperationException("A challenge for this card is already pending");
 
         var challenge = new SlipChallenge
         {
@@ -179,19 +213,30 @@ public class GameService : IGameService
         var challenge = await context.SlipChallenges
             .Include(sc => sc.GameRound)
             .Include(sc => sc.TargetCard)
+            .Include(sc => sc.ChallengingPlayer)
+            .Include(sc => sc.TargetPlayer)
             .FirstOrDefaultAsync(sc => sc.Id == challengeId) ?? throw new InvalidOperationException("Challenge not found");
 
-        // approved = Beschuldigung stimmt (Phrase war falsch)
-        // rejected = Beschuldigung stimmt nicht (Phrase war richtig)
+        if (challenge.Status != ChallengeStatus.Pending)
+            throw new InvalidOperationException("Challenge has already been resolved");
 
-        if (!approved)
+        // approved = Beschuldigung stimmt (Phrase war ein unberechtigtes SlipIn des Beschuldigten)
+        // rejected = Beschuldigung stimmt nicht (Phrase wurde regelkonform gespielt)
+
+        if (approved)
         {
-            // FALSCHE BESCHULDIGUNG: Beschuldiger erhält die Phrase des Beschuldigten
-            var targetCard = challenge.TargetCard;
-            targetCard.PlayerId = challenge.ChallengingPlayerId;
-            context.PlayerCards.Update(targetCard);
+            // Berechtigte Beschuldigung: Beschuldigter muss die Phrase an den Beschuldiger abgeben
+            challenge.TargetCard.PlayerId = challenge.ChallengingPlayerId;
+            challenge.ChallengingPlayer.Score += 1;
+            challenge.TargetPlayer.FailedSlips += 1;
+        }
+        else
+        {
+            // Falsche Beschuldigung: Phrase bleibt beim Beschuldigten
+            challenge.TargetPlayer.SuccessfulSlips += 1;
+            challenge.TargetPlayer.Score += 1;
+            challenge.ChallengingPlayer.FailedSlips += 1;
         }
-        // Wenn approved: Phrase bleibt bei Beschuldigtem (= Phrase war tatsächlich ein SlipIn)
 
         challenge.Status = approved ? ChallengeStatus.Approved : ChallengeStatus.Rejected;
         challenge.ResolvedAt = DateTime.UtcNow;
@@ -218,7 +263,7 @@ public class GameService : IGameService
             Username = p.User.Username,
             Score = p.Score,
             IsReady = p.IsReady,
-            CardCount = p.Cards.Count // Nur Anzahl, nicht die Karten selbst!
+            CardCount = p.Cards.Count(c => !c.IsUsed) // Nur Anzahl, nicht die Karten selbst!
         }).ToList();
 
         var currentRound = game.Rounds
@@ -249,9 +294,17 @@ public class GameService : IGameService
     {
         using var context = _contextFactory.CreateDbContext();
 
+        // Nur Karten der aktuell aktiven Runde zurückgeben — sonst wächst die Hand
+        // über Runden hinweg unbegrenzt und enthält veraltete Karten.
+        var activeRoundIds = await context.GameRounds
+            .Where(gr => gr.Status == RoundStatus.Active &&
+                         gr.Game.Players.Any(p => p.Id == playerId))
+            .Select(gr => gr.Id)
+            .ToListAsync();
+
         var cards = await context.PlayerCards
             .Include(pc => pc.Phrase)
-            .Where(pc => pc.PlayerId == playerId)
+            .Where(pc => pc.PlayerId == playerId && activeRoundIds.Contains(pc.GameRoundId))
             .Select(pc => new PlayerCardDto
             {
                 CardId = pc.Id,
@@ -275,11 +328,25 @@ public class GameService : IGameService
             ?? throw new InvalidOperationException("Game not found");
     }
 
-    private string GenerateLobbyCode()
+    private static string GenerateLobbyCode()
     {
         const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
-        var code = new string([.. Enumerable.Range(0, 6).Select(_ => chars[Random.Shared.Next(chars.Length)])]);
+        var buffer = new char[6];
+        for (var i = 0; i < buffer.Length; i++)
+            buffer[i] = chars[RandomNumberGenerator.GetInt32(chars.Length)];
+        return new string(buffer);
+    }
 
-        return code;
+    private static async Task<string> GenerateUniqueLobbyCodeAsync(SlipItInDbContext context, int maxAttempts = 10)
+    {
+        for (var attempt = 0; attempt < maxAttempts; attempt++)
+        {
+            var code = GenerateLobbyCode();
+            var exists = await context.Games.AnyAsync(g => g.LobbyCode == code);
+            if (!exists)
+                return code;
+        }
+
+        throw new InvalidOperationException("Could not generate a unique lobby code");
     }
 }