[sydseter]

Description

These changes fix the “players get kicked out / stuck after game start” issue by preventing bad card-play requests and handling them safely when they still happen.

• Frontend fix in app.js: only real hand cards can be dragged/dropped, and requests are blocked if game/player/card IDs are missing. This stops calls like PUT /api/games/undefined/players/undefined/card.
• Frontend recovery in app.js: if the API call fails, the drag is canceled so the UI doesn’t drift into a broken state.
• API hardening in api_controller.ex: missing or invalid params now return explicit 400 JSON errors instead of ambiguous behavior.

Net effect: fewer broken turns, clearer errors, and players are much less likely to feel like their session vanished.

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: Github CoPilor
  • LLMs and versions: GPT-5.5
  • Prompts: `Some players have reported that they get thrown out of the game after the game is started. I am getting the following logs:

The call: PUT /api/games/undefined/players/undefined/card

seems to indicate that something has gone wrong for the player, but what?

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[Copilot]

Pull request overview

This PR hardens the card-play flow to prevent invalid “play card” requests from breaking gameplay, by adding frontend drag/drop validation and backend request validation with clearer error responses.

Changes:

• Frontend: restrict drag/drop to valid hand cards and block requests missing required identifiers.
• Frontend: attempt UI recovery when the API call fails.
• Backend: return explicit 400 JSON errors for missing/invalid play_card params, plus add test coverage for missing dealt_card_id.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
copi.owasp.org/assets/js/app.js	Tightens Dragula drag/drop validation and adds client-side blocking/recovery around the play-card API call.
copi.owasp.org/lib/copi_web/controllers/api_controller.ex	Adds 400 Bad Request handling for missing/invalid play_card parameters.
copi.owasp.org/test/copi_web/controllers/api_controller_test.exs	Adds a controller test to ensure missing dealt_card_id returns 400 with an explicit error message.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[sydseter]

The dragging got broken. I needed to change the hook to resolve to the nearest draggable card container that has data-* attributes before validating the drag and sending the card request.