feat(backend): per-tier, per-kind active-game limits with a guest funnel

Cap a player's simultaneous unfinished games per kind (vs_ai, random,
friends) with independent guest and durable-account tiers, held in a new
single-row backend.config table (-1 = unlimited) behind an in-memory cache
and editable live in the admin console (/_gm/limits). Each game is tagged
with games.game_kind on creation.

This replaces the earlier flat MaxActiveQuickGames=10 combined cap: the
per-tier/kind config is the single mechanism, enforced at the same handler
gate (ensureUnderGameLimit by kind on lobby/enqueue) plus the durable
friends cap in CreateInvitation. game.Service.AtGameLimit only resolves the
tier and counts; the limit policy stays at the request edge.

Guests are now refused friend requests, friend-code redemption,
befriend-in-game and invitation creation outright (403 guest_forbidden) --
previously only the UI hid these.

Admin: a kind column in both game lists and the config editor.

Defaults: guest 1 vs_ai / 1 random / 0 friends; durable 10 / 10 / 10.

backend/internal/inttest/game_limit_test.go

@@ -5,6 +5,7 @@ package inttest
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@@ -18,59 +19,119 @@ import (
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
+	"scrabble/backend/internal/gamelimits"
+	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/server"
+	"scrabble/backend/internal/social"
 )
 
-// The game-limit suite covers the simultaneous quick-game cap (game.MaxActiveQuickGames):
-// the counting rule (Store/Service.CountActiveQuickGames) and the HTTP gate that refuses a
-// new game once the cap is reached, while accepting an incoming invitation stays allowed.
+// The game-limit suite covers the per-tier, per-kind active-game caps (backend.config): the
+// game_kind tag persisted per creation path, the tier resolution + counting rule
+// (game.Service.AtGameLimit), the HTTP gate + lobby at_game_limit flag, the guest gate on friend
+// actions, and the config hot-cache reflecting an admin edit. Accepting an invitation stays exempt.
 
-// TestCountActiveQuickGames checks the count includes active and open quick games (the
-// honest-AI ones among them) and excludes finished games, friend games (created by
-// invitation) and games the account is not seated in.
-func TestCountActiveQuickGames(t *testing.T) {
+// newGameLimits builds a gamelimits service over the shared pool and loads the seeded config
+// (guest 1/1/0, durable 10/10/10).
+func newGameLimits(t *testing.T) *gamelimits.Service {
+	t.Helper()
+	gl := gamelimits.NewService(gamelimits.NewStore(testDB))
+	if err := gl.Load(context.Background()); err != nil {
+		t.Fatalf("load game limits: %v", err)
+	}
+	return gl
+}
+
+// restoreDefaultLimits resets the single config row to the migration seed on cleanup, so a test that
+// edited it never leaks its values into another (the row is a shared singleton).
+func restoreDefaultLimits(t *testing.T, gl *gamelimits.Service) {
+	t.Helper()
+	t.Cleanup(func() {
+		_ = gl.Update(context.Background(), gamelimits.Config{
+			Guest:   gamelimits.Limits{VsAI: 1, Random: 1, Friends: 0},
+			Durable: gamelimits.Limits{VsAI: 10, Random: 10, Friends: 10},
+		})
+	})
+}
+
+// gameKind reads a game's persisted game_kind tag.
+func gameKind(t *testing.T, gameID uuid.UUID) int16 {
+	t.Helper()
+	var k int16
+	if err := testDB.QueryRowContext(context.Background(),
+		`SELECT game_kind FROM backend.games WHERE game_id=$1`, gameID).Scan(&k); err != nil {
+		t.Fatalf("read game_kind: %v", err)
+	}
+	return k
+}
+
+// mustCreateKind creates an active game seating the accounts, tagged with kind, and returns its id.
+func mustCreateKind(t *testing.T, games *game.Service, seats []uuid.UUID, kind gamelimits.Kind) uuid.UUID {
+	t.Helper()
+	g, err := games.Create(context.Background(), game.CreateParams{
+		Variant: engine.VariantEnglish, Seats: seats, TurnTimeout: 24 * time.Hour, Kind: kind,
+	})
+	if err != nil {
+		t.Fatalf("create game (kind=%d): %v", kind, err)
+	}
+	return g.ID
+}
+
+// startFriendGameID has inviter invite invitee to a friend game and the invitee accept, returning
+// the started game's id.
+func startFriendGameID(t *testing.T, inv *lobby.InvitationService, inviter, invitee uuid.UUID) uuid.UUID {
+	t.Helper()
+	ctx := context.Background()
+	invitation, err := inv.CreateInvitation(ctx, inviter, []uuid.UUID{invitee}, englishInvite())
+	if err != nil {
+		t.Fatalf("create invitation: %v", err)
+	}
+	got, err := inv.RespondInvitation(ctx, invitation.ID, invitee, true)
+	if err != nil {
+		t.Fatalf("accept invitation: %v", err)
+	}
+	if got.GameID == nil {
+		t.Fatal("accepted invitation has no game id")
+	}
+	return *got.GameID
+}
+
+// TestGameKindPersisted checks each creation path stamps the right game_kind: random (auto-match)
+// =2, vs_ai =1, friend (by invitation) =3.
+func TestGameKindPersisted(t *testing.T) {
 	ctx := context.Background()
 	clearOpenGames(t)
 	games := newGameService()
-	human := provisionAccount(t)
-	opp := provisionAccount(t)
+	inv := newInvitationService()
+	human, opp := provisionAccount(t), provisionAccount(t)
 
-	if n := mustCount(t, games, human); n != 0 {
-		t.Fatalf("fresh account count = %d, want 0", n)
+	rnd, _, err := games.OpenOrJoin(ctx, human, game.CreateParams{Variant: engine.VariantEnglish, TurnTimeout: 24 * time.Hour}, time.Now().Add(time.Minute), nil)
+	if err != nil {
+		t.Fatalf("open random game: %v", err)
+	}
+	if k := gameKind(t, rnd.ID); k != int16(gamelimits.KindRandom) {
+		t.Errorf("random game_kind = %d, want %d", k, gamelimits.KindRandom)
 	}
 
-	// An open (awaiting-opponent) quick game counts.
-	if _, _, err := games.OpenOrJoin(ctx, human, game.CreateParams{
-		Variant: engine.VariantEnglish, TurnTimeout: 24 * time.Hour,
-	}, time.Now().Add(time.Minute), nil); err != nil {
-		t.Fatalf("open quick game: %v", err)
+	ai := mustCreateKind(t, games, []uuid.UUID{human, opp}, gamelimits.KindVsAI)
+	if k := gameKind(t, ai); k != int16(gamelimits.KindVsAI) {
+		t.Errorf("vs_ai game_kind = %d, want %d", k, gamelimits.KindVsAI)
 	}
-	// An active quick game and an honest-AI quick game both count (neither has an invitation row).
-	mustCreateQuick(t, games, []uuid.UUID{human, opp}, false, 1)
-	mustCreateQuick(t, games, []uuid.UUID{human, opp}, true, 2)
 
-	// A finished quick game does NOT count.
-	fin := mustCreateQuick(t, games, []uuid.UUID{human, opp}, false, 3)
-	if _, err := testDB.ExecContext(ctx, `UPDATE backend.games SET status='finished' WHERE game_id=$1`, fin); err != nil {
-		t.Fatalf("finish game: %v", err)
-	}
-	// A game the human is not seated in does NOT count.
-	mustCreateQuick(t, games, []uuid.UUID{opp, provisionAccount(t)}, false, 4)
-	// A friend game (created by invitation) does NOT count, even though it is active.
-	startFriendGame(t, human)
-
-	if n := mustCount(t, games, human); n != 3 {
-		t.Fatalf("active quick count = %d, want 3 (active + AI + open)", n)
+	friend := startFriendGameID(t, inv, human, opp)
+	if k := gameKind(t, friend); k != int16(gamelimits.KindFriends) {
+		t.Errorf("friend game_kind = %d, want %d", k, gamelimits.KindFriends)
 	}
 }
 
-// TestGameLimitGate drives the cap through the assembled HTTP server: under the cap the lobby
-// reports at_game_limit false; at the cap it flips to true and both new-game endpoints (quick
-// enqueue and invitation creation) are refused with 409 game_limit_reached, while accepting an
-// incoming invitation is still allowed.
-func TestGameLimitGate(t *testing.T) {
+// TestGuestActiveGameLimitHTTP drives the guest random cap through the assembled server: the first
+// auto-match opens a game, the lobby then flags at_game_limit, and a second enqueue is refused 409
+// game_limit_reached. It also checks the guest vs_ai and friends caps resolve at the domain level.
+func TestGuestActiveGameLimitHTTP(t *testing.T) {
 	ctx := context.Background()
+	clearOpenGames(t)
+	gl := newGameLimits(t)
 	games := newGameService()
+	games.SetGameLimits(gl)
 	srv := server.New(":0", server.Deps{
 		Logger:      zaptest.NewLogger(t),
 		DB:          testDB,
@@ -78,88 +139,110 @@ func TestGameLimitGate(t *testing.T) {
 		Games:       games,
 		Matchmaker:  newMatchmaker(t, newRobotService(t, newGameService()), time.Minute, 0),
 		Invitations: newInvitationService(),
+		GameLimits:  gl,
 	})
 
-	human := provisionAccount(t)
+	guest := provisionGuest(t)
+	if gamesListAtLimit(t, srv, guest) {
+		t.Fatal("a fresh guest must be under the random game limit")
+	}
+	// The first auto-match opens a random game (guest random cap = 1).
+	if rec := userPost(t, srv, "/api/v1/user/lobby/enqueue", guest, `{"variant":"erudit_ru"}`); rec.Code != http.StatusOK {
+		t.Fatalf("first enqueue = %d (%s), want 200", rec.Code, rec.Body.String())
+	}
+	// At the cap: the lobby flags it and a second enqueue is refused with the stable code.
+	if !gamesListAtLimit(t, srv, guest) {
+		t.Fatal("after one random game the guest must be at the limit")
+	}
+	if rec := userPost(t, srv, "/api/v1/user/lobby/enqueue", guest, `{"variant":"erudit_ru"}`); rec.Code != http.StatusConflict || errorCode(t, rec) != "game_limit_reached" {
+		t.Fatalf("second enqueue = (%d, %q), want (409, game_limit_reached)", rec.Code, errorCode(t, rec))
+	}
+
+	// A guest is refused the friends flow outright at the HTTP edge (403 guest_forbidden).
 	opp := provisionAccount(t)
-
-	// Under the cap: the lobby reports the player is not limited.
-	if gamesListAtLimit(t, srv, human) {
-		t.Fatal("a fresh account must be under the game limit")
-	}
-
-	// Reach the cap with active quick games seating the human (no invitation row → quick).
-	for i := 0; i < game.MaxActiveQuickGames; i++ {
-		mustCreateQuick(t, games, []uuid.UUID{human, opp}, false, int64(i+1))
-	}
-
-	// At the cap: the lobby flags it and both create paths are refused with the stable code.
-	if !gamesListAtLimit(t, srv, human) {
-		t.Fatalf("at %d games at_game_limit must be true", game.MaxActiveQuickGames)
-	}
-	// erudit_ru is in the default variant preferences, so the variant gate passes and the
-	// game-limit gate is what fires here.
-	if rec := userPost(t, srv, "/api/v1/user/lobby/enqueue", human, `{"variant":"erudit_ru"}`); rec.Code != http.StatusConflict || errorCode(t, rec) != "game_limit_reached" {
-		t.Fatalf("enqueue at limit = (%d, %q), want (409, game_limit_reached)", rec.Code, errorCode(t, rec))
-	}
 	invBody := fmt.Sprintf(`{"variant":"erudit_ru","invitee_ids":[%q]}`, opp.String())
-	if rec := userPost(t, srv, "/api/v1/user/invitations", human, invBody); rec.Code != http.StatusConflict || errorCode(t, rec) != "game_limit_reached" {
-		t.Fatalf("invitation at limit = (%d, %q), want (409, game_limit_reached)", rec.Code, errorCode(t, rec))
+	if rec := userPost(t, srv, "/api/v1/user/invitations", guest, invBody); rec.Code != http.StatusForbidden || errorCode(t, rec) != "guest_forbidden" {
+		t.Fatalf("guest invitation = (%d, %q), want (403, guest_forbidden)", rec.Code, errorCode(t, rec))
 	}
 
-	// Accepting an incoming invitation is never blocked, even at the cap: another player invites
-	// the capped human, who accepts over HTTP and the game starts (friend games do not count).
-	inviter := provisionAccount(t)
-	inv := newInvitationService()
-	invitation, err := inv.CreateInvitation(ctx, inviter, []uuid.UUID{human}, englishInvite())
-	if err != nil {
-		t.Fatalf("create invitation: %v", err)
+	// The guest vs_ai cap is 1: one vs_ai game puts the guest at the vs_ai limit.
+	mustCreateKind(t, games, []uuid.UUID{guest, opp}, gamelimits.KindVsAI)
+	if at, err := games.AtGameLimit(ctx, guest, gamelimits.KindVsAI); err != nil || !at {
+		t.Fatalf("guest vs_ai at-limit = (%v, %v), want (true, nil)", at, err)
 	}
-	if rec := userPost(t, srv, "/api/v1/user/invitations/"+invitation.ID.String()+"/accept", human, ""); rec.Code != http.StatusOK {
-		t.Fatalf("accept at limit = %d (%s), want 200 — accept must bypass the cap", rec.Code, rec.Body.String())
+	// The guest friends cap is 0: a guest is always at the friends limit (the 403 gate blocks first).
+	if at, err := games.AtGameLimit(ctx, guest, gamelimits.KindFriends); err != nil || !at {
+		t.Fatalf("guest friends at-limit = (%v, %v), want (true, nil)", at, err)
 	}
 }
 
-// mustCount returns the account's active-quick-game count, failing on error.
-func mustCount(t *testing.T, games *game.Service, id uuid.UUID) int {
-	t.Helper()
-	n, err := games.CountActiveQuickGames(context.Background(), id)
-	if err != nil {
-		t.Fatalf("count active quick games: %v", err)
-	}
-	return n
-}
-
-// mustCreateQuick creates an active quick game (no invitation) seating the given accounts and
-// returns its id; vsAI flags an honest-AI game (the service then applies the 7-day clock).
-func mustCreateQuick(t *testing.T, games *game.Service, seats []uuid.UUID, vsAI bool, seed int64) uuid.UUID {
-	t.Helper()
-	p := game.CreateParams{Variant: engine.VariantEnglish, Seats: seats, TurnTimeout: 24 * time.Hour, Seed: seed}
-	if vsAI {
-		p.VsAI = true
-		p.TurnTimeout = 0 // the service applies the 7-day AI inactivity clock for vs_ai games
-	}
-	g, err := games.Create(context.Background(), p)
-	if err != nil {
-		t.Fatalf("create quick game (vsAI=%v): %v", vsAI, err)
-	}
-	return g.ID
-}
-
-// startFriendGame has a fresh inviter invite the given account to a friend game and the invitee
-// accept it, so the (active) friend game exists with its game_invitations row.
-func startFriendGame(t *testing.T, invitee uuid.UUID) {
-	t.Helper()
+// TestDurableTierHigherLimit checks a durable account resolves the durable tier, not the guest one:
+// one random game leaves it well under the durable cap (10).
+func TestDurableTierHigherLimit(t *testing.T) {
 	ctx := context.Background()
+	gl := newGameLimits(t)
+	games := newGameService()
+	games.SetGameLimits(gl)
+	durable, opp := provisionAccount(t), provisionAccount(t)
+
+	mustCreateKind(t, games, []uuid.UUID{durable, opp}, gamelimits.KindRandom)
+	if at, err := games.AtGameLimit(ctx, durable, gamelimits.KindRandom); err != nil || at {
+		t.Fatalf("durable random at-limit after one game = (%v, %v), want (false, nil)", at, err)
+	}
+}
+
+// TestGuestForbiddenFriendActions checks a guest is refused every friend action server-side (the UI
+// hides them; this is the source of truth): creating an invitation, sending a friend request, and
+// redeeming a friend code.
+func TestGuestForbiddenFriendActions(t *testing.T) {
+	ctx := context.Background()
+	guest := provisionGuest(t)
+	other := provisionAccount(t)
+
 	inv := newInvitationService()
+	if _, err := inv.CreateInvitation(ctx, guest, []uuid.UUID{other}, englishInvite()); !errors.Is(err, lobby.ErrGuestForbidden) {
+		t.Fatalf("guest CreateInvitation err = %v, want ErrGuestForbidden", err)
+	}
+
+	soc := newSocialService()
+	if err := soc.SendFriendRequest(ctx, guest, other); !errors.Is(err, social.ErrGuestForbidden) {
+		t.Fatalf("guest SendFriendRequest err = %v, want ErrGuestForbidden", err)
+	}
+	if _, err := soc.RedeemFriendCode(ctx, guest, "000000"); !errors.Is(err, social.ErrGuestForbidden) {
+		t.Fatalf("guest RedeemFriendCode err = %v, want ErrGuestForbidden", err)
+	}
+}
+
+// TestDurableFriendsCapAndConfigCache lowers the durable friends cap to 1 through the service (the
+// admin-edit path), checks a durable inviter is refused a second friend game with 409, and that
+// accepting an incoming invitation is still exempt from the cap.
+func TestDurableFriendsCapAndConfigCache(t *testing.T) {
+	ctx := context.Background()
+	gl := newGameLimits(t)
+	restoreDefaultLimits(t, gl)
+	cfg := gl.Get()
+	cfg.Durable.Friends = 1
+	if err := gl.Update(ctx, cfg); err != nil {
+		t.Fatalf("update durable friends cap: %v", err)
+	}
+	games := newGameService()
+	games.SetGameLimits(gl)
+	inv := lobby.NewInvitationService(lobby.NewStore(testDB), games, account.NewStore(testDB), newSocialService())
+
 	inviter := provisionAccount(t)
-	invitation, err := inv.CreateInvitation(ctx, inviter, []uuid.UUID{invitee}, englishInvite())
-	if err != nil {
-		t.Fatalf("create invitation: %v", err)
+	d2, d3 := provisionAccount(t), provisionAccount(t)
+
+	// The inviter's first friend game reaches the (lowered) cap of 1.
+	startFriendGameID(t, inv, inviter, d2)
+	if at, err := games.AtGameLimit(ctx, inviter, gamelimits.KindFriends); err != nil || !at {
+		t.Fatalf("inviter friends at-limit = (%v, %v), want (true, nil)", at, err)
 	}
-	if _, err := inv.RespondInvitation(ctx, invitation.ID, invitee, true); err != nil {
-		t.Fatalf("accept invitation: %v", err)
+	// A second invitation is refused: the cache reflects the edit.
+	if _, err := inv.CreateInvitation(ctx, inviter, []uuid.UUID{d3}, englishInvite()); !errors.Is(err, game.ErrGameLimitReached) {
+		t.Fatalf("second invitation err = %v, want ErrGameLimitReached", err)
 	}
+	// Accept stays exempt: someone else invites the capped inviter, who accepts and the game starts.
+	startFriendGameID(t, inv, d3, inviter)
 }
 
 // gamesListAtLimit fetches /api/v1/user/games and returns its at_game_limit flag.