fix(websocket): prevent debater race condition

backend/websocket/websocket.go

@@ -144,6 +144,27 @@ func countDebaters(room *Room) int {
 	return count
 }
 
+// tryAddClient atomically checks the debater limit and adds the client to the room.
+func tryAddClient(room *Room, conn *websocket.Conn, client *Client) bool {
+	room.Mutex.Lock()
+	defer room.Mutex.Unlock()
+
+	if !client.IsSpectator {
+		currentDebaters := 0
+		for _, existing := range room.Clients {
+			if !existing.IsSpectator {
+				currentDebaters++
+			}
+		}
+
+		if currentDebaters >= 2 {
+			return false
+		}
+	}
+
+	room.Clients[conn] = client
+	return true
+}
 func countSpectators(room *Room) int {
 	room.Mutex.Lock()
 	defer room.Mutex.Unlock()
@@ -283,24 +304,9 @@ func WebsocketHandler(c *gin.Context) {
 		return
 	}
 
-	// Check if this is a spectator connection (they want to receive video streams)
-	// Allow spectators to connect even if room has 2 debaters
+	// Check if this is a spectator connection.
+	// Spectators are allowed to connect even if the room has 2 debaters.
 	isSpectator := strings.EqualFold(c.Query("spectator"), "true")
-	room.Mutex.Lock()
-	currentDebaters := 0
-	for _, existing := range room.Clients {
-		if !existing.IsSpectator {
-			currentDebaters++
-		}
-	}
-	maxDebaters := 2
-	if !isSpectator && currentDebaters >= maxDebaters {
-		room.Mutex.Unlock()
-		log.Printf("[ws] rejecting debater %s for room %s: already full", email, roomID)
-		conn.Close()
-		return
-	}
-	room.Mutex.Unlock()
 
 	if avatarURL == "" {
 		avatarURL = "https://api.dicebear.com/9.x/big-ears/svg?seed=Nolan"
@@ -335,17 +341,19 @@ func WebsocketHandler(c *gin.Context) {
 	// Mark as spectator if needed (we can add a field to Client struct for this)
 	// For now, we'll handle it through the message handlers
 
-	// Send current participants to the new client
-	room.Mutex.Lock()
-	room.Clients[conn] = client
-	room.Mutex.Unlock()
+	// Atomically check the debater limit and register the client.
+	if !tryAddClient(room, conn, client) {
+		log.Printf("[ws] rejecting debater %s for room %s: already full", email, roomID)
+		conn.Close()
+		return
+	}
 
 	// Send participants list to newly connected client
 	participantsMsg := buildParticipantsMessage(room)
 	client.SafeWriteJSON(participantsMsg)
 
 	// Send existing participants' detailed info to the new client
-	for connRef, existing := range room.Clients {
+	for _, existing := range snapshotRecipients(room, nil) {
 		payload := map[string]interface{}{
 			"id":          existing.UserID,
 			"username":    existing.Username,
@@ -354,18 +362,13 @@ func WebsocketHandler(c *gin.Context) {
 			"avatarUrl":   existing.AvatarURL,
 			"elo":         existing.Elo,
 		}
+
 		detailMessage := map[string]interface{}{
 			"type":        "userDetails",
 			"userDetails": payload,
 		}
 
-		if connRef == conn {
-			// Already sent this client's participant data; ensure they have their own detail payload too
-			client.SafeWriteJSON(detailMessage)
-		} else {
-			// Send existing participant info to the new client
-			client.SafeWriteJSON(detailMessage)
-		}
+		client.SafeWriteJSON(detailMessage)
 	}
 
 	// Prepare detailed payload for the new client to broadcast to others

backend/websocket/websocket_test.go

@@ -1,6 +1,7 @@
 package websocket
 
 import (
+	"sync"
 	"testing"
 
 	gorilla "github.com/gorilla/websocket"
@@ -37,3 +38,54 @@ func TestBuildParticipantsMessageIncludesRecoverableRoomState(t *testing.T) {
 		t.Fatalf("expected role=for, got %#v", participant["role"])
 	}
 }
+
+// TestTryAddClientDoesNotExceedDebaterLimit verifies that concurrent debater
+// join attempts cannot exceed the room's two-debater limit.
+func TestTryAddClientDoesNotExceedDebaterLimit(t *testing.T) {
+	room := &Room{
+		Clients: make(map[*gorilla.Conn]*Client),
+	}
+
+	// Start with one debater already in the room.
+	existingConn := &gorilla.Conn{}
+	room.Clients[existingConn] = &Client{
+		Conn:        existingConn,
+		IsSpectator: false,
+	}
+
+	const attempts = 100
+
+	var wg sync.WaitGroup
+	var accepted int
+	var acceptedMutex sync.Mutex
+
+	for i := 0; i < attempts; i++ {
+		wg.Add(1)
+
+		go func() {
+			defer wg.Done()
+
+			conn := &gorilla.Conn{}
+			client := &Client{
+				Conn:        conn,
+				IsSpectator: false,
+			}
+
+			if tryAddClient(room, conn, client) {
+				acceptedMutex.Lock()
+				accepted++
+				acceptedMutex.Unlock()
+			}
+		}()
+	}
+
+	wg.Wait()
+
+	if accepted != 1 {
+		t.Fatalf("expected exactly one additional debater to be accepted, got %d", accepted)
+	}
+
+	if countDebaters(room) != 2 {
+		t.Fatalf("expected room to contain exactly 2 debaters, got %d", countDebaters(room))
+	}
+}