feat: gate allocation on accepted proposals

server/allocator/service.go

@@ -29,6 +29,36 @@ type Service struct {
 	Now      func() time.Time
 }
 
+// AllocateAcceptedProposal is the hand-off from proposal consensus to server
+// allocation. Keeping this check beside the provider call prevents a caller
+// from allocating capacity for an OPEN/DECLINED proposal or for a request
+// whose playlist does not match the proposal that produced it.
+func (s Service) AllocateAcceptedProposal(ctx context.Context, proposal domain.Proposal, request domain.AllocationRequest, playlist domain.Playlist, labels map[string]string) (agones.AllocatedServer, error) {
+	if proposal.State != domain.Accepted || proposal.Playlist != playlist || len(proposal.Participants) == 0 {
+		return agones.AllocatedServer{}, domain.ErrAllocationInput
+	}
+	if proposal.Playlist == domain.Ranked && len(proposal.Participants) != 6 {
+		return agones.AllocatedServer{}, domain.ErrAllocationInput
+	}
+	if proposal.Playlist == domain.Casual && (len(proposal.Participants) < 2 || len(proposal.Participants) > 6) {
+		return agones.AllocatedServer{}, domain.ErrAllocationInput
+	}
+	seen := make(map[string]struct{}, len(proposal.Participants))
+	for _, participant := range proposal.Participants {
+		if participant.PlayerID == "" || participant.Response != domain.AcceptedResponse {
+			return agones.AllocatedServer{}, domain.ErrAllocationInput
+		}
+		if _, exists := seen[participant.PlayerID]; exists {
+			return agones.AllocatedServer{}, domain.ErrAllocationInput
+		}
+		seen[participant.PlayerID] = struct{}{}
+	}
+	if request.MatchID == "" {
+		return agones.AllocatedServer{}, domain.ErrAllocationInput
+	}
+	return s.Allocate(ctx, request, labels)
+}
+
 func (s Service) PublishRoster(ctx context.Context, assignment domain.Assignment, roster []domain.SignedJoinAuthorisation, verify func([]byte, []byte) bool) error {
 	if s.Roster == nil {
 		return errNotConfigured