fix(multiplayer): fence recovered allocation tuples

server/allocator/worker.go

@@ -6,6 +6,7 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/cosmic-clash/cosmic-clash/server/agones"
 	"github.com/cosmic-clash/cosmic-clash/server/domain"
 )
 
@@ -49,6 +50,9 @@ func (w Worker) RunOnce(ctx context.Context) (bool, error) {
 				return true, fmt.Errorf("recover provider allocation for match %s: %w", request.MatchID, err)
 			}
 			if found {
+				if err := validateRecoveredAllocation(request, recovered); err != nil {
+					return true, fmt.Errorf("recovered provider allocation for match %s: %w", request.MatchID, err)
+				}
 				if _, err := w.Service.RecordProviderAllocation(ctx, recovered, w.Now()); err != nil {
 					return true, fmt.Errorf("record recovered allocation for match %s: %w", request.MatchID, err)
 				}
@@ -74,6 +78,14 @@ func (w Worker) RunOnce(ctx context.Context) (bool, error) {
 	return true, nil
 }
 
+func validateRecoveredAllocation(request domain.AllocationRequest, result agones.AllocatedServer) error {
+	allocation := result.Allocation
+	if result.Endpoint == "" || allocation.State != domain.ServerAllocated || allocation.AllocationID != request.AllocationID || allocation.MatchID != request.MatchID || allocation.ServerID == "" || allocation.Region != request.Region || allocation.Build != request.Build || allocation.Protocol != request.Protocol || allocation.Transport != request.Transport {
+		return fmt.Errorf("recovered allocation does not match request")
+	}
+	return nil
+}
+
 // AllocationLabels are the compatibility selectors shared with the Fleet
 // template. They are derived only from the durable match plan, never client
 // input or mutable worker configuration.