fix: bind queue candidates to their owner

server/domain/queue.go

@@ -62,7 +62,7 @@ func (q *Queue) Create(playerID, ticketID, idempotencyKey string, candidate Cand
 		}
 		return prior.ticket, nil
 	}
-	if idempotencyKey == "" || playerID == "" || ticketID == "" || candidate.TicketID != ticketID {
+	if idempotencyKey == "" || playerID == "" || ticketID == "" || candidate.TicketID != ticketID || candidate.PlayerID != playerID {
 		return QueueTicket{}, fmt.Errorf("%w: invalid queue create", ErrConflict)
 	}
 	if _, ok := q.byPlayer[playerID]; ok {

server/domain/queue_test.go

@@ -79,6 +79,20 @@ func TestQueueCreateIdempotencyIncludesCandidatePayload(t *testing.T) {
 	}
 }
 
+func TestQueueCreateRejectsCandidateOwnedByAnotherPlayer(t *testing.T) {
+	q := NewQueue()
+	now := time.Unix(1000, 0)
+	_, err := q.Create("player-a", "ticket-a", "create-key-123456", Candidate{
+		TicketID: "ticket-a", PlayerID: "player-b", EnqueuedAt: now,
+	}, now)
+	if !errors.Is(err, ErrConflict) {
+		t.Fatalf("mismatched candidate owner error = %v", err)
+	}
+	if got := q.Candidates(now); len(got) != 0 {
+		t.Fatalf("mismatched candidate was stored: %+v", got)
+	}
+}
+
 func TestQueueConcurrentCreateKeepsOneActiveTicketPerPlayer(t *testing.T) {
 	q := NewQueue()
 	now := time.Unix(1000, 0)