feat: add ban policy to ticket verification

server/domain/auth.go

@@ -26,6 +26,7 @@ type TicketVerifier struct {
 	mu          sync.Mutex
 	expectedApp uint64
 	consumed    map[string]time.Time
+	banned      map[string]bool
 }
 
 type AuthAttemptState string
@@ -159,7 +160,21 @@ func NewTicketVerifier(expectedApp uint64) (*TicketVerifier, error) {
 	if expectedApp == 0 {
 		return nil, ErrTicketRejected
 	}
-	return &TicketVerifier{expectedApp: expectedApp, consumed: make(map[string]time.Time)}, nil
+	return &TicketVerifier{expectedApp: expectedApp, consumed: make(map[string]time.Time), banned: make(map[string]bool)}, nil
+}
+
+func (v *TicketVerifier) SetBanned(playerID string, banned bool) error {
+	if v == nil || playerID == "" {
+		return ErrTicketRejected
+	}
+	v.mu.Lock()
+	defer v.mu.Unlock()
+	if banned {
+		v.banned[playerID] = true
+	} else {
+		delete(v.banned, playerID)
+	}
+	return nil
 }
 
 // Verify consumes a backend-validated ticket exactly once. In production the
@@ -175,7 +190,7 @@ func (v *TicketVerifier) Verify(ticket SteamTicket, resolve func(string) (string
 		return VerifiedIdentity{}, ErrTicketRejected
 	}
 	playerID, ok := resolve(ticket.SteamID)
-	if !ok || playerID == "" {
+	if !ok || playerID == "" || v.banned[playerID] {
 		return VerifiedIdentity{}, ErrTicketRejected
 	}
 	v.consumed[ticket.TicketID] = now

server/domain/auth_test.go

@@ -38,6 +38,25 @@ func TestTicketVerifierBindsAppIdentityExpiryAndSingleUse(t *testing.T) {
 	}
 }
 
+func TestTicketVerifierRejectsBannedIdentityBeforeConsumption(t *testing.T) {
+	now := time.Unix(1000, 0)
+	verifier, _ := NewTicketVerifier(480)
+	if err := verifier.SetBanned("player-1", true); err != nil {
+		t.Fatal(err)
+	}
+	ticket := SteamTicket{TicketID: "ticket-1", SteamID: "steam-1", AppID: 480, ExpiresAt: now.Add(time.Minute)}
+	resolve := func(string) (string, bool) { return "player-1", true }
+	if _, err := verifier.Verify(ticket, resolve, now); !errors.Is(err, ErrTicketRejected) {
+		t.Fatalf("banned ticket accepted: %v", err)
+	}
+	if err := verifier.SetBanned("player-1", false); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := verifier.Verify(ticket, resolve, now); err != nil {
+		t.Fatalf("unbanned ticket remained consumed: %v", err)
+	}
+}
+
 func TestSessionIsOpaqueShortLivedAndRevocable(t *testing.T) {
 	now := time.Unix(1000, 0)
 	store := NewSessionStore()