feat: add ban policy to ticket verification

server/domain/auth.go

@@ -26,6 +26,7 @@ type TicketVerifier struct {
 	mu          sync.Mutex
 	expectedApp uint64
 	consumed    map[string]time.Time
+	banned      map[string]bool
 }
 
 type AuthAttemptState string
@@ -159,7 +160,21 @@ func NewTicketVerifier(expectedApp uint64) (*TicketVerifier, error) {
 	if expectedApp == 0 {
 		return nil, ErrTicketRejected
 	}
-	return &TicketVerifier{expectedApp: expectedApp, consumed: make(map[string]time.Time)}, nil
+	return &TicketVerifier{expectedApp: expectedApp, consumed: make(map[string]time.Time), banned: make(map[string]bool)}, nil
+}
+
+func (v *TicketVerifier) SetBanned(playerID string, banned bool) error {
+	if v == nil || playerID == "" {
+		return ErrTicketRejected
+	}
+	v.mu.Lock()
+	defer v.mu.Unlock()
+	if banned {
+		v.banned[playerID] = true
+	} else {
+		delete(v.banned, playerID)
+	}
+	return nil
 }
 
 // Verify consumes a backend-validated ticket exactly once. In production the
@@ -175,7 +190,7 @@ func (v *TicketVerifier) Verify(ticket SteamTicket, resolve func(string) (string
 		return VerifiedIdentity{}, ErrTicketRejected
 	}
 	playerID, ok := resolve(ticket.SteamID)
-	if !ok || playerID == "" {
+	if !ok || playerID == "" || v.banned[playerID] {
 		return VerifiedIdentity{}, ErrTicketRejected
 	}
 	v.consumed[ticket.TicketID] = now