fix(multiplayer): honor assigned team and slot

Game/scripts/match_net.gd

@@ -39,6 +39,7 @@ class PlayerInfo:
 	var player_name: String
 	var player_identity: String
 	var team: int = 0
+	var spawn_index: int = -1
 	var ready: bool = false
 
 	func _init(p_peer_id: int, p_player_name: String, p_team: int = 0, p_ready: bool = false, p_player_identity: String = "") -> void:
@@ -119,6 +120,21 @@ func configure_join_authorisations(tokens: Array, context: Dictionary, signing_k
 	return true
 
 
+func assigned_player_slots() -> Array:
+	var result: Array = []
+	for token in _allowed_join_authorisations.keys():
+		var claims := _join_claims(String(token))
+		if claims.is_empty():
+			continue
+		result.append({
+			"player_identity": str(claims.get("PlayerID", "")),
+			"team": int(claims.get("Team", -1)),
+			"slot": int(claims.get("Slot", -1)),
+		})
+	result.sort_custom(func(a: Dictionary, b: Dictionary) -> bool: return int(a["slot"]) < int(b["slot"]))
+	return result
+
+
 func player_identity(peer_id: int) -> String:
 	if not roster.has(peer_id):
 		return ""
@@ -248,7 +264,19 @@ func _hello(protocol_version: int, tick_hz: int, player_name: String, supplied_j
 		_player_joined.rpc_id(peer_id, existing_id, existing.player_name, existing.team, existing.ready)
 
 	var team := _pick_balanced_team()
-	roster[peer_id] = PlayerInfo.new(peer_id, clean_name, team, false, identity)
+	var spawn_index := -1
+	if require_join_authorisation:
+		var claims := _join_claims(supplied_join_authorisation)
+		var assigned_slot := int(claims.get("Slot", -1))
+		var assigned_team := int(claims.get("Team", -1))
+		if assigned_slot < 0 or assigned_slot > 5 or assigned_team < 0 or assigned_team >= TEAM_COUNT or assigned_slot / 3 != assigned_team:
+			await _reject(peer_id, "join authorisation rejected")
+			return
+		team = assigned_team
+		spawn_index = assigned_slot % 3
+	var info := PlayerInfo.new(peer_id, clean_name, team, false, identity)
+	info.spawn_index = spawn_index
+	roster[peer_id] = info
 	if require_join_authorisation:
 		# _reserve_join_authorisation already owns the active peer reservation;
 		# keeping the generation in the history makes fencing auditable without
@@ -276,6 +304,10 @@ func _valid_join_authorisation(token: String) -> bool:
 		return false
 	if str(claims.get("PlayerID", "")).is_empty():
 		return false
+	var claimed_team := int(claims.get("Team", -1))
+	var claimed_slot := int(claims.get("Slot", -1))
+	if claimed_team < 0 or claimed_team >= TEAM_COUNT or claimed_slot < 0 or claimed_slot > 5 or claimed_slot / 3 != claimed_team:
+		return false
 	var protocol := str(claims.get("Protocol", ""))
 	var expires_at := str(claims.get("ExpiresAt", ""))
 	var expiry := Time.get_unix_time_from_datetime_string(expires_at)
@@ -322,6 +354,21 @@ func _join_identity(token: String) -> String:
 	return str(envelope["Authorisation"].get("PlayerID", ""))
 
 
+func _join_claims(token: String) -> Dictionary:
+	if token.is_empty():
+		return {}
+	var standard_token := token.replace("-", "+").replace("_", "/")
+	while standard_token.length() % 4 != 0:
+		standard_token += "="
+	var decoded := Marshalls.base64_to_raw(standard_token)
+	if decoded.is_empty():
+		return {}
+	var envelope = JSON.parse_string(decoded.get_string_from_utf8())
+	if not envelope is Dictionary or not envelope.has("Authorisation") or not envelope["Authorisation"] is Dictionary:
+		return {}
+	return envelope["Authorisation"]
+
+
 func is_join_authorisation_active(token: String) -> bool:
 	return not token.is_empty() and _active_join_peers.has(token)
 

Game/scripts/networked_match.gd

@@ -455,8 +455,9 @@ func _start_server() -> void:
 	sorted_peer_ids.sort()
 	for peer_id in sorted_peer_ids:
 		var info: MatchNet.PlayerInfo = MatchNet.roster[peer_id]
-		var spawn_index: int = team_counts.get(info.team, 0)
-		team_counts[info.team] = spawn_index + 1
+		var spawn_index: int = info.spawn_index if info.spawn_index >= 0 else team_counts.get(info.team, 0)
+		if info.spawn_index < 0:
+			team_counts[info.team] = spawn_index + 1
 		var slot := SlotInfo.new()
 		slot.peer_id = peer_id
 		slot.team = info.team