fix(game): allow participants to view watch states after game finishes

Previously GetWatchLatestStates returned ErrForbidden for participants
regardless of game state. Now checks whether the game has finished and
permits access once complete. Also fixes config test env var cleanup.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

1 files changed, 112 insertions, 0 deletions

diff --git a/backend/game/service_test.go b/backend/game/service_test.go
index 95ceef6..93e62f7 100644
--- a/backend/game/service_test.go
+++ b/backend/game/service_test.go
@@ -1,12 +1,31 @@
 package game
 
 import (
+	"context"
 	"testing"
 	"time"
 
 	"github.com/jackc/pgx/v5/pgtype"
+
+	"albatross-2026-backend/db"
 )
 
+// stubQuerier implements db.Querier with only the methods needed for tests.
+// All unimplemented methods panic so missing stubs are caught immediately.
+type stubQuerier struct {
+	db.Querier
+	getGameByID                  func(ctx context.Context, gameID int32) (db.GetGameByIDRow, error)
+	getLatestStatesOfMainPlayers func(ctx context.Context, gameID int32) ([]db.GetLatestStatesOfMainPlayersRow, error)
+}
+
+func (s *stubQuerier) GetGameByID(ctx context.Context, gameID int32) (db.GetGameByIDRow, error) {
+	return s.getGameByID(ctx, gameID)
+}
+
+func (s *stubQuerier) GetLatestStatesOfMainPlayers(ctx context.Context, gameID int32) ([]db.GetLatestStatesOfMainPlayersRow, error) {
+	return s.getLatestStatesOfMainPlayers(ctx, gameID)
+}
+
 func TestIsGameRunning(t *testing.T) {
 	now := time.Now()
 	tests := []struct {
@@ -80,3 +99,96 @@ func TestIsGameFinished(t *testing.T) {
 		})
 	}
 }
+
+func TestGetWatchLatestStates_ParticipantRestriction(t *testing.T) {
+	now := time.Now()
+	var playerID int32 = 1
+	var otherID int32 = 2
+
+	code := "<?php echo 1;"
+	status := "pass"
+	var codeSize int32 = 14
+
+	mainPlayerRows := []db.GetLatestStatesOfMainPlayersRow{
+		{
+			GameID:   1,
+			UserID:   playerID,
+			Code:     &code,
+			Status:   &status,
+			CodeSize: &codeSize,
+		},
+		{
+			GameID:   1,
+			UserID:   otherID,
+			Code:     &code,
+			Status:   &status,
+			CodeSize: &codeSize,
+		},
+	}
+
+	tests := []struct {
+		name      string
+		startedAt pgtype.Timestamp
+		userID    *int32
+		isAdmin   bool
+		wantErr   error
+	}{
+		{
+			name:      "participant blocked while game is running",
+			startedAt: pgtype.Timestamp{Time: now.Add(-1 * time.Minute), Valid: true},
+			userID:    &playerID,
+			isAdmin:   false,
+			wantErr:   ErrForbidden,
+		},
+		{
+			name:      "participant allowed after game finished",
+			startedAt: pgtype.Timestamp{Time: now.Add(-10 * time.Minute), Valid: true},
+			userID:    &playerID,
+			isAdmin:   false,
+			wantErr:   nil,
+		},
+		{
+			name:      "participant blocked before game starts",
+			startedAt: pgtype.Timestamp{Valid: false},
+			userID:    &playerID,
+			isAdmin:   false,
+			wantErr:   ErrForbidden,
+		},
+		{
+			name:      "admin always allowed even while running",
+			startedAt: pgtype.Timestamp{Time: now.Add(-1 * time.Minute), Valid: true},
+			userID:    &playerID,
+			isAdmin:   true,
+			wantErr:   nil,
+		},
+		{
+			name:      "non-participant allowed while running",
+			startedAt: pgtype.Timestamp{Time: now.Add(-1 * time.Minute), Valid: true},
+			userID:    nil,
+			isAdmin:   false,
+			wantErr:   nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			q := &stubQuerier{
+				getGameByID: func(_ context.Context, _ int32) (db.GetGameByIDRow, error) {
+					return db.GetGameByIDRow{
+						StartedAt:       tt.startedAt,
+						DurationSeconds: 300,
+					}, nil
+				},
+				getLatestStatesOfMainPlayers: func(_ context.Context, _ int32) ([]db.GetLatestStatesOfMainPlayersRow, error) {
+					return mainPlayerRows, nil
+				},
+			}
+			svc := NewService(q, nil, nil)
+
+			_, err := svc.GetWatchLatestStates(context.Background(), 1, tt.userID, tt.isAdmin)
+			if err != tt.wantErr {
+				t.Errorf("got err=%v, want %v", err, tt.wantErr)
+			}
+		})
+	}
+}