Add tournament and multiplayer community chat moderation

tests/tournaments.test.ts

@@ -128,6 +128,43 @@ const manifest = {
   })),
   assets: [{ path: "terrain.json.gz", sha256: "a".repeat(64), bytes: 1 }],
 };
+test("community and chat derive the actor from the signed-in account and reject forged fields", async () => {
+  const guest = fixture({ signedIn: false });
+  await assert.rejects(guest.run(`tournaments/${tournament}/chat`), /Sign in/);
+  const f = fixture();
+  await assert.rejects(
+    f.run(`tournaments/${tournament}/community`, "POST", {
+      action: "admin",
+      accountId: map,
+      actor: map,
+    }),
+  );
+  await assert.rejects(
+    f.run(`tournaments/${tournament}/chat`, "POST", {
+      clientId: room,
+      text: "hello",
+      accountId: map,
+    }),
+  );
+  f.reply("tournament_community", { moderator: true });
+  await f.run(`tournaments/${tournament}/community`, "POST", {
+    action: "ban",
+    accountId: map,
+  });
+  assert.equal(
+    (f.calls.at(-1)?.args[0] as { p_account: string }).p_account,
+    member,
+  );
+  f.reply("tournament_chat", { messages: [] });
+  await f.run(`tournaments/${tournament}/chat`, "POST", {
+    clientId: room,
+    text: "hello",
+  });
+  assert.equal(
+    (f.calls.at(-1)?.args[0] as { p_account: string }).p_account,
+    member,
+  );
+});
 function mediaReplies(f: ReturnType<typeof fixture>, view = playingView()) {
   f.reply("tournament_action", view);
   f.reply("multiplayer_rooms", { revision_id: revision });