server-side move validation improvements

server/src/socket/game.socket.ts

@@ -87,7 +87,17 @@ export async function sendMove(this: Socket, m: { from: string; to: string; prom
     if (game.pgn) {
         chess.loadPgn(game.pgn);
     }
+
+    try {
         const prevTurn = chess.turn();
+
+        if (
+            (prevTurn === "b" && this.request.session.id !== game.black?.id) ||
+            (prevTurn === "w" && this.request.session.id !== game.white?.id)
+        ) {
+            throw new Error("not turn to move");
+        }
+
         const newMove = chess.move(m);
         if (chess.isGameOver()) {
             let reason = "";
@@ -112,11 +122,15 @@ export async function sendMove(this: Socket, m: { from: string; to: string; prom
             }
             io.to(game.code as string).emit("gameOver", { reason, winnerName, winnerSide });
         }
-    if (newMove === null) {
+        if (newMove) {
-        this.emit("receivedLatestGame", game);
-    } else {
             game.pgn = chess.pgn();
             this.to(game.code as string).emit("receivedMove", m);
+        } else {
+            throw new Error("invalid move");
+        }
+    } catch (e) {
+        console.log("sendMove error: " + e);
+        this.emit("receivedLatestGame", game);
     }
 }