fix: admin undo/redo failure, video poker cabinet ids, room ref behavior

1 files changed, 19 insertions, 0 deletions

diff --git a/internal/admin/api_rooms.go b/internal/admin/api_rooms.go
index 586bfff..76db231 100644
--- a/internal/admin/api_rooms.go
+++ b/internal/admin/api_rooms.go
@@ -1315,6 +1315,25 @@ func (s *AdminServer) handleResolveDuplicate(w http.ResponseWriter, r *http.Requ
 		failJSON(w, "invalid path")
 		return
 	}
+	// Only a real duplicate-ID file may be resolved here. Trusting the client
+	// path would let this endpoint delete a live indexed room with none of the
+	// normal delete semantics (exit cleanup, casino eviction, undo).
+	stem := strings.TrimSuffix(filepath.Base(absPath), ".yaml")
+	isDuplicate := false
+	for _, d := range behavior.CheckDuplicateIDs(roomsDir) {
+		if d.ID != stem {
+			continue
+		}
+		for _, p := range d.Paths {
+			if pa, err := filepath.Abs(p); err == nil && pa == absPath {
+				isDuplicate = true
+			}
+		}
+	}
+	if !isDuplicate {
+		failJSON(w, "path is not a duplicate-ID room file")
+		return
+	}
 
 	switch body.Action {
 	case "delete":