From 4edbfb16eee0a42198941a70f7dc235fe5b17c2d Mon Sep 17 00:00:00 2001
From: Frank Tovar <mail@franktovar.de>
Date: Wed, 4 Feb 2026 23:17:47 +0100
Subject: [PATCH] Block voting when finalized; disable sliders client-side

---
 Endpoints/VoteEndpoints.cs | 2 ++
 wwwroot/js/ui.js           | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/Endpoints/VoteEndpoints.cs b/Endpoints/VoteEndpoints.cs
index 6ae1f34..c1a9b5d 100644
--- a/Endpoints/VoteEndpoints.cs
+++ b/Endpoints/VoteEndpoints.cs
@@ -32,6 +32,8 @@ public static class VoteEndpoints
 
             var player = await EndpointHelpers.GetAuthenticatedPlayer(ctx, db);
             if (player is null) return Results.Unauthorized();
+            if (player.VotesFinal)
+                return Results.BadRequest(new { error = "Votes are finalized. Unfinalize before changing scores." });
             var phase = await EndpointHelpers.GetPhase(db, player.Id);
             if (phase != Phase.Vote)
                 return EndpointHelpers.PhaseMismatch(Phase.Vote, phase);
diff --git a/wwwroot/js/ui.js b/wwwroot/js/ui.js
index 4c5ce1d..83ee8dc 100644
--- a/wwwroot/js/ui.js
+++ b/wwwroot/js/ui.js
@@ -152,7 +152,7 @@ export function renderVotes() {
         footer.innerHTML = `
       <div class="warning-text ${hasVote ? "hidden" : ""}" id="warn-${s.id}">${t("vote.missingWarn")}</div>
       <div class="vote-row">
-        <input class="full-slider" type="range" min="0" max="10" value="${current}" data-id="${s.id}">
+        <input class="full-slider" type="range" min="0" max="10" value="${current}" data-id="${s.id}" ${state.votesFinal ? "disabled" : ""}>
         <span class="score" id="score-${s.id}">${displayScore}</span>
         <span class="score-emoji" id="emoji-${s.id}">${displayEmoji}</span>
       </div>`;
@@ -161,6 +161,7 @@ export function renderVotes() {
     });
     list.querySelectorAll("input[type=range]").forEach((input) => {
         input.addEventListener("input", (e) => {
+            if (state.votesFinal) return;
             const val = Number(e.target.value);
             $("score-" + e.target.dataset.id).textContent = val;
             const emojiEl = $("emoji-" + e.target.dataset.id);
@@ -169,6 +170,7 @@ export function renderVotes() {
             if (warn) warn.classList.add("hidden");
         });
         input.addEventListener("change", async (e) => {
+            if (state.votesFinal) return;
             const suggestionId = Number(e.target.dataset.id);
             const score = Number(e.target.value);
             try {