Pick'n'Play — Product Spec (current)

Goal

Help a small Discord group (4–8 players) pick a co-op game via phased flow:

Single shared instance
Username/password login (cookie auth)
Admins flagged via admin key at registration
Logout returns to the login form and clears all auth form fields
Destructive admin actions (player delete, reset, factory reset) require admin password confirmation
Per-user phase tracking; admins can move themselves backward, everyone can move forward (subject to admin “results open” toggle and Suggest→Vote requiring at least one own suggestion)

Up to 5 suggestions per player
Name required; optional genre, description, screenshot URL, YouTube URL, external game link, min/max players
Players see only their own suggestions until voting
A player can enter Vote only after submitting at least one own suggestion
The Suggest phase shows a non-interactive “add a game first” hint until the first successful suggestion, then immediately shows the Next button
Screenshots validated as reachable images

All suggestions visible with authors
Score each suggestion 0–10
Players see only their own votes; can finalize/unfinalize their ballot
Linked games: admins can link duplicates; linked games share a vote group. Moving a slider on one updates all linked siblings.
Linking or unlinking games clears votes for the linked group and unfinalizes all players so ballots can be reviewed again
Admin status controls can move a player from Vote back to Suggest for exceptional cases
The “new/linked games” vote popup appears only when the vote list changes after the player has already seen that vote list

Visible only after admin enables results; players auto-advance when opened
Admin controls results availability with a single toggle button whose label reflects enabled/disabled state
Leaderboard sorted by average score; shows totals, counts, player’s own vote, and links/media
Average score and score emojis expose the same tooltip showing the game's voters in alphabetical order
When results are closed again, only accounts with at least one suggestion return to Vote; accounts without suggestions return to Suggest

Desktop + mobile friendly
Runs on IIS; SQLite via EF Core
Browser security baseline: strict CSP (no inline styles, no insecure image origins) and same-origin protection for authenticated mutating API requests