feat(core): harden sessions settlement and credit activity

tests/Feature/PlayerNativeAuthTest.php

@@ -10,8 +10,10 @@ use Illuminate\Support\Facades\DB;
 use Database\Seeders\CurrencySeeder;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Event;
 use Database\Seeders\LotterySettingsSeeder;
 use Illuminate\Support\Facades\RateLimiter;
+use App\Events\PlayerSessionReplacedBroadcast;
 use App\Services\Player\PlayerNativeAuthService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 
@@ -244,6 +246,63 @@ test('native player can login and access me', function (): void {
         ->assertJsonPath('data.auth_source', PlayerAuthSource::LOTTERY_NATIVE);
 });
 
+test('latest native login replaces the previous device session', function (): void {
+    Event::fake([PlayerSessionReplacedBroadcast::class]);
+
+    $site = DB::table('admin_sites')->where('is_default', true)->first();
+    $rootId = (int) DB::table('agent_nodes')->where('depth', 0)->value('id');
+
+    $player = Player::query()->create([
+        'site_code' => (string) $site->code,
+        'agent_node_id' => $rootId,
+        'site_player_id' => 'native:single-session',
+        'auth_source' => PlayerAuthSource::LOTTERY_NATIVE,
+        'funding_mode' => PlayerFundingMode::CREDIT,
+        'username' => 'single_session_player',
+        'password_hash' => Hash::make('secret-pass'),
+        'nickname' => null,
+        'default_currency' => 'NPR',
+        'status' => 0,
+    ]);
+
+    $firstLogin = $this->postJson('/api/v1/player/auth/login', array_merge([
+        'username' => 'single_session_player',
+        'password' => 'secret-pass',
+    ], playerLoginCaptcha()))->assertOk();
+    $firstToken = (string) $firstLogin->json('data.access_token');
+
+    expect($player->fresh()->native_session_version)->toBe(1);
+    $this->withHeader('Authorization', 'Bearer '.$firstToken)
+        ->getJson('/api/v1/player/me')
+        ->assertOk();
+
+    $secondLogin = $this->postJson('/api/v1/player/auth/login', array_merge([
+        'username' => 'single_session_player',
+        'password' => 'secret-pass',
+    ], playerLoginCaptcha()))->assertOk();
+    $secondToken = (string) $secondLogin->json('data.access_token');
+
+    expect($secondToken)->not->toBe($firstToken)
+        ->and($player->fresh()->native_session_version)->toBe(2);
+
+    $this->withHeader('Authorization', 'Bearer '.$firstToken)
+        ->getJson('/api/v1/player/me')
+        ->assertStatus(401)
+        ->assertJsonPath('code', ErrorCode::PlayerSessionReplaced->value);
+
+    $this->withHeader('Authorization', 'Bearer '.$secondToken)
+        ->getJson('/api/v1/player/me')
+        ->assertOk()
+        ->assertJsonPath('data.id', $player->id);
+
+    Event::assertDispatchedTimes(PlayerSessionReplacedBroadcast::class, 2);
+    Event::assertDispatched(
+        PlayerSessionReplacedBroadcast::class,
+        fn (PlayerSessionReplacedBroadcast $event): bool => $event->playerId === (int) $player->id
+            && $event->sessionVersion === 2,
+    );
+});
+
 test('credit player wallet transfer in is rejected', function (): void {
     $site = DB::table('admin_sites')->where('is_default', true)->first();
     $rootId = (int) DB::table('agent_nodes')->where('depth', 0)->value('id');