Fix auth hook so it returns forbidden if the user is authenticated but not allowed to hit an endpoint.

src/lib/server/test/GameData.spec.ts

@@ -0,0 +1,53 @@
+import { describe, it } from "vitest";
+import { type GameData, isGameData } from "$lib/GameData";
+import { equal, ok } from "node:assert/strict";
+import { createId, idFromString, stringFromId } from "$lib/Id";
+
+describe("GameData", () => {
+	const idString = stringFromId(createId());
+
+	describe("isGameData", () => {
+		it("rejects a malformed object", () => {
+			let data: unknown = {
+				players: [idFromString(idString), idString],
+				isStarted: false,
+				state: {},
+			};
+			equal(isGameData(data), false);
+
+			data = {
+				players: [idFromString(idString)],
+				isStarted: null,
+				state: {},
+			};
+			equal(isGameData(data), false);
+
+			data = {
+				players: [idFromString(idString)],
+				isStarted: false,
+			};
+			equal(isGameData(data), false);
+		});
+
+		it("rejects an object with extra properties", () => {
+			const data: GameData & { extra: boolean } = {
+				players: [idFromString(idString)],
+				isStarted: false,
+				state: {},
+				extra: true,
+			};
+
+			equal(isGameData(data), false);
+		});
+
+		it("should accept a proper GameData object", () => {
+			const data: GameData = {
+				players: [idFromString(idString)],
+				state: {},
+				isStarted: false,
+			};
+
+			ok(isGameData(data));
+		});
+	});
+});