From 92c93b0a58e92787985c2fdd562ed587cde8289e Mon Sep 17 00:00:00 2001
From: Devin Zuczek <devin.zuczek@gmail.com>
Date: Tue, 13 Oct 2026 09:44:14 -0400
Subject: [PATCH] [match] 2026 verifylock endpoint

---
 apps/match/src/match.app.ts                 | 17 +++++++++++++++++
 apps/match/src/test/integration/api.test.ts |  6 ++++++
 2 files changed, 23 insertions(+)

diff --git a/apps/match/src/match.app.ts b/apps/match/src/match.app.ts
index a8e69ea..06dbc2a 100644
--- a/apps/match/src/match.app.ts
+++ b/apps/match/src/match.app.ts
@@ -1889,6 +1889,23 @@ const app = new Hono<App>()
 		(c) => c.json({ errorCode: 0 })
 	)
 
+	// The client asks whether its `LoginLock` still holds the session. Nothing enforces the
+	// lock yet (see exclusivelogin), so every lock verifies: a bare 200, no body.
+	.post(
+		'/player/verifylock',
+		describeRoute({
+			tags: ['Presence'],
+			summary: 'Verify the session login lock (no-op)',
+			description: [
+				'Asks whether the session `LoginLock` is still the live one. Login locking is not',
+				'enforced, so this always acks. Empty ack — there is no response shape.',
+			].join(' '),
+			requestBody: form(LoginLockRequest, 'The session LoginLock GUID'),
+			responses: { 200: EMPTY_OK },
+		}),
+		(c) => c.body(null, 200)
+	)
+
 	// Logout clears the player's presence so they read offline immediately and the
 	// instance they were in frees up (rather than waiting out the presence TTL).
 	//
diff --git a/apps/match/src/test/integration/api.test.ts b/apps/match/src/test/integration/api.test.ts
index 7aac313..13fd08a 100644
--- a/apps/match/src/test/integration/api.test.ts
+++ b/apps/match/src/test/integration/api.test.ts
@@ -342,6 +342,12 @@ describe('public endpoints', () => {
 		expect(await res.json()).toEqual({ errorCode: 0 })
 	})
 
+	test('POST /player/verifylock returns 200 with no body', async () => {
+		const res = await exports.default.fetch(`${ORIGIN}/player/verifylock`, { method: 'POST' })
+		expect(res.status).toBe(200)
+		expect(await res.text()).toBe('')
+	})
+
 	test('POST /player/notifydisconnect returns 200', async () => {
 		const res = await exports.default.fetch(`${ORIGIN}/player/notifydisconnect`, {
 			method: 'POST',