Limita una diretta attiva per account e valorizza la copertina Premium Full.

Blocca la seconda diretta sullo stesso utente, registra gli abusi in admin e presenta la copertina come grafica caricata dalla società, con demo Team MLTV.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/sessions/assert_user_concurrent.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Sessions
+  class AssertUserConcurrent
+    ERROR_CODE = "user_concurrent_stream"
+
+    def self.with_lock(session, action: "start")
+      new(session, action: action).with_lock { yield }
+    end
+
+    def initialize(session, action: "start")
+      @session = session
+      @action = action.to_s
+    end
+
+    def with_lock
+      occupying = nil
+
+      User.transaction do
+        User.lock.find(@session.user_id) if @session.user_id.present?
+        occupying = occupying_session
+        yield if occupying.nil?
+      end
+
+      return if occupying.nil?
+
+      StreamConcurrencyViolation.record!(
+        attempted: @session,
+        occupying: occupying,
+        action: @action
+      )
+      raise Teams::EntitlementError.new(
+        I18n.t("api.errors.user_concurrent_stream"),
+        code: ERROR_CODE
+      )
+    end
+
+    private
+
+    def occupying_session
+      return if @session.user_id.blank?
+
+      StreamSession.broadcasting
+                   .where(user_id: @session.user_id)
+                   .where.not(id: @session.id)
+                   .includes(:user, match: { team: :club })
+                   .order(Arel.sql("COALESCE(started_at, updated_at) DESC"))
+                   .first
+    end
+  end
+end

backend/app/services/sessions/resume.rb

@@ -10,8 +10,10 @@ module Sessions
       end
 
       cancel_timeout_job
-      # connecting finché RTMP non è online (evita lose_connection da PublisherSync)
-      @session.begin_connect! if @session.may_begin_connect?
+      Sessions::AssertUserConcurrent.with_lock(@session, action: "resume") do
+        # connecting finché RTMP non è online (evita lose_connection da PublisherSync)
+        @session.begin_connect! if @session.may_begin_connect?
+      end
       # Recording riabilitato in PublisherSync quando RTMP è online (evita patch path prima del publisher).
       log_event("resumed")
       SessionChannel.broadcast_message(@session, { type: "command", action: "resume_stream" })

backend/app/services/sessions/start.rb

@@ -5,9 +5,11 @@ module Sessions
     end
 
     def call
-      @session.match.team.entitlements.assert_concurrent_stream!(excluding_session: @session)
-      @session.begin_connect! if @session.may_begin_connect?
-      @session.update!(status: "connecting") unless @session.connecting?
+      Sessions::AssertUserConcurrent.with_lock(@session, action: "start") do
+        @session.match.team.entitlements.assert_concurrent_stream!(excluding_session: @session)
+        @session.begin_connect! if @session.may_begin_connect?
+        @session.update!(status: "connecting") unless @session.connecting?
+      end
       Youtube::LivePipeline.schedule!(@session, force: true) if @session.platform == "youtube"
       broadcast_status("connecting")
       @session