router.post('/move', (request, response) => {
const game = request.game;
const move = request.body.move;
+ const player = game.players[request.session.id];
- const result = game.add_move(move);
+ /* Reject move if there is no player for this session. */
+ if (! player) {
+ response.json({legal: false, message: "No valid player from session"});
+ return;
+ }
+
+ const result = game.add_move(player, move);
/* Feed move response back to the client. */
response.json(result);