SP4: Server-derived member_id for SyncPlay group operations

[detain]

Summary

Implements SP4 specification requirement that member_id is server-derived from the authenticated connection's userId, not from the client wire payload.

Changes

Core SP4 Logic

1. handleGroupCreate(): Now uses $connection->getUserId() as the member_id for the creating member
2. handleGroupJoin(): Now uses $connection->getUserId() as the member_id for the joining member
3. Host authorization (handlePlaybackPlay, handlePlaybackPause, handlePlaybackSeek, handlePlaybackQueue): Now checks $connection->getUserId() === $group['host_member_id'] instead of trusting client-supplied member_id in payload
4. Authentication guards: Added NOT_AUTHENTICATED error when connection's getUserId() returns null

GroupState::getState()

Returns members as an associative array keyed by member_id (instead of a numeric list) to support server-derived member_id lookup.

Test Infrastructure

• Extracted TestConnection class to separate PSR-12 compliant file tests/Unit/Server/WebSocket/TestConnection.php
• WsAuthenticationTest.php updated to use the extracted class

Security Fix

This prevents spoofed member_id attacks where a malicious client claims to be a different member. The server now always uses the authenticated connection's userId for authorization decisions, ensuring only the actual group host can control playback.

Test Results

✔ testUnauthenticatedConnectionCannotCreateGroup
✔ testUnauthenticatedConnectionCannotJoinGroup  
✔ testUnauthenticatedConnectionCannotControlPlayback
✔ testServerDerivedMemberIdIsUsedInsteadOfClientSupplied
✔ testHostAuthorizationUsesServerDerivedMemberId
✔ testJoinGroupUsesServerDerivedMemberId

PHPStan level 9: ✅ PASS
PHPCS PSR-12: ✅ PASS

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codacy-production]

Not up to standards ⛔

🔴 Issues 2 high · 19 medium · 79 minor

Alerts:
⚠ 100 issues (≤ 0 issues of at least minor severity)

Results:
100 new issues

Category	Results
UnusedCode	1 medium
BestPractice	5 medium
Documentation	47 minor
ErrorProne	1 medium
Security	2 high
CodeStyle	30 minor
Complexity	12 medium
Comprehensibility	2 minor

View in Codacy

🟢 Metrics 64 complexity · 3 duplication

Metric	Results
Complexity	64
Duplication	3

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}