feat: mint matchId and turnToken in PostStartMatch

tests/Integration/PostStartMatchTest.php

@@ -38,6 +38,10 @@ final class PostStartMatchTest extends TestCase
         self::assertSame('alpha', $body['match']['activeTeamId'] ?? null);
         self::assertSame(1, $body['match']['round'] ?? null);
         self::assertCount(6, $body['match']['units'] ?? []);
+        self::assertIsString($body['matchId'] ?? null);
+        self::assertMatchesRegularExpression('/^[a-f0-9]{16,}$/', $body['matchId']);
+        self::assertIsString($body['turnToken'] ?? null);
+        self::assertMatchesRegularExpression('/^[a-f0-9]{32}$/', $body['turnToken']);
     }
 
     public function testItReturns400OnAnInvalidScenario(): void
@@ -54,6 +58,33 @@ final class PostStartMatchTest extends TestCase
         self::assertSame(400, $response->status);
     }
 
+    public function testItReturnsATurnTokenValidForTheInitialMatchState(): void
+    {
+        [$token, $cookie] = CsrfToken::issue(self::SECRET);
+        $handler = new PostStartMatch();
+        $request = $this->buildRequest(
+            rawBody: json_encode($this->validScenario(), JSON_THROW_ON_ERROR),
+            csrfHeader: $token,
+            cookies: ['__csrf' => $cookie],
+        );
+        $response = $handler->handle($request, ['id' => 'demo']);
+
+        self::assertSame(200, $response->status);
+        $body = json_decode($response->body, true);
+        $matchId = $body['matchId'];
+        $turnToken = $body['turnToken'];
+        $lastActionIndex = count($body['match']['actionLog'] ?? []);
+
+        self::assertTrue(\BattleForge\Application\TurnToken::verify(
+            self::SECRET,
+            $matchId,
+            $body['match']['activeTeamId'],
+            $body['match']['round'],
+            $lastActionIndex,
+            $turnToken,
+        ));
+    }
+
     /** @param array<string, string> $cookies */
     private function buildRequest(string $rawBody, string $csrfHeader, array $cookies = []): Request
     {