diff --git a/.env.example b/.env.example
index 4455476..338c445 100644
--- a/.env.example
+++ b/.env.example
@@ -1,7 +1,15 @@
-DATABASE_URL="your-db-url"
+DATABASE_URL="postgresql://postgres:spotofy@localhost:5432/spotofy"
 
-BETTER_AUTH_SECRET="your-secret"
-WEB_APP_URL="your-web-app-url"
+BETTER_AUTH_SECRET="generate-a-long-random-string"
+WEB_APP_URL="http://localhost:3000"
+NEXT_PUBLIC_WEB_APP_URL="http://localhost:3000"
 
-GOOGLE_CLIENT_ID=""
-GOOGLE_CLIENT_SECRET=""
+GOOGLE_CLIENT_ID="your-google-client-id"
+GOOGLE_CLIENT_SECRET="your-google-client-secret"
+
+SPOTIFY_CLIENT_ID="your-spotify-client-id"
+SPOTIFY_CLIENT_SECRET="your-spotify-client-secret"
+
+NEXT_PUBLIC_WS_URL="ws://localhost:3001"
+WS_PORT=3001
+WS_SECRET="generate-a-long-random-string"
diff --git a/AGENTS.md b/AGENTS.md
index e5c1199..66aafce 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,31 +1,233 @@
-# agents.md
+# AGENTS.md
 
-This repository uses Windsurf Agents. Follow these rules whenever generating or editing code.
+Guidance for AI agents working in this repository.
 
-## Package Manager
+## Project overview
 
-- **Always use `bun`** as the package manager for all operations.
-  - Install packages: `bun add <package>`
-  - Install dev dependencies: `bun add -d <package>`
-  - Run scripts: `bun run <script>`
-  - Do NOT use `npm`, `yarn`, or `pnpm`.
+**Spotofy** is a collaborative Spotify listening app. Room admins create listening rooms; guests join, request songs, and upvote tracks. The room admin plays music through Spotify and controls the queue in real time.
 
-## UI & Components
+The repo is a **Turborepo monorepo** managed with **Bun** workspaces.
 
-- Prefer **shadcn/ui** components wherever possible.
-- If the required shadcn/ui component is not available in the project, **install it first** using `bun add` (then use it).
-- Keep styling consistent with the existing design system:
-  - Use Tailwind utility classes.
-  - Use the existing theme tokens/colors already defined in the project (avoid introducing arbitrary new colors).
+## Repository layout
 
-## React Component Conventions
+```
+spotofy-app/
+├── apps/
+│   ├── web/              # Next.js 16 App Router frontend + REST API routes
+│   └── room-server/      # Bun WebSocket server for real-time room state
+├── packages/
+│   ├── db/               # Prisma schema, migrations, shared DB client (@repo/db)
+│   ├── ui/               # Shared shadcn/ui component library (@repo/ui)
+│   ├── tailwind-config/  # Shared Tailwind v4 config
+│   ├── eslint-config/    # Shared ESLint configs (@repo/eslint-config)
+│   └── typescript-config/# Shared tsconfigs (@repo/typescript-config)
+├── docker/
+│   └── docker-compose.dev.yml  # Local PostgreSQL
+└── .env                    # Root env file (not committed; copy from .env.example)
+```
 
-- **New React component filenames must be kebab-case**.
-  - Example: `user-avatar.tsx`, `sign-in-form.tsx`
-- **React component names must be PascalCase**.
-  - Example: `UserAvatar`, `SignInForm`
+## Tech stack
 
-## General
+| Layer | Technology |
+| --- | --- |
+| Frontend | Next.js 16 (App Router), React 19, Tailwind CSS v4 |
+| UI library | shadcn/ui (`base-nova` style), `@base-ui/react`, Lucide icons |
+| Auth | [better-auth](https://www.better-auth.com/) with Google OAuth + Prisma adapter |
+| Database | PostgreSQL 17, Prisma 7 (`@prisma/adapter-pg`) |
+| Real-time | WebSocket server (`ws`) in `apps/room-server` |
+| Music | Spotify OAuth + Web Playback SDK (admin only) |
+| Validation | Zod 4 |
+| Monorepo | Turborepo 2 |
 
-- Keep changes minimal and aligned with the requested task.
-- Do not add backend logic unless explicitly requested.
+## Architecture
+
+Two runtimes share `@repo/db`:
+
+1. **`apps/web`** — HTTP layer
+   - Pages, layouts, and client UI
+   - REST API routes under `app/api/`
+   - Auth via better-auth (`/api/auth/[...all]`)
+   - Spotify OAuth/token/search routes under `/api/spotify/`
+   - Room CRUD under `/api/rooms`
+
+2. **`apps/room-server`** — Real-time layer
+   - WebSocket server on `WS_PORT` (default **3001**)
+   - In-memory room state (`Room` class) backed by Prisma for persistence
+   - Handles join flow, song requests, upvotes, queue updates, admin approvals
+
+The web app connects to the room server via `NEXT_PUBLIC_WS_URL` (see `apps/web/hooks/useWebSocket.ts`).
+
+### Key routes (web)
+
+| Path | Purpose |
+| --- | --- |
+| `/` | Landing page |
+| `/login` | Google sign-in |
+| `/admin` | Create/manage rooms (admin dashboard) |
+| `/join` | Join a room by code |
+| `/room/[code]` | Live room UI (`code` = room `id` from Prisma) |
+
+Route protection is defined in `apps/web/lib/routes.ts`. Auth redirects live in `apps/web/proxy.ts` (Next.js 16 replacement for `middleware.ts`). Pages also perform their own session checks (e.g. `app/room/[code]/page.tsx`).
+
+### Database models
+
+Defined in `packages/db/prisma/schema.prisma`:
+
+- **User** — auth + Spotify token fields
+- **Room** — admin, limits (`maxUpvotes`, `maxUsers`), auto-approve flags
+- **Song** — queue items with `SongStatus` enum (`REQUESTED`, `QUEUED`, `PLAYING`, `REJECTED`)
+- **SongUpvoteHistory** — one upvote per user per song per room
+
+After schema changes, run migrations from the repo root (see Commands below).
+
+### WebSocket protocol
+
+Message type constants are duplicated in:
+
+- `apps/web/lib/constants.ts`
+- `apps/room-server/src/constants.ts`
+
+Zod schemas and TypeScript types live in:
+
+- `apps/web/types/websocket.ts` (client)
+- `apps/room-server/src/types.ts` (server)
+
+**When adding or changing WebSocket message types, update both apps and keep constants in sync.**
+
+Server handlers: `apps/room-server/src/handerFunctions.ts` (router; note the filename spelling). Handler logic lives in `apps/room-server/src/handlers/`; shared helpers in `apps/room-server/src/lib/`.
+
+## Environment variables
+
+Root `.env` is loaded by apps via `dotenv-cli` (e.g. `dotenv -e ../../.env`).
+
+| Variable | Used by | Purpose |
+| --- | --- | --- |
+| `DATABASE_URL` | db, web, room-server | PostgreSQL connection string |
+| `BETTER_AUTH_SECRET` | web | Auth signing secret |
+| `WEB_APP_URL` | web | better-auth base URL (server) |
+| `NEXT_PUBLIC_WEB_APP_URL` | web (client) | Public app URL for OAuth callbacks |
+| `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` | web | Google OAuth |
+| `SPOTIFY_CLIENT_ID` / `SPOTIFY_CLIENT_SECRET` | web | Spotify OAuth + API |
+| `WS_PORT` | room-server | WebSocket listen port (default 3001) |
+| `NEXT_PUBLIC_WS_URL` | web (client) | WebSocket URL (default `ws://localhost:3001`) |
+
+Copy `.env.example` to `.env` and fill in values. Spotify vars are required for music features but are not yet listed in `.env.example`.
+
+Local DB: `docker compose -f docker/docker-compose.dev.yml up -d` (Postgres on port 5432, user/db/password: `spotofy`).
+
+## Commands
+
+Always use **Bun** — do not use npm, yarn, or pnpm.
+
+```bash
+bun install                  # Install all workspace dependencies
+bun run dev                  # Start all apps (web :3000, room-server :3001)
+bun run build                # Build all packages/apps
+bun run lint                 # Lint entire monorepo
+bun run check-types          # Type-check entire monorepo
+bun run format               # Prettier format
+
+# Database (runs via turbo → @repo/db)
+bun run db:generate          # Generate Prisma client
+bun run db:migrate           # Create/apply migrations (dev)
+bun run db:deploy            # Apply migrations (production)
+bun run db:studio            # Prisma Studio
+
+# Filter to a single package
+bunx turbo run dev --filter=web
+bunx turbo run dev --filter=room-server
+bunx turbo run build --filter=@repo/db
+```
+
+Prisma client output: `packages/db/generated/prisma/`. Import via `@repo/db`.
+
+## Package manager
+
+- Install packages: `bun add <package>` (from the relevant workspace directory, or `-w` at root)
+- Dev dependencies: `bun add -d <package>`
+- Run scripts: `bun run <script>`
+
+## UI & components
+
+- Prefer **shadcn/ui** components from `@repo/ui`.
+- Components live in `packages/ui/src/components/ui/`.
+- Import pattern: `@repo/ui/components/ui/<component>` (e.g. `@repo/ui/components/ui/button`).
+- Global styles: `@repo/ui/globals.css` (imported in `apps/web/app/layout.tsx`).
+- Theme: dark default via `next-themes` (`apps/web/components/theme-provider.tsx`).
+- Toasts: `@repo/ui/components/ui/sonner`.
+
+### Adding shadcn components
+
+Install new components into **`packages/ui`** using its `components.json` (`style: base-nova`). Do not add shadcn components directly under `apps/web` unless they are app-specific.
+
+- Use Tailwind utility classes and existing CSS variables from `packages/ui/src/styles/globals.css`.
+- Avoid arbitrary new colors; follow the neutral theme tokens.
+- Spotify album art is allowed via `next/image` remote pattern for `i.scdn.co`.
+
+## React & Next.js conventions
+
+### File naming
+
+- **New component files: kebab-case** — e.g. `room-header.tsx`, `sign-in-form.tsx`
+- **Component names: PascalCase** — e.g. `RoomHeader`, `SignInForm`
+- Some legacy files use camelCase (e.g. `signIn.tsx`); follow kebab-case for new files.
+
+### App Router patterns
+
+- **Server pages** fetch session/data, then render a **`_client.tsx`** client component for interactivity.
+- Co-locate route-specific components in `_components/` next to the page.
+- Path alias in web: `@/*` → `apps/web/*`
+- Path alias for UI: `@repo/ui/*` → `packages/ui/src/*`
+
+Example (room page):
+
+```
+app/room/[code]/
+├── page.tsx              # Server component: auth + data loading
+└── _components/
+    ├── _client.tsx       # Client shell: WebSocket + layout
+    ├── room-header.tsx
+    └── queue-sidebar.tsx
+```
+
+### API routes
+
+- Use Route Handlers in `app/api/**/route.ts`.
+- Validate request bodies with Zod (`safeParse`).
+- Check session via `auth.api.getSession({ headers: req.headers })`.
+- Use `prisma` from `@repo/db` for database access.
+
+### Auth
+
+- Server: `auth` from `@/lib/auth`
+- Client: `signIn` / `signOut` from `@/lib/auth-client`
+- Do not put heavy auth logic in `proxy.ts`; keep detailed checks in pages and route handlers.
+
+## Shared packages
+
+| Package | Import | Notes |
+| --- | --- | --- |
+| `@repo/db` | `import { prisma } from "@repo/db"` | Also re-exports Prisma types |
+| `@repo/ui` | `@repo/ui/components/ui/*` | Transpiled by Next via `transpilePackages` |
+| `@repo/eslint-config` | Extended in each app's `eslint.config.*` | `--max-warnings 0` in CI |
+| `@repo/typescript-config` | Extended in each `tsconfig.json` | |
+
+## CI
+
+GitHub Actions workflows (path-filtered per package):
+
+- `ci-web.yml` — build, lint, type-check for `web` (+ db/ui deps)
+- `ci-room-server.yml` — build, lint, type-check for `room-server`
+- `ci-db.yml` — build, type-check for `@repo/db`
+- `ci-ui.yml` — build, lint, type-check for `@repo/ui`
+
+All use Bun 1.3.6 and `bun install --frozen-lockfile`.
+
+## General guidelines
+
+- Keep changes minimal and scoped to the requested task.
+- Match existing patterns in the file or directory you are editing.
+- When touching Prisma schema, add a migration — do not only edit the schema file.
+- When touching WebSocket messages, update web client, room-server, and Zod schemas together.
+- `apps/web/next.config.ts` has `typescript.ignoreBuildErrors: true` — still run `bun run check-types` locally.
+- Do not commit `.env` or secrets.
diff --git a/README.md b/README.md
index 438763d..8fa1160 100644
--- a/README.md
+++ b/README.md
@@ -1,58 +1,148 @@
-# Turborepo Tailwind CSS starter
+# Spotofy
 
-This Turborepo starter is maintained by the Turborepo core team.
+Listen to music together. Spotofy lets a room host create a shared listening session on Spotify — guests join, request songs, upvote tracks, and everyone sees the queue update in real time.
 
-## Using this example
+## How it works
 
-Run the following command:
+1. **Sign in** with Google.
+2. **Create a room** from the admin dashboard and share the room code.
+3. **Guests join** the room, request songs, and upvote what they want to hear next.
+4. **The room host** connects their Spotify account, plays music, and manages the queue.
 
-```sh
-npx create-turbo@latest -e with-tailwind
+The host is the only person who needs Spotify connected — everyone else participates through the web app.
+
+## Architecture
+
+Spotofy is split into three main pieces that work together:
+
+```mermaid
+flowchart LR
+  Browser["Browser\n(Next.js web app)"]
+  RoomServer["Room server\n(WebSockets)"]
+  DB["PostgreSQL\n(database)"]
+  Spotify["Spotify API"]
+
+  Browser <-->|"real-time updates"| RoomServer
+  Browser -->|"pages, auth, API"| DB
+  RoomServer -->|"rooms, songs, votes"| DB
+  Browser -->|"search & playback"| Spotify
+```
+
+| Part | What it does |
+| --- | --- |
+| **Web app** (`apps/web`) | The website you interact with — login, create/join rooms, search songs, and the live room UI. Runs on [http://localhost:3000](http://localhost:3000). |
+| **Room server** (`apps/room-server`) | Keeps rooms in sync in real time — who joined, song requests, upvotes, and queue changes. Runs on port **3001**. |
+| **Database** (`packages/db`) | Stores users, rooms, songs, and votes. Uses PostgreSQL with Prisma. |
+
+Shared UI components live in `packages/ui`. The repo uses [Turborepo](https://turbo.build/) and [Bun](https://bun.sh/) to manage everything as a monorepo.
+
+For deeper technical details (file layout, conventions, env vars), see [AGENTS.md](./AGENTS.md).
+
+## Prerequisites
+
+- [Bun](https://bun.sh/) (v1.3+)
+- [Docker](https://www.docker.com/) (for local PostgreSQL)
+- A **Google OAuth** app (for sign-in)
+- A **Spotify Developer** app (for music search and playback)
+
+## Run locally
+
+### 1. Clone and install
+
+```bash
+git clone <repo-url>
+cd spotofy-app
+bun install
 ```
 
-## What's inside?
+### 2. Start the database
+
+```bash
+docker compose -f docker/docker-compose.dev.yml up -d
+```
 
-This Turborepo includes the following packages/apps:
+This starts PostgreSQL on port `5432` (user `postgres`, database `spotofy`, password `spotofy`).
 
-### Apps and Packages
+### 3. Configure environment variables
 
-- `docs`: a [Next.js](https://nextjs.org/) app with [Tailwind CSS](https://tailwindcss.com/)
-- `web`: another [Next.js](https://nextjs.org/) app with [Tailwind CSS](https://tailwindcss.com/)
-- `ui`: a stub React component library with [Tailwind CSS](https://tailwindcss.com/) shared by both `web` and `docs` applications
-- `@repo/eslint-config`: `eslint` configurations (includes `eslint-config-next` and `eslint-config-prettier`)
-- `@repo/typescript-config`: `tsconfig.json`s used throughout the monorepo
+Copy the example env file and fill in your values:
 
-Each package/app is 100% [TypeScript](https://www.typescriptlang.org/).
+```bash
+cp .env.example .env
+```
 
-### Building packages/ui
+At minimum, set these in `.env`:
 
-This example is set up to produce compiled styles for `ui` components into the `dist` directory. The component `.tsx` files are consumed by the Next.js apps directly using `transpilePackages` in `next.config.ts`. This was chosen for several reasons:
+```env
+DATABASE_URL="postgresql://postgres:spotofy@localhost:5432/spotofy"
 
-- Make sharing one `tailwind.config.ts` to apps and packages as easy as possible.
-- Make package compilation simple by only depending on the Next.js Compiler and `tailwindcss`.
-- Ensure Tailwind classes do not overwrite each other. The `ui` package uses a `ui-` prefix for it's classes.
-- Maintain clear package export boundaries.
+BETTER_AUTH_SECRET="generate-a-long-random-string"
+WEB_APP_URL="http://localhost:3000"
+NEXT_PUBLIC_WEB_APP_URL="http://localhost:3000"
 
-Another option is to consume `packages/ui` directly from source without building. If using this option, you will need to update the `tailwind.config.ts` in your apps to be aware of your package locations, so it can find all usages of the `tailwindcss` class names for CSS compilation.
+GOOGLE_CLIENT_ID="your-google-client-id"
+GOOGLE_CLIENT_SECRET="your-google-client-secret"
 
-For example, in [tailwind.config.ts](packages/tailwind-config/tailwind.config.ts):
+SPOTIFY_CLIENT_ID="your-spotify-client-id"
+SPOTIFY_CLIENT_SECRET="your-spotify-client-secret"
 
-```js
-  content: [
-    // app content
-    `src/**/*.{js,ts,jsx,tsx}`,
-    // include packages if not transpiling
-    "../../packages/ui/*.{js,ts,jsx,tsx}",
-  ],
+NEXT_PUBLIC_WS_URL="ws://localhost:3001"
+WS_PORT=3001
+WS_SECRET="generate-a-long-random-string"
 ```
 
-If you choose this strategy, you can remove the `tailwindcss` and `autoprefixer` dependencies from the `ui` package.
+`WS_SECRET` signs room-scoped WebSocket JWTs. Use the same value in both the web app and room server (see `.env.example`).
 
-### Utilities
+**Google OAuth:** Create credentials in the [Google Cloud Console](https://console.cloud.google.com/). Add `http://localhost:3000` as an authorized origin and `http://localhost:3000/api/auth/callback/google` as a redirect URI.
 
-This Turborepo has some additional tools already setup for you:
+**Spotify:** Create an app in the [Spotify Developer Dashboard](https://developer.spotify.com/dashboard). Add `http://localhost:3000/api/spotify/callback` as a redirect URI.
 
-- [Tailwind CSS](https://tailwindcss.com/) for styles
-- [TypeScript](https://www.typescriptlang.org/) for static type checking
-- [ESLint](https://eslint.org/) for code linting
-- [Prettier](https://prettier.io) for code formatting
+### 4. Set up the database
+
+```bash
+bun run db:generate
+bun run db:migrate
+```
+
+### 5. Start the app
+
+```bash
+bun run dev
+```
+
+This starts both the web app and the room server. Open [http://localhost:3000](http://localhost:3000) in your browser.
+
+## Useful commands
+
+| Command | Description |
+| --- | --- |
+| `bun run dev` | Start web app + room server in development |
+| `bun run build` | Build all packages |
+| `bun run lint` | Lint the codebase |
+| `bun run check-types` | Run TypeScript checks |
+| `bun run db:migrate` | Create and apply database migrations (development) |
+| `bun run db:deploy` | Apply migrations (production) |
+| `bun run db:studio` | Open Prisma Studio (database GUI) |
+
+To run a single app:
+
+```bash
+bunx turbo run dev --filter=web
+bunx turbo run dev --filter=room-server
+```
+
+## Project structure
+
+```
+spotofy-app/
+├── apps/
+│   ├── web/           # Next.js frontend + API
+│   └── room-server/   # WebSocket server for live rooms
+├── packages/
+│   ├── db/            # Database schema & client
+│   ├── ui/            # Shared UI components
+│   ├── tailwind-config/
+│   ├── eslint-config/
+│   └── typescript-config/
+└── docker/            # Local PostgreSQL setup
+```
diff --git a/apps/room-server/package.json b/apps/room-server/package.json
index 47597a5..a420f53 100644
--- a/apps/room-server/package.json
+++ b/apps/room-server/package.json
@@ -24,6 +24,7 @@
     "@paralleldrive/cuid2": "^3.3.0",
     "@repo/db": "*",
     "dotenv-cli": "^11.0.0",
+    "jose": "^6.2.3",
     "ws": "^8.19.0"
   }
 }
diff --git a/apps/room-server/src/constants.ts b/apps/room-server/src/constants.ts
index 7b5a263..7ed1584 100644
--- a/apps/room-server/src/constants.ts
+++ b/apps/room-server/src/constants.ts
@@ -1,38 +1,39 @@
-export const CLIENT_TO_SERVER_MESSAGE_TYPES = {
-  JOIN_ROOM: "join_room",
-  REQUEST_SONG: "request_song",
-  UPVOTE_SONG: "upvote_song",
-  APPROVE_SONG: "approve_song",
-  REJECT_SONG: "reject_song",
-  APPROVE_USER: "approve_user",
-  REJECT_USER: "reject_user",
-  BROADCAST_NOW_PLAYING: "broadcast_now_playing",
-  NEXT_SONG: "next_song",
+export const ClientEvents = {
+  JOIN_ROOM: "room.join",
+  REQUEST_SONG: "song.request",
+  UPVOTE_SONG: "song.upvote",
+  APPROVE_SONG: "song.approve",
+  REJECT_SONG: "song.reject",
+  APPROVE_USER: "user.approve",
+  REJECT_USER: "user.reject",
+  SYNC_NOW_PLAYING: "now_playing.sync",
+  SKIP_TO_NEXT: "queue.next",
 } as const;
 
-export const SERVER_TO_CLIENT_MESSAGE_TYPES = {
-  QUEUE_UPDATE: "queue_update",
-  SONG_REQUESTED: "song_requested",
-  SONG_APPROVED: "song_approved",
-  SONG_REJECTED: "song_rejected",
+export const ServerEvents = {
+  QUEUE_UPDATED: "queue.updated",
+  SONG_REQUESTED: "song.requested",
+  SONG_REQUEST_SUBMITTED: "song.request_submitted",
+  SONG_APPROVED: "song.approved",
+  SONG_REJECTED: "song.rejected",
   ERROR: "error",
-  ADMIN_NOT_JOINED: "admin_not_joined",
-  ADMIN_LEFT: "admin_left",
-  JOINED_ROOM: "joined_room",
-  LIST_USERS: "list_users",
-  JOIN_REQUESTED: "join_requested",
-  REQUEST_ALREADY_SENT: "request_already_sent",
-  ADMIN_JOINED: "admin_joined",
-  USER_APPROVED: "user_approved",
-  USER_REJECTED: "user_rejected",
-  USERS_REQUESTED_LIST: "users_requested_list",
-  NOW_PLAYING_UPDATE: "now_playing_update",
+  WAITING_FOR_ADMIN: "room.waiting_for_admin",
+  ADMIN_LEFT: "room.admin_left",
+  ADMIN_JOINED: "room.admin_joined",
+  ROOM_JOINED: "room.joined",
+  MEMBERS_UPDATED: "room.members_updated",
+  USER_JOIN_REQUESTED: "user.join_requested",
+  JOIN_ALREADY_PENDING: "user.join_already_pending",
+  USER_APPROVED: "user.approved",
+  USER_REJECTED: "user.rejected",
+  PENDING_JOIN_REQUESTS: "room.pending_join_requests",
+  PENDING_SONG_REQUESTS: "room.pending_song_requests",
+  NOW_PLAYING_UPDATED: "now_playing.updated",
+  ROOM_USER_LIMIT_REACHED: "room.user_limit_reached",
+  ROOM_UPVOTE_LIMIT_REACHED: "room.upvote_limit_reached",
+  USER_UPVOTES_USAGE: "user.upvotes_usage",
 } as const;
 
-export const ALL_CLIENT_TO_SERVER_MESSAGE_TYPES = Object.values(
-  CLIENT_TO_SERVER_MESSAGE_TYPES,
-);
+export const ALL_CLIENT_EVENTS = Object.values(ClientEvents);
 
-export const ALL_SERVER_TO_CLIENT_MESSAGE_TYPES = Object.values(
-  SERVER_TO_CLIENT_MESSAGE_TYPES,
-);
+export const ALL_SERVER_EVENTS = Object.values(ServerEvents);
diff --git a/apps/room-server/src/handerFunctions.ts b/apps/room-server/src/handerFunctions.ts
index f67c29c..306d1aa 100644
--- a/apps/room-server/src/handerFunctions.ts
+++ b/apps/room-server/src/handerFunctions.ts
@@ -1,518 +1,32 @@
 import type { WebSocket } from "ws";
+import { ClientEvents, ServerEvents } from "./constants";
+import { handleJoinRoom } from "./handlers/join";
+import { handleNextSong, handlePlayCurrentSong } from "./handlers/playback";
 import {
-  CLIENT_TO_SERVER_MESSAGE_TYPES,
-  SERVER_TO_CLIENT_MESSAGE_TYPES,
-} from "./constants";
-import { Room } from "./room";
-import {
-  IncomingMessageSchema,
-  type ApproveSongMessage,
-  type ApproveUserMessage,
-  type ClientConnection,
-  type IncomingMessage,
-  type JoinRoomMessage,
-  type OutgoingMessage,
-  type RejectUserMessage,
-  type RejectSongMessage,
-  type RequestSongMessage,
-  type UpvoteSongMessage,
-} from "./types";
-
-const roomCache = new Map<string, Room>();
-const connections = new Map<WebSocket, ClientConnection>();
-
-function send(ws: WebSocket, message: OutgoingMessage) {
-  if (ws.readyState === ws.OPEN) {
-    ws.send(JSON.stringify(message));
-  }
-}
-
-function broadcastToRoom(roomId: string, message: OutgoingMessage) {
-  for (const [, conn] of connections) {
-    if (conn.roomId === roomId && conn.status === "joined") {
-      send(conn.ws, message);
-    }
-  }
-}
-
-function sendToAdmin(roomId: string, room: Room, message: OutgoingMessage) {
-  const adminId = room.getAdminId();
-  for (const [, conn] of connections) {
-    if (conn.roomId === roomId && conn.user?.userId === adminId) {
-      send(conn.ws, message);
-      break;
-    }
-  }
-}
-
-function sendToUser(userId: string, message: OutgoingMessage) {
-  for (const [, conn] of connections) {
-    if (conn.user?.userId === userId) {
-      send(conn.ws, message);
-      break;
-    }
-  }
-}
-
-async function sendQueueUpdate(roomId: string, room: Room) {
-  const queue = await room.loadSongs();
-  broadcastToRoom(roomId, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.QUEUE_UPDATE,
-    payload: { queue },
-  });
-}
-
-async function getRoom(roomId: string): Promise<Room | null> {
-  return roomCache.get(roomId) ?? null;
-}
-
-async function handleJoinRoom(ws: WebSocket, msg: JoinRoomMessage) {
-  const { roomId, user } = msg.payload;
-
-  let room = roomCache.get(roomId);
-  if (!room) {
-    room = await Room.findOrCreate(roomId, user.userId);
-    roomCache.set(roomId, room);
-  }
-
-  connections.set(ws, { ws, user, roomId, status: "pending" });
-
-  if (user.userId === room.getAdminId()) {
-    room.setAdminStatus(true);
-    broadcastToRoom(roomId, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ADMIN_JOINED,
-      payload: {},
-    });
-
-    // send list of users requested to join
-    const userRequests = room.getUsersRequestedList();
-    if (userRequests.length > 0) {
-      send(ws, {
-        type: SERVER_TO_CLIENT_MESSAGE_TYPES.USERS_REQUESTED_LIST,
-        payload: { users: userRequests },
-      });
-    }
-  } else {
-    if (!room.isAdminJoined()) {
-      // send message to user that admin has not joined yet
-      send(ws, {
-        type: SERVER_TO_CLIENT_MESSAGE_TYPES.ADMIN_NOT_JOINED,
-        payload: {},
-      });
-
-      room.addUserRequest(user, ws);
-      return;
-    }
-    if (!room.isAutoApproveUsers()) {
-      if (room.checkUserRequestedAlready(user.userId)) {
-        // send message to user that request is already sent
-        send(ws, {
-          type: SERVER_TO_CLIENT_MESSAGE_TYPES.REQUEST_ALREADY_SENT,
-          payload: {},
-        });
-        return;
-      }
-
-      room.addUserRequest(user, ws);
-
-      // send to admin for approval
-      sendToAdmin(roomId, room, {
-        type: SERVER_TO_CLIENT_MESSAGE_TYPES.JOIN_REQUESTED,
-        payload: {
-          userId: user.userId,
-          username: user.username,
-        },
-      });
-      return;
-    }
-  }
-
-  connections.get(ws)!.status = "joined";
-  room.addUser(user);
-
-  const queue = await room.loadSongs();
-
-  // send joined room message to self
-  send(ws, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.JOINED_ROOM,
-    payload: {
-      roomId,
-      config: room.getConfig(),
-      queue,
-    },
-  });
-
-  // send list users message to all users in room
-  broadcastToRoom(roomId, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.LIST_USERS,
-    payload: { users: room.getUsers() },
-  });
-
-  // send current song to this user
-  const currentSong = await room.playCurrentSong();
-  send(ws, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.NOW_PLAYING_UPDATE,
-    payload: { song: currentSong ?? null },
-  });
-
-  // send queue update to this user
-  send(ws, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.QUEUE_UPDATE,
-    payload: { queue },
-  });
-}
-
-async function handleRejectUser(ws: WebSocket, msg: RejectUserMessage) {
-  const conn = connections.get(ws);
-  if (!conn || !conn.user) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Not in a room" },
-    });
-  }
-
-  // check if user is admin
-  if (!conn.user.isAdmin) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "User is not admin" },
-    });
-  }
-
-  // get room
-  const room = await getRoom(conn.roomId);
-  if (!room) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Room not found" },
-    });
-  }
-
-  // remove from the user requested list
-  room.removeUserRequest(msg.payload.userId);
-
-  // send to user that request is rejected
-  sendToUser(msg.payload.userId, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.USER_REJECTED,
-  });
-}
-
-async function handleApproveUser(ws: WebSocket, msg: ApproveUserMessage) {
-  const conn = connections.get(ws);
-  if (!conn || !conn.user) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Not in a room" },
-    });
-  }
-
-  const room = await getRoom(conn.roomId);
-  if (!room) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Room not found" },
-    });
-  }
-
-  // check if user is admin
-  if (!conn.user.isAdmin) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "User is not admin" },
-    });
-  }
-
-  // get the user from requested list
-  const user = room.getUserRequested(msg.payload.userId);
-  if (!user) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "User not found in requested list" },
-    });
-  }
-
-  // add to connection and user list
-  connections.set(user.ws, {
-    ws: user.ws,
-    user: {
-      userId: user.userId,
-      username: user.username,
-      email: user.email,
-      isAdmin: user.isAdmin,
-    },
-    roomId: conn.roomId,
-    status: "joined",
-  });
-  room.addUser({
-    userId: user.userId,
-    email: user.email,
-    username: user.username,
-    isAdmin: user.isAdmin,
-  });
-
-  // remove the user from requested list
-  room.removeUserRequest(msg.payload.userId);
-
-  const queue = await room.loadSongs();
-
-  // send joined message to user
-  sendToUser(msg.payload.userId, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.JOINED_ROOM,
-    payload: {
-      roomId: conn.roomId,
-      config: room.getConfig(),
-      queue,
-    },
-  });
-
-  // send list users message to all users in room
-  broadcastToRoom(conn.roomId, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.LIST_USERS,
-    payload: { users: room.getUsers() },
-  });
-
-  // send current song to this user
-  const currentSong = await room.playCurrentSong();
-  sendToUser(msg.payload.userId, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.NOW_PLAYING_UPDATE,
-    payload: { song: currentSong ?? null },
-  });
-
-  // send queue update to this user
-  sendToUser(msg.payload.userId, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.QUEUE_UPDATE,
-    payload: { queue },
-  });
-
-  // send to user that request is approved
-  sendToUser(msg.payload.userId, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.USER_APPROVED,
-    payload: {
-      userId: msg.payload.userId,
-      username: msg.payload.username,
-    },
-  });
-}
-
-async function handleRequestSong(ws: WebSocket, msg: RequestSongMessage) {
-  const conn = connections.get(ws);
-  if (!conn || !conn.user) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Not in a room" },
-    });
-  }
-
-  const room = await getRoom(conn.roomId);
-  if (!room) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Room not found" },
-    });
-  }
-
-  // Need to add a check if same song requested by someone already
-
-  const songData = await room.requestSong(msg.payload.song);
-
-  if (room.isAutoApproveSongs()) {
-    await sendQueueUpdate(conn.roomId, room);
-  } else {
-    sendToAdmin(conn.roomId, room, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.SONG_REQUESTED,
-      payload: { song: songData },
-    });
-  }
-}
-
-async function handleUpvote(ws: WebSocket, msg: UpvoteSongMessage) {
-  const conn = connections.get(ws);
-  if (!conn || !conn.user) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Not in a room" },
-    });
-  }
-
-  const room = await getRoom(conn.roomId);
-  if (!room) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Room not found" },
-    });
-  }
+  handleApproveSong,
+  handleRejectSong,
+  handleRequestSong,
+  handleUpvote,
+} from "./handlers/songs";
+import { handleApproveUser, handleRejectUser } from "./handlers/users";
+import { connections, roomCache } from "./lib/context";
+import { broadcastToRoom, send } from "./lib/messaging";
+import { IncomingMessageSchema, type IncomingMessage } from "./types";
 
-  if (msg.payload.userId !== conn.user.userId) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Invalid upvote user" },
-    });
-  }
-
-  const result = await room.upvote(msg.payload.songId, conn.user.userId);
-  if (result === "success") {
-    return await sendQueueUpdate(conn.roomId, room);
-  }
-
-  if (result === "already_upvoted") {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "You have already upvoted this song in this room" },
-    });
-  }
-
-  return send(ws, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-    payload: { message: "Song not found in queue" },
-  });
-}
-
-async function handleApproveSong(ws: WebSocket, msg: ApproveSongMessage) {
-  const conn = connections.get(ws);
-  if (!conn || !conn.user) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Not in a room" },
-    });
-  }
-
-  const room = await getRoom(conn.roomId);
-  if (!room) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Room not found" },
-    });
-  }
-
-  if (conn.user.userId !== room.getAdminId()) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Only admin can approve songs" },
-    });
-  }
-
-  const success = await room.approveSong(msg.payload.songId);
-  if (success) {
-    broadcastToRoom(conn.roomId, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.SONG_APPROVED,
-      payload: { songId: msg.payload.songId },
-    });
-    await sendQueueUpdate(conn.roomId, room);
-  } else {
-    send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Song not found in requests" },
-    });
-  }
-}
-
-async function handleRejectSong(ws: WebSocket, msg: RejectSongMessage) {
-  const conn = connections.get(ws);
-  if (!conn || !conn.user) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Not in a room" },
-    });
-  }
-
-  const room = await getRoom(conn.roomId);
-  if (!room) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Room not found" },
-    });
-  }
-
-  if (conn.user.userId !== room.getAdminId()) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Only admin can reject songs" },
-    });
-  }
-
-  const success = await room.rejectSong(msg.payload.songId);
-  if (success) {
-    broadcastToRoom(conn.roomId, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.SONG_REJECTED,
-      payload: { songId: msg.payload.songId },
-    });
-  } else {
-    send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Song not found in requests" },
-    });
-  }
-}
-
-async function handleNextSong(ws: WebSocket) {
-  const conn = connections.get(ws);
-  if (!conn || !conn.user) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Not in a room" },
-    });
-  }
-
-  const room = await getRoom(conn.roomId);
-  if (!room) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Room not found" },
-    });
-  }
-
-  if (conn.user.userId !== room.getAdminId()) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Only admin can skip to next song" },
-    });
-  }
-
-  const song = await room.playNextSong();
-
-  broadcastToRoom(conn.roomId, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.NOW_PLAYING_UPDATE,
-    payload: { song: song ?? null },
-  });
-
-  await sendQueueUpdate(conn.roomId, room);
-}
-
-async function handlePlayCurrentSong(ws: WebSocket) {
+export async function handleMessage(ws: WebSocket, raw: string) {
   const conn = connections.get(ws);
-  if (!conn || !conn.user) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Not in a room" },
-    });
+  if (!conn?.auth) {
+    ws.close(4401, "Unauthorized");
+    return;
   }
 
-  const room = await getRoom(conn.roomId);
-  if (!room) {
-    return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
-      payload: { message: "Room not found" },
-    });
-  }
-
-  const song = await room.playCurrentSong();
-
-  broadcastToRoom(conn.roomId, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.NOW_PLAYING_UPDATE,
-    payload: { song: song ?? null },
-  });
-
-  await sendQueueUpdate(conn.roomId, room);
-}
-
-export async function handleMessage(ws: WebSocket, raw: string) {
   let msg: IncomingMessage;
   try {
     const parsedMessage = IncomingMessageSchema.safeParse(JSON.parse(raw));
 
     if (!parsedMessage.success) {
       return send(ws, {
-        type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
+        type: ServerEvents.ERROR,
         payload: { message: "Invalid message payload" },
       });
     }
@@ -520,34 +34,34 @@ export async function handleMessage(ws: WebSocket, raw: string) {
     msg = parsedMessage.data;
   } catch {
     return send(ws, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
+      type: ServerEvents.ERROR,
       payload: { message: "Invalid JSON" },
     });
   }
 
   switch (msg.type) {
-    case CLIENT_TO_SERVER_MESSAGE_TYPES.JOIN_ROOM:
+    case ClientEvents.JOIN_ROOM:
       return handleJoinRoom(ws, msg);
-    case CLIENT_TO_SERVER_MESSAGE_TYPES.REQUEST_SONG:
+    case ClientEvents.REQUEST_SONG:
       return handleRequestSong(ws, msg);
-    case CLIENT_TO_SERVER_MESSAGE_TYPES.UPVOTE_SONG:
+    case ClientEvents.UPVOTE_SONG:
       return handleUpvote(ws, msg);
-    case CLIENT_TO_SERVER_MESSAGE_TYPES.APPROVE_SONG:
+    case ClientEvents.APPROVE_SONG:
       return handleApproveSong(ws, msg);
-    case CLIENT_TO_SERVER_MESSAGE_TYPES.REJECT_SONG:
+    case ClientEvents.REJECT_SONG:
       return handleRejectSong(ws, msg);
-    case CLIENT_TO_SERVER_MESSAGE_TYPES.APPROVE_USER:
+    case ClientEvents.APPROVE_USER:
       return handleApproveUser(ws, msg);
-    case CLIENT_TO_SERVER_MESSAGE_TYPES.REJECT_USER:
+    case ClientEvents.REJECT_USER:
       return handleRejectUser(ws, msg);
-    case CLIENT_TO_SERVER_MESSAGE_TYPES.BROADCAST_NOW_PLAYING:
+    case ClientEvents.SYNC_NOW_PLAYING:
       return handlePlayCurrentSong(ws);
-    case CLIENT_TO_SERVER_MESSAGE_TYPES.NEXT_SONG:
+    case ClientEvents.SKIP_TO_NEXT:
       return handleNextSong(ws);
     default:
       console.log("MESSAGE_TYPE: ", msg);
       return send(ws, {
-        type: SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR,
+        type: ServerEvents.ERROR,
         payload: { message: "Unknown message type" },
       });
   }
@@ -562,13 +76,11 @@ export function handleDisconnect(ws: WebSocket) {
   const room = roomCache.get(conn.roomId);
   if (!room) return;
 
-  // check if admin left
-  if (conn.user.isAdmin) {
+  if (conn.user.userId === room.getAdminId()) {
     room.setAdminStatus(false);
 
-    // TODO: notify other users that admin left
     broadcastToRoom(conn.roomId, {
-      type: SERVER_TO_CLIENT_MESSAGE_TYPES.ADMIN_LEFT,
+      type: ServerEvents.ADMIN_LEFT,
       payload: {},
     });
   }
@@ -580,7 +92,14 @@ export function handleDisconnect(ws: WebSocket) {
   }
 
   broadcastToRoom(conn.roomId, {
-    type: SERVER_TO_CLIENT_MESSAGE_TYPES.LIST_USERS,
+    type: ServerEvents.MEMBERS_UPDATED,
     payload: { users: room.getUsers() },
   });
+
+  const hasRemaining = Array.from(connections.values()).some(
+    (c) => c.roomId === conn.roomId,
+  );
+  if (!hasRemaining) {
+    roomCache.delete(conn.roomId);
+  }
 }
diff --git a/apps/room-server/src/handlers/join.ts b/apps/room-server/src/handlers/join.ts
new file mode 100644
index 0000000..d5a4113
--- /dev/null
+++ b/apps/room-server/src/handlers/join.ts
@@ -0,0 +1,144 @@
+import type { WebSocket } from "ws";
+import { ServerEvents } from "../constants";
+import { connections, roomCache } from "../lib/context";
+import {
+  completeDirectJoin,
+  notifyPendingUsersOnAdminJoin,
+  sendJoinedSnapshotToClient,
+} from "../lib/join-helpers";
+import {
+  broadcastToRoom,
+  send,
+  sendToAdmin,
+  sendUserLimitReached,
+} from "../lib/messaging";
+import { resolveUserPayload } from "../lib/user";
+import { Room } from "../room";
+import type { JoinRoomMessage } from "../types";
+
+export async function handleJoinRoom(ws: WebSocket, msg: JoinRoomMessage) {
+  const conn = connections.get(ws);
+  if (!conn?.auth) {
+    send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Unauthorized" },
+    });
+    ws.close(4401, "Unauthorized");
+    return;
+  }
+
+  const { roomId } = msg.payload;
+
+  if (roomId !== conn.auth.roomId) {
+    send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Token is not valid for this room" },
+    });
+    return;
+  }
+
+  let room: Room | null = roomCache.get(roomId) ?? null;
+  if (!room) {
+    room = await Room.find(roomId);
+    if (!room) {
+      send(ws, {
+        type: ServerEvents.ERROR,
+        payload: { message: "Room not found" },
+      });
+      connections.delete(ws);
+      return;
+    }
+    roomCache.set(roomId, room);
+  }
+
+  const user = await resolveUserPayload(conn.auth.userId, room.getAdminId());
+  if (!user) {
+    send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "User not found" },
+    });
+    connections.delete(ws);
+    return;
+  }
+
+  const existing = connections.get(ws);
+  if (
+    existing?.status === "joined" &&
+    existing.roomId === roomId &&
+    existing.user?.userId === user.userId
+  ) {
+    const cachedRoom = roomCache.get(roomId);
+    if (cachedRoom) {
+      await sendJoinedSnapshotToClient(ws, roomId, cachedRoom, user.userId);
+    }
+    return;
+  }
+
+  connections.set(ws, { ...conn, user, roomId, status: "pending" });
+
+  if (user.userId === room.getAdminId()) {
+    room.setAdminStatus(true);
+    broadcastToRoom(roomId, {
+      type: ServerEvents.ADMIN_JOINED,
+      payload: {},
+    });
+
+    await notifyPendingUsersOnAdminJoin(roomId, room);
+
+    const userRequests = room.getUsersRequestedList();
+    if (userRequests.length > 0) {
+      send(ws, {
+        type: ServerEvents.PENDING_JOIN_REQUESTS,
+        payload: { users: userRequests },
+      });
+    }
+
+    const requestedSongs = await room.loadRequestedSongs();
+    if (requestedSongs.length > 0) {
+      send(ws, {
+        type: ServerEvents.PENDING_SONG_REQUESTS,
+        payload: { songs: requestedSongs },
+      });
+    }
+  } else {
+    if (room.isAtUserCapacity(user.userId)) {
+      sendUserLimitReached(ws, room.getConfig().maxUsers);
+      return;
+    }
+
+    if (!room.isAdminJoined()) {
+      send(ws, {
+        type: ServerEvents.WAITING_FOR_ADMIN,
+        payload: {},
+      });
+
+      room.addUserRequest(user, ws);
+      return;
+    }
+    if (!room.isAutoApproveUsers()) {
+      if (room.checkUserRequestedAlready(user.userId)) {
+        send(ws, {
+          type: ServerEvents.JOIN_ALREADY_PENDING,
+          payload: {},
+        });
+        return;
+      }
+
+      room.addUserRequest(user, ws);
+
+      sendToAdmin(roomId, room, {
+        type: ServerEvents.USER_JOIN_REQUESTED,
+        payload: {
+          userId: user.userId,
+          username: user.username,
+        },
+      });
+      return;
+    }
+  }
+
+  connections.get(ws)!.status = "joined";
+  room.addUser(user);
+
+  await completeDirectJoin(ws, roomId, room, user.userId);
+}
diff --git a/apps/room-server/src/handlers/playback.ts b/apps/room-server/src/handlers/playback.ts
new file mode 100644
index 0000000..d2ac116
--- /dev/null
+++ b/apps/room-server/src/handlers/playback.ts
@@ -0,0 +1,59 @@
+import type { WebSocket } from "ws";
+import { ServerEvents } from "../constants";
+import { getRoom } from "../lib/context";
+import { getJoinedConnection } from "../lib/guards";
+import { sendQueueUpdate } from "../lib/join-helpers";
+import { broadcastToRoom, send } from "../lib/messaging";
+
+export async function handleNextSong(ws: WebSocket) {
+  const ctx = getJoinedConnection(ws);
+  if (!ctx) return;
+
+  const { conn } = ctx;
+
+  const room = getRoom(conn.roomId);
+  if (!room) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Room not found" },
+    });
+  }
+
+  if (conn.user!.userId !== room.getAdminId()) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Only admin can skip to next song" },
+    });
+  }
+
+  const song = await room.playNextSong();
+
+  broadcastToRoom(conn.roomId, {
+    type: ServerEvents.NOW_PLAYING_UPDATED,
+    payload: { song: song ?? null },
+  });
+
+  await sendQueueUpdate(conn.roomId, room);
+}
+
+export async function handlePlayCurrentSong(ws: WebSocket) {
+  const ctx = getJoinedConnection(ws);
+  if (!ctx) return;
+
+  const { conn } = ctx;
+
+  const room = getRoom(conn.roomId);
+  if (!room) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Room not found" },
+    });
+  }
+
+  const song = await room.getCurrentSong();
+
+  broadcastToRoom(conn.roomId, {
+    type: ServerEvents.NOW_PLAYING_UPDATED,
+    payload: { song: song ?? null },
+  });
+}
diff --git a/apps/room-server/src/handlers/songs.ts b/apps/room-server/src/handlers/songs.ts
new file mode 100644
index 0000000..ec4afd8
--- /dev/null
+++ b/apps/room-server/src/handlers/songs.ts
@@ -0,0 +1,204 @@
+import type { WebSocket } from "ws";
+import { ServerEvents } from "../constants";
+import { getRoom } from "../lib/context";
+import { getJoinedConnection } from "../lib/guards";
+import { sendQueueUpdate } from "../lib/join-helpers";
+import {
+  broadcastToRoom,
+  send,
+  sendToAdmin,
+  sendUserUpvotesUsage,
+} from "../lib/messaging";
+import type {
+  ApproveSongMessage,
+  RejectSongMessage,
+  RequestSongMessage,
+  UpvoteSongMessage,
+} from "../types";
+
+export async function handleRequestSong(
+  ws: WebSocket,
+  msg: RequestSongMessage,
+) {
+  const ctx = getJoinedConnection(ws);
+  if (!ctx) return;
+
+  const { conn } = ctx;
+
+  const room = getRoom(conn.roomId);
+  if (!room) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Room not found" },
+    });
+  }
+
+  const result = await room.requestSong(msg.payload.song, conn.user!.userId);
+
+  if (result === "duplicate") {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: {
+        message: "This song is already in the queue or pending approval",
+      },
+    });
+  }
+
+  const songData = result;
+
+  if (room.isAutoApproveSongs()) {
+    await sendQueueUpdate(conn.roomId, room);
+    const { song, started } = await room.promoteNextIfIdle();
+    if (started) {
+      broadcastToRoom(conn.roomId, {
+        type: ServerEvents.NOW_PLAYING_UPDATED,
+        payload: { song },
+      });
+    }
+  } else {
+    send(conn.ws, {
+      type: ServerEvents.SONG_REQUEST_SUBMITTED,
+      payload: { song: songData },
+    });
+    sendToAdmin(conn.roomId, room, {
+      type: ServerEvents.SONG_REQUESTED,
+      payload: { song: songData },
+    });
+  }
+}
+
+export async function handleUpvote(ws: WebSocket, msg: UpvoteSongMessage) {
+  const ctx = getJoinedConnection(ws);
+  if (!ctx) return;
+
+  const { conn } = ctx;
+
+  const room = getRoom(conn.roomId);
+  if (!room) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Room not found" },
+    });
+  }
+
+  if (msg.payload.userId !== conn.user!.userId) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Invalid upvote user" },
+    });
+  }
+
+  const result = await room.upvote(msg.payload.songId, conn.user!.userId);
+  if (result === "success") {
+    await sendUserUpvotesUsage(ws, room, conn.user!.userId);
+    return await sendQueueUpdate(conn.roomId, room);
+  }
+
+  if (result === "upvote_limit_reached") {
+    return send(ws, {
+      type: ServerEvents.ROOM_UPVOTE_LIMIT_REACHED,
+      payload: { maxUpvotes: room.getConfig().maxUpvotes },
+    });
+  }
+
+  if (result === "already_upvoted") {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "You have already upvoted this song in this room" },
+    });
+  }
+
+  return send(ws, {
+    type: ServerEvents.ERROR,
+    payload: { message: "Song not found in queue" },
+  });
+}
+
+export async function handleApproveSong(
+  ws: WebSocket,
+  msg: ApproveSongMessage,
+) {
+  const ctx = getJoinedConnection(ws);
+  if (!ctx) return;
+
+  const { conn } = ctx;
+
+  const room = getRoom(conn.roomId);
+  if (!room) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Room not found" },
+    });
+  }
+
+  if (conn.user!.userId !== room.getAdminId()) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Only admin can approve songs" },
+    });
+  }
+
+  const success = await room.approveSong(msg.payload.songId);
+  if (!success) {
+    send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Song not found in requests" },
+    });
+    return;
+  }
+
+  broadcastToRoom(conn.roomId, {
+    type: ServerEvents.SONG_APPROVED,
+    payload: { songId: msg.payload.songId },
+  });
+
+  const { song, started } = await room.promoteNextIfIdle();
+  if (started) {
+    broadcastToRoom(conn.roomId, {
+      type: ServerEvents.NOW_PLAYING_UPDATED,
+      payload: { song },
+    });
+  }
+
+  await sendQueueUpdate(conn.roomId, room);
+}
+
+export async function handleRejectSong(ws: WebSocket, msg: RejectSongMessage) {
+  const ctx = getJoinedConnection(ws);
+  if (!ctx) return;
+
+  const { conn } = ctx;
+
+  const room = getRoom(conn.roomId);
+  if (!room) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Room not found" },
+    });
+  }
+
+  if (conn.user!.userId !== room.getAdminId()) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Only admin can reject songs" },
+    });
+  }
+
+  const success = await room.rejectSong(msg.payload.songId);
+  if (success) {
+    broadcastToRoom(conn.roomId, {
+      type: ServerEvents.SONG_REJECTED,
+      payload: {
+        songId: success.id,
+        name: success.name,
+        artist: success.artist,
+        requestedByUserId: success.requestedByUserId,
+      },
+    });
+  } else {
+    send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Song not found in requests" },
+    });
+  }
+}
diff --git a/apps/room-server/src/handlers/users.ts b/apps/room-server/src/handlers/users.ts
new file mode 100644
index 0000000..8fa3d77
--- /dev/null
+++ b/apps/room-server/src/handlers/users.ts
@@ -0,0 +1,99 @@
+import type { WebSocket } from "ws";
+import { ServerEvents } from "../constants";
+import { getRoom } from "../lib/context";
+import { getJoinedConnection } from "../lib/guards";
+import {
+  admitUserToRoom,
+  sendPendingListToAdmin,
+} from "../lib/join-helpers";
+import { send, sendToUser } from "../lib/messaging";
+import type { ApproveUserMessage, RejectUserMessage } from "../types";
+
+export async function handleRejectUser(ws: WebSocket, msg: RejectUserMessage) {
+  const ctx = getJoinedConnection(ws);
+  if (!ctx) return;
+
+  const { conn } = ctx;
+
+  const room = getRoom(conn.roomId);
+  if (!room) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Room not found" },
+    });
+  }
+
+  if (conn.user!.userId !== room.getAdminId()) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "User is not admin" },
+    });
+  }
+
+  room.removeUserRequest(msg.payload.userId);
+
+  sendToUser(msg.payload.userId, {
+    type: ServerEvents.USER_REJECTED,
+    payload: {
+      roomId: conn.roomId,
+      message: "Your entry request was rejected by the admin.",
+    },
+  });
+
+  sendPendingListToAdmin(conn.roomId, room);
+}
+
+export async function handleApproveUser(
+  ws: WebSocket,
+  msg: ApproveUserMessage,
+) {
+  const ctx = getJoinedConnection(ws);
+  if (!ctx) return;
+
+  const { conn } = ctx;
+
+  const room = getRoom(conn.roomId);
+  if (!room) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "Room not found" },
+    });
+  }
+
+  if (conn.user!.userId !== room.getAdminId()) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "User is not admin" },
+    });
+  }
+
+  const user = room.getUserRequested(msg.payload.userId);
+  if (!user) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: { message: "User not found in requested list" },
+    });
+  }
+
+  if (room.isAtUserCapacity(user.userId)) {
+    return send(ws, {
+      type: ServerEvents.ERROR,
+      payload: {
+        message: `Room is full (${room.getConfig().maxUsers} users max)`,
+      },
+    });
+  }
+
+  const admitted = await admitUserToRoom(conn.roomId, room, user);
+  if (!admitted) {
+    send(ws, {
+      type: ServerEvents.ERROR,
+      payload: {
+        message: `Room is full (${room.getConfig().maxUsers} users max)`,
+      },
+    });
+    return;
+  }
+
+  sendPendingListToAdmin(conn.roomId, room);
+}
diff --git a/apps/room-server/src/index.ts b/apps/room-server/src/index.ts
index 9a03b37..23f3b18 100644
--- a/apps/room-server/src/index.ts
+++ b/apps/room-server/src/index.ts
@@ -1,11 +1,49 @@
 import { WebSocketServer } from "ws";
 import { handleMessage, handleDisconnect } from "./handerFunctions";
+import { connections } from "./lib/context";
+import { verifyRoomToken } from "./lib/ws-auth";
 
 const PORT = Number(process.env.WS_PORT) || 3001;
-const wss = new WebSocketServer({ port: PORT });
+const ALLOWED_ORIGIN =
+  process.env.NEXT_PUBLIC_WEB_APP_URL || process.env.WEB_APP_URL;
 
-wss.on("connection", (ws) => {
-  console.log("A client connected");
+const wss = new WebSocketServer({
+  port: PORT,
+  maxPayload: 64 * 1024,
+  verifyClient: (info, callback) => {
+    if (!ALLOWED_ORIGIN) {
+      callback(true);
+      return;
+    }
+
+    const origin = info.origin;
+    if (!origin || origin === ALLOWED_ORIGIN) {
+      callback(true);
+      return;
+    }
+
+    callback(false, 403, "Forbidden");
+  },
+});
+
+wss.on("connection", async (ws, req) => {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const auth = await verifyRoomToken(url.searchParams.get("token"));
+
+  if (!auth) {
+    ws.close(4401, "Unauthorized");
+    return;
+  }
+
+  connections.set(ws, {
+    ws,
+    auth,
+    user: null,
+    roomId: "",
+    status: "pending",
+  });
+
+  console.log(`Client connected (user=${auth.userId}, room=${auth.roomId})`);
 
   ws.on("message", (data) => {
     handleMessage(ws, data.toString()).catch((err) => {
diff --git a/apps/room-server/src/lib/context.ts b/apps/room-server/src/lib/context.ts
new file mode 100644
index 0000000..c499eca
--- /dev/null
+++ b/apps/room-server/src/lib/context.ts
@@ -0,0 +1,10 @@
+import type { WebSocket } from "ws";
+import { Room } from "../room";
+import type { ClientConnection } from "../types";
+
+export const roomCache = new Map<string, Room>();
+export const connections = new Map<WebSocket, ClientConnection>();
+
+export function getRoom(roomId: string): Room | null {
+  return roomCache.get(roomId) ?? null;
+}
diff --git a/apps/room-server/src/lib/guards.ts b/apps/room-server/src/lib/guards.ts
new file mode 100644
index 0000000..3b2d2e3
--- /dev/null
+++ b/apps/room-server/src/lib/guards.ts
@@ -0,0 +1,27 @@
+import type { WebSocket } from "ws";
+import { ServerEvents } from "../constants";
+import type { ClientConnection } from "../types";
+import { connections } from "./context";
+import { send } from "./messaging";
+
+export type HandlerContext = {
+  ws: WebSocket;
+  conn: ClientConnection;
+};
+
+function sendError(ws: WebSocket, message: string) {
+  send(ws, { type: ServerEvents.ERROR, payload: { message } });
+}
+
+export function getJoinedConnection(ws: WebSocket): HandlerContext | null {
+  const conn = connections.get(ws);
+  if (!conn || !conn.user) {
+    sendError(ws, "Not in a room");
+    return null;
+  }
+  if (conn.status !== "joined") {
+    sendError(ws, "You have not joined this room yet");
+    return null;
+  }
+  return { ws, conn };
+}
diff --git a/apps/room-server/src/lib/join-helpers.ts b/apps/room-server/src/lib/join-helpers.ts
new file mode 100644
index 0000000..9d6c18f
--- /dev/null
+++ b/apps/room-server/src/lib/join-helpers.ts
@@ -0,0 +1,169 @@
+import type { WebSocket } from "ws";
+import { ServerEvents } from "../constants";
+import type { Room } from "../room";
+import type { UserPayload } from "../types";
+import { connections } from "./context";
+import {
+  broadcastToRoom,
+  send,
+  sendToAdmin,
+  sendUserLimitReached,
+} from "./messaging";
+
+export type UserPayloadWithWs = UserPayload & { ws: WebSocket };
+
+export async function sendQueueUpdate(roomId: string, room: Room) {
+  const queue = await room.loadSongs();
+  broadcastToRoom(roomId, {
+    type: ServerEvents.QUEUE_UPDATED,
+    payload: { queue },
+  });
+}
+
+export function sendPendingListToAdmin(roomId: string, room: Room) {
+  sendToAdmin(roomId, room, {
+    type: ServerEvents.PENDING_JOIN_REQUESTS,
+    payload: { users: room.getUsersRequestedList() },
+  });
+}
+
+async function broadcastRoomSnapshot(roomId: string, room: Room) {
+  const currentSong = await room.getCurrentSong();
+  const queue = await room.loadSongs();
+
+  broadcastToRoom(roomId, {
+    type: ServerEvents.MEMBERS_UPDATED,
+    payload: { users: room.getUsers() },
+  });
+
+  broadcastToRoom(roomId, {
+    type: ServerEvents.NOW_PLAYING_UPDATED,
+    payload: { song: currentSong ?? null },
+  });
+
+  broadcastToRoom(roomId, {
+    type: ServerEvents.QUEUE_UPDATED,
+    payload: { queue },
+  });
+}
+
+export async function sendJoinedSnapshotToClient(
+  ws: WebSocket,
+  roomId: string,
+  room: Room,
+  userId: string,
+) {
+  const currentSong = await room.getCurrentSong();
+  const queue = await room.loadSongs();
+  const upvotesUsed = await room.getUserUpvoteCount(userId);
+
+  send(ws, {
+    type: ServerEvents.ROOM_JOINED,
+    payload: { roomId, config: room.getConfig(), upvotesUsed },
+  });
+  send(ws, {
+    type: ServerEvents.MEMBERS_UPDATED,
+    payload: { users: room.getUsers() },
+  });
+  send(ws, {
+    type: ServerEvents.NOW_PLAYING_UPDATED,
+    payload: { song: currentSong ?? null },
+  });
+  send(ws, {
+    type: ServerEvents.QUEUE_UPDATED,
+    payload: { queue },
+  });
+}
+
+export async function admitUserToRoom(
+  roomId: string,
+  room: Room,
+  user: UserPayloadWithWs,
+) {
+  if (room.isAtUserCapacity(user.userId)) {
+    sendUserLimitReached(user.ws, room.getConfig().maxUsers);
+    return false;
+  }
+
+  const existing = connections.get(user.ws);
+  if (!existing?.auth) {
+    return false;
+  }
+
+  connections.set(user.ws, {
+    ...existing,
+    user: {
+      userId: user.userId,
+      username: user.username,
+      email: user.email,
+      isAdmin: user.isAdmin,
+    },
+    roomId,
+    status: "joined",
+  });
+  room.addUser({
+    userId: user.userId,
+    email: user.email,
+    username: user.username,
+    isAdmin: user.isAdmin,
+  });
+  room.removeUserRequest(user.userId);
+
+  const upvotesUsed = await room.getUserUpvoteCount(user.userId);
+
+  send(user.ws, {
+    type: ServerEvents.ROOM_JOINED,
+    payload: {
+      roomId,
+      config: room.getConfig(),
+      upvotesUsed,
+    },
+  });
+
+  await broadcastRoomSnapshot(roomId, room);
+  return true;
+}
+
+export async function notifyPendingUsersOnAdminJoin(
+  roomId: string,
+  room: Room,
+) {
+  const pendingUsers = room.getPendingUserRequests();
+
+  for (const pendingUser of pendingUsers) {
+    if (room.isAutoApproveUsers()) {
+      const admitted = await admitUserToRoom(roomId, room, pendingUser);
+      if (!admitted) {
+        room.removeUserRequest(pendingUser.userId);
+      }
+    } else if (!room.isAtUserCapacity(pendingUser.userId)) {
+      send(pendingUser.ws, {
+        type: ServerEvents.ADMIN_JOINED,
+        payload: {},
+      });
+    } else {
+      sendUserLimitReached(pendingUser.ws, room.getConfig().maxUsers);
+      room.removeUserRequest(pendingUser.userId);
+    }
+  }
+}
+
+export async function completeDirectJoin(
+  ws: WebSocket,
+  roomId: string,
+  room: Room,
+  userId: string,
+) {
+  const upvotesUsed = await room.getUserUpvoteCount(userId);
+
+  send(ws, {
+    type: ServerEvents.ROOM_JOINED,
+    payload: {
+      roomId,
+      config: room.getConfig(),
+      upvotesUsed,
+    },
+  });
+
+  await broadcastRoomSnapshot(roomId, room);
+}
diff --git a/apps/room-server/src/lib/messaging.ts b/apps/room-server/src/lib/messaging.ts
new file mode 100644
index 0000000..554d21b
--- /dev/null
+++ b/apps/room-server/src/lib/messaging.ts
@@ -0,0 +1,55 @@
+import type { WebSocket } from "ws";
+import { ServerEvents } from "../constants";
+import type { Room } from "../room";
+import type { OutgoingMessage } from "../types";
+import { connections } from "./context";
+
+export function send(ws: WebSocket, message: OutgoingMessage) {
+  if (ws.readyState === ws.OPEN) {
+    ws.send(JSON.stringify(message));
+  }
+}
+
+export function broadcastToRoom(roomId: string, message: OutgoingMessage) {
+  for (const [, conn] of connections) {
+    if (conn.roomId === roomId && conn.status === "joined") {
+      send(conn.ws, message);
+    }
+  }
+}
+
+export function sendToAdmin(roomId: string, room: Room, message: OutgoingMessage) {
+  const adminId = room.getAdminId();
+  for (const [, conn] of connections) {
+    if (conn.roomId === roomId && conn.user?.userId === adminId) {
+      send(conn.ws, message);
+    }
+  }
+}
+
+export function sendToUser(userId: string, message: OutgoingMessage) {
+  for (const [, conn] of connections) {
+    if (conn.user?.userId === userId) {
+      send(conn.ws, message);
+    }
+  }
+}
+
+export function sendUserLimitReached(ws: WebSocket, maxUsers: number) {
+  send(ws, {
+    type: ServerEvents.ROOM_USER_LIMIT_REACHED,
+    payload: { maxUsers },
+  });
+}
+
+export async function sendUserUpvotesUsage(
+  ws: WebSocket,
+  room: Room,
+  userId: string,
+) {
+  const used = await room.getUserUpvoteCount(userId);
+  send(ws, {
+    type: ServerEvents.USER_UPVOTES_USAGE,
+    payload: { used, maxUpvotes: room.getConfig().maxUpvotes },
+  });
+}
diff --git a/apps/room-server/src/lib/user.ts b/apps/room-server/src/lib/user.ts
new file mode 100644
index 0000000..afe67f3
--- /dev/null
+++ b/apps/room-server/src/lib/user.ts
@@ -0,0 +1,21 @@
+import { prisma } from "@repo/db";
+import type { UserPayload } from "../types";
+
+export async function resolveUserPayload(
+  userId: string,
+  roomAdminId: string,
+): Promise<UserPayload | null> {
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+    select: { id: true, email: true, name: true },
+  });
+
+  if (!user) return null;
+
+  return {
+    userId: user.id,
+    email: user.email,
+    username: user.name || user.email.split("@")[0] || "User",
+    isAdmin: userId === roomAdminId,
+  };
+}
diff --git a/apps/room-server/src/lib/ws-auth.ts b/apps/room-server/src/lib/ws-auth.ts
new file mode 100644
index 0000000..798210c
--- /dev/null
+++ b/apps/room-server/src/lib/ws-auth.ts
@@ -0,0 +1,33 @@
+import * as jose from "jose";
+
+export type WsTokenPayload = {
+  userId: string;
+  roomId: string;
+};
+
+function getWsSecret(): Uint8Array {
+  const secret = process.env.WS_SECRET;
+  if (!secret) {
+    throw new Error("WS_SECRET is not configured");
+  }
+  return new TextEncoder().encode(secret);
+}
+
+export async function verifyRoomToken(
+  token: string | null | undefined,
+): Promise<WsTokenPayload | null> {
+  if (!token) return null;
+
+  try {
+    const { payload } = await jose.jwtVerify(token, getWsSecret());
+    const userId = payload.userId;
+    const roomId = payload.roomId;
+
+    if (typeof userId !== "string" || !userId) return null;
+    if (typeof roomId !== "string" || !roomId) return null;
+
+    return { userId, roomId };
+  } catch {
+    return null;
+  }
+}
diff --git a/apps/room-server/src/room.ts b/apps/room-server/src/room.ts
index 86a6baf..5249b26 100644
--- a/apps/room-server/src/room.ts
+++ b/apps/room-server/src/room.ts
@@ -1,4 +1,4 @@
-import { prisma } from "@repo/db";
+import { prisma, Prisma, type Song } from "@repo/db";
 import type {
   RoomConfig,
   SongPayload,
@@ -9,7 +9,24 @@ import type {
 import { createId } from "@paralleldrive/cuid2";
 import type { WebSocket } from "ws";
 
-type UpvoteResult = "success" | "already_upvoted" | "song_not_found";
+type PromoteNextIfIdleResult = {
+  song: SongData | null;
+  started: boolean;
+};
+
+type UpvoteResult =
+  | "success"
+  | "already_upvoted"
+  | "song_not_found"
+  | "upvote_limit_reached";
+
+export type RequestSongResult = SongData | "duplicate";
+export type RejectedSongResult = {
+  id: string;
+  name: string;
+  artist: string;
+  requestedByUserId: string | null;
+} | null;
 
 type UserPayloadWithWs = UserPayload & {
   ws: WebSocket;
@@ -20,11 +37,50 @@ export class Room {
   private users: Map<string, UserPayload> = new Map();
   private adminJoined: boolean = false;
   private usersRequested: Map<string, UserPayloadWithWs> = new Map();
+  private queueLock: Promise<unknown> = Promise.resolve();
 
   constructor(config: RoomConfig) {
     this.config = config;
   }
 
+  private async withQueueLock<T>(fn: () => Promise<T>): Promise<T> {
+    const result = this.queueLock.then(fn);
+    this.queueLock = result.then(
+      () => undefined,
+      () => undefined,
+    );
+    return result;
+  }
+
+  private toSongData(song: Song): SongData {
+    return {
+      id: song.id,
+      songId: song.songId,
+      name: song.name,
+      artist: song.artist,
+      url: song.url,
+      upvotes: song.upvotes,
+      imgUrl: song.imgUrl,
+      status: song.status,
+    };
+  }
+
+  private async findTopQueuedSongForUpdate(
+    tx: Prisma.TransactionClient,
+  ): Promise<string | null> {
+    const rows = await tx.$queryRaw<{ id: string }[]>`
+      SELECT id
+      FROM "song"
+      WHERE "roomId" = ${this.config.id}
+        AND status = 'QUEUED'::"SongStatus"
+      ORDER BY upvotes DESC, "createdAt" ASC
+      LIMIT 1
+      FOR UPDATE SKIP LOCKED
+    `;
+
+    return rows[0]?.id ?? null;
+  }
+
   addUser(user: UserPayload): void {
     this.users.set(user.userId, user);
   }
@@ -37,6 +93,27 @@ export class Room {
     return Array.from(this.users.values());
   }
 
+  getMemberCount(): number {
+    return this.users.size;
+  }
+
+  hasUser(userId: string): boolean {
+    return this.users.has(userId);
+  }
+
+  isAtUserCapacity(userId: string): boolean {
+    if (this.hasUser(userId) || userId === this.config.admin) {
+      return false;
+    }
+    return this.getMemberCount() >= this.config.maxUsers;
+  }
+
+  async getUserUpvoteCount(userId: string): Promise<number> {
+    return prisma.songUpvoteHistory.count({
+      where: { roomId: this.config.id, userId },
+    });
+  }
+
   getConfig(): RoomConfig {
     return this.config;
   }
@@ -90,6 +167,10 @@ export class Room {
     return this.usersRequested.get(userId);
   }
 
+  getPendingUserRequests(): UserPayloadWithWs[] {
+    return Array.from(this.usersRequested.values());
+  }
+
   clearUsersRequested(): void {
     this.usersRequested.clear();
   }
@@ -102,21 +183,11 @@ export class Room {
     return song;
   }
 
-  static async findOrCreate(roomId: string, adminId: string): Promise<Room> {
-    let dbRoom = await prisma.room.findUnique({ where: { id: roomId } });
+  static async find(roomId: string): Promise<Room | null> {
+    const dbRoom = await prisma.room.findUnique({ where: { id: roomId } });
 
     if (!dbRoom) {
-      dbRoom = await prisma.room.create({
-        data: {
-          id: roomId,
-          name: roomId,
-          adminId,
-          maxUpvotes: 10,
-          maxUsers: 10,
-          autoApproveSongs: false,
-          autoApproveUsers: false,
-        },
-      });
+      return null;
     }
 
     return new Room({
@@ -130,43 +201,48 @@ export class Room {
     });
   }
 
-  async requestSong(songPayload: SongPayload): Promise<SongData> {
-    const song = await prisma.song.create({
-      data: {
-        name: songPayload.name,
-        artist: songPayload.artist,
-        url: songPayload.url,
-        imgUrl: songPayload.imgUrl,
-        roomId: this.config.id,
-        status: this.config.autoApproveSongs ? "QUEUED" : "REQUESTED",
-      },
-    });
-
-    // if (!this.config.autoApproveSongs) {
-    //   const timeout = setTimeout(async () => {
-    //     songRequestTimeouts.delete(song.id);
-    //     await prisma.song
-    //       .update({
-    //         where: { id: song.id },
-    //         data: { status: "REJECTED" },
-    //       })
-    //       .catch(() => {});
-    //   }, SONG_REQUEST_TIMEOUT);
-    //   songRequestTimeouts.set(song.id, timeout);
-    // }
-
-    return {
-      id: song.id,
-      name: song.name,
-      artist: song.artist,
-      url: song.url,
-      upvotes: song.upvotes,
-      imgUrl: song.imgUrl,
-      status: song.status,
-    };
+  async requestSong(
+    songPayload: SongPayload,
+    requestedByUserId: string,
+  ): Promise<RequestSongResult> {
+    return this.withQueueLock(async () =>
+      prisma.$transaction(async (tx) => {
+        const existing = await tx.song.findFirst({
+          where: {
+            roomId: this.config.id,
+            songId: songPayload.songId,
+            status: { in: ["REQUESTED", "QUEUED", "PLAYING"] },
+          },
+        });
+
+        if (existing) {
+          return "duplicate";
+        }
+
+        const song = await tx.song.create({
+          data: {
+            songId: songPayload.songId,
+            name: songPayload.name,
+            artist: songPayload.artist,
+            url: songPayload.url,
+            imgUrl: songPayload.imgUrl,
+            requestedByUserId,
+            roomId: this.config.id,
+            status: this.config.autoApproveSongs ? "QUEUED" : "REQUESTED",
+          },
+        });
+
+        return this.toSongData(song);
+      }),
+    );
   }
 
   async upvote(songId: string, userId: string): Promise<UpvoteResult> {
+    const upvotesUsed = await this.getUserUpvoteCount(userId);
+    if (upvotesUsed >= this.config.maxUpvotes) {
+      return "upvote_limit_reached";
+    }
+
     const result = await prisma.$transaction(async (tx) => {
       const song = await tx.song.findFirst({
         where: { id: songId, roomId: this.config.id, status: "QUEUED" },
@@ -177,6 +253,13 @@ export class Room {
         return "song_not_found" satisfies UpvoteResult;
       }
 
+      const upvotesInRoom = await tx.songUpvoteHistory.count({
+        where: { roomId: this.config.id, userId },
+      });
+      if (upvotesInRoom >= this.config.maxUpvotes) {
+        return "upvote_limit_reached" satisfies UpvoteResult;
+      }
+
       const insertedRows = await tx.$executeRaw`
         INSERT INTO "song_upvote_history" ("id", "roomId", "songId", "userId", "createdAt")
         VALUES (${createId()}, ${this.config.id}, ${songId}, ${userId}, NOW())
@@ -198,37 +281,51 @@ export class Room {
     return result;
   }
 
+  async getCurrentSong(): Promise<SongData | null> {
+    const song = await prisma.song.findFirst({
+      where: { roomId: this.config.id, status: "PLAYING" },
+    });
+    if (!song) return null;
+    return {
+      id: song.id,
+      songId: song.songId,
+      name: song.name,
+      artist: song.artist,
+      url: song.url,
+      upvotes: song.upvotes,
+      imgUrl: song.imgUrl,
+      status: song.status,
+    };
+  }
+
   async approveSong(songId: string): Promise<boolean> {
     try {
       await prisma.song.update({
         where: { id: songId, roomId: this.config.id, status: "REQUESTED" },
         data: { status: "QUEUED" },
       });
-      // const timeout = songRequestTimeouts.get(songId);
-      // if (timeout) {
-      //   clearTimeout(timeout);
-      //   songRequestTimeouts.delete(songId);
-      // }
       return true;
-    } catch {
+    } catch (error) {
+      console.error("Error approving song:", error);
       return false;
     }
   }
 
-  async rejectSong(songId: string): Promise<boolean> {
+  async rejectSong(songId: string): Promise<RejectedSongResult> {
     try {
-      await prisma.song.update({
+      const song = await prisma.song.update({
         where: { id: songId, roomId: this.config.id, status: "REQUESTED" },
         data: { status: "REJECTED" },
+        select: {
+          id: true,
+          name: true,
+          artist: true,
+          requestedByUserId: true,
+        },
       });
-      // const timeout = songRequestTimeouts.get(songId);
-      // if (timeout) {
-      //   clearTimeout(timeout);
-      //   songRequestTimeouts.delete(songId);
-      // }
-      return true;
+      return song;
     } catch {
-      return false;
+      return null;
     }
   }
 
@@ -239,6 +336,7 @@ export class Room {
     });
     return songs.map((s) => ({
       id: s.id,
+      songId: s.songId,
       name: s.name,
       artist: s.artist,
       url: s.url,
@@ -255,6 +353,7 @@ export class Room {
     });
     return songs.map((s) => ({
       id: s.id,
+      songId: s.songId,
       name: s.name,
       artist: s.artist,
       url: s.url,
@@ -265,52 +364,78 @@ export class Room {
   }
 
   async playCurrentSong(): Promise<SongData | null> {
-    const song = await prisma.song.findFirst({
-      where: { roomId: this.config.id, status: "PLAYING" },
-    });
-    if (song) {
-      return {
-        id: song.id,
-        name: song.name,
-        artist: song.artist,
-        url: song.url,
-        upvotes: song.upvotes,
-        imgUrl: song.imgUrl,
-        status: song.status,
-      };
-    }
-    return await this.playNextSong();
+    return this.getCurrentSong();
   }
 
-  async playNextSong(): Promise<SongData | null> {
-    // Delete the currently playing song (if any)
-    await prisma.song.deleteMany({
-      where: { roomId: this.config.id, status: "PLAYING" },
-    });
-
-    // Get the top queued song (highest upvotes, earliest created)
-    const next = await prisma.song.findFirst({
-      where: { roomId: this.config.id, status: "QUEUED" },
-      orderBy: [{ upvotes: "desc" }, { createdAt: "asc" }],
-    });
-
-    if (!next) {
-      return null;
-    }
-
-    const updated = await prisma.song.update({
-      where: { id: next.id },
-      data: { status: "PLAYING" },
-    });
+  async promoteNextIfIdle(): Promise<PromoteNextIfIdleResult> {
+    return this.withQueueLock(async () =>
+      prisma.$transaction(async (tx) => {
+        const playing = await tx.song.findFirst({
+          where: { roomId: this.config.id, status: "PLAYING" },
+        });
+
+        if (playing) {
+          return { song: this.toSongData(playing), started: false };
+        }
+
+        const nextSongId = await this.findTopQueuedSongForUpdate(tx);
+        if (!nextSongId) {
+          return { song: null, started: false };
+        }
+
+        const promoted = await tx.song.updateMany({
+          where: {
+            id: nextSongId,
+            roomId: this.config.id,
+            status: "QUEUED",
+          },
+          data: { status: "PLAYING" },
+        });
+
+        if (promoted.count === 0) {
+          return { song: null, started: false };
+        }
+
+        const updated = await tx.song.findUniqueOrThrow({
+          where: { id: nextSongId },
+        });
+
+        return { song: this.toSongData(updated), started: true };
+      }),
+    );
+  }
 
-    return {
-      id: updated.id,
-      name: updated.name,
-      artist: updated.artist,
-      url: updated.url,
-      upvotes: updated.upvotes,
-      imgUrl: updated.imgUrl,
-      status: updated.status,
-    };
+  async playNextSong(): Promise<SongData | null> {
+    return this.withQueueLock(async () =>
+      prisma.$transaction(async (tx) => {
+        await tx.song.deleteMany({
+          where: { roomId: this.config.id, status: "PLAYING" },
+        });
+
+        const nextSongId = await this.findTopQueuedSongForUpdate(tx);
+        if (!nextSongId) {
+          return null;
+        }
+
+        const promoted = await tx.song.updateMany({
+          where: {
+            id: nextSongId,
+            roomId: this.config.id,
+            status: "QUEUED",
+          },
+          data: { status: "PLAYING" },
+        });
+
+        if (promoted.count === 0) {
+          return null;
+        }
+
+        const updated = await tx.song.findUniqueOrThrow({
+          where: { id: nextSongId },
+        });
+
+        return this.toSongData(updated);
+      }),
+    );
   }
 }
diff --git a/apps/room-server/src/types.ts b/apps/room-server/src/types.ts
index 21f3256..61ff0a7 100644
--- a/apps/room-server/src/types.ts
+++ b/apps/room-server/src/types.ts
@@ -3,8 +3,8 @@ import { WebSocket } from "ws";
 
 import { z } from "zod";
 import {
-  CLIENT_TO_SERVER_MESSAGE_TYPES,
-  SERVER_TO_CLIENT_MESSAGE_TYPES,
+  ClientEvents,
+  ServerEvents,
 } from "./constants";
 
 export const SongStatusSchema = z.enum([
@@ -32,6 +32,7 @@ export type UserShortPayload = z.infer<typeof UserShortPayloadSchema>;
 
 export const SongSchema = z.object({
   id: z.string().min(1),
+  songId: z.string().min(1),
   name: z.string().min(1),
   artist: z.string().min(1),
   url: z.url(),
@@ -68,8 +69,14 @@ export const RoomConfigSchema = z.object({
 
 export type RoomConfig = z.infer<typeof RoomConfigSchema>;
 
+export type WsAuth = {
+  userId: string;
+  roomId: string;
+};
+
 export type ClientConnection = {
   ws: WebSocket;
+  auth: WsAuth;
   user: UserPayload | null;
   roomId: string;
   status: "joined" | "pending";
@@ -78,17 +85,16 @@ export type ClientConnection = {
 // --- WS Message Types ---
 
 export const JoinRoomMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.JOIN_ROOM),
+  type: z.literal(ClientEvents.JOIN_ROOM),
   payload: z.object({
     roomId: z.string().min(1),
-    user: UserPayloadSchema,
   }),
 });
 
 export type JoinRoomMessage = z.infer<typeof JoinRoomMessageSchema>;
 
 export const RequestSongMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.REQUEST_SONG),
+  type: z.literal(ClientEvents.REQUEST_SONG),
   payload: z.object({
     song: SongPayloadSchema,
   }),
@@ -97,7 +103,7 @@ export const RequestSongMessageSchema = z.object({
 export type RequestSongMessage = z.infer<typeof RequestSongMessageSchema>;
 
 export const UpvoteSongMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.UPVOTE_SONG),
+  type: z.literal(ClientEvents.UPVOTE_SONG),
   payload: z.object({
     songId: z.string().min(1),
     userId: z.string().min(1),
@@ -107,7 +113,7 @@ export const UpvoteSongMessageSchema = z.object({
 export type UpvoteSongMessage = z.infer<typeof UpvoteSongMessageSchema>;
 
 export const ApproveSongMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.APPROVE_SONG),
+  type: z.literal(ClientEvents.APPROVE_SONG),
   payload: z.object({
     songId: z.string().min(1),
   }),
@@ -116,7 +122,7 @@ export const ApproveSongMessageSchema = z.object({
 export type ApproveSongMessage = z.infer<typeof ApproveSongMessageSchema>;
 
 export const RejectSongMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.REJECT_SONG),
+  type: z.literal(ClientEvents.REJECT_SONG),
   payload: z.object({
     songId: z.string().min(1),
   }),
@@ -125,21 +131,21 @@ export const RejectSongMessageSchema = z.object({
 export type RejectSongMessage = z.infer<typeof RejectSongMessageSchema>;
 
 export const ApproveUserMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.APPROVE_USER),
+  type: z.literal(ClientEvents.APPROVE_USER),
   payload: UserShortPayloadSchema,
 });
 
 export type ApproveUserMessage = z.infer<typeof ApproveUserMessageSchema>;
 
 export const RejectUserMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.REJECT_USER),
+  type: z.literal(ClientEvents.REJECT_USER),
   payload: UserShortPayloadSchema,
 });
 
 export type RejectUserMessage = z.infer<typeof RejectUserMessageSchema>;
 
 export const BroadcastNowPlayingMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.BROADCAST_NOW_PLAYING),
+  type: z.literal(ClientEvents.SYNC_NOW_PLAYING),
 });
 
 export type BroadcastNowPlayingMessage = z.infer<
@@ -147,7 +153,7 @@ export type BroadcastNowPlayingMessage = z.infer<
 >;
 
 export const NextSongMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.NEXT_SONG),
+  type: z.literal(ClientEvents.SKIP_TO_NEXT),
 });
 
 export type NextSongMessage = z.infer<typeof NextSongMessageSchema>;
@@ -169,7 +175,7 @@ export type IncomingMessage = z.infer<typeof IncomingMessageSchema>;
 // --- Server -> Client Messages ---
 
 export const QueueUpdateMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.QUEUE_UPDATE),
+  type: z.literal(ServerEvents.QUEUE_UPDATED),
   payload: z.object({
     queue: z.array(SongDataSchema),
   }),
@@ -178,7 +184,7 @@ export const QueueUpdateMessageSchema = z.object({
 export type QueueUpdateMessage = z.infer<typeof QueueUpdateMessageSchema>;
 
 export const SongRequestedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.SONG_REQUESTED),
+  type: z.literal(ServerEvents.SONG_REQUESTED),
   payload: z.object({
     song: SongDataSchema,
   }),
@@ -186,8 +192,19 @@ export const SongRequestedMessageSchema = z.object({
 
 export type SongRequestedMessage = z.infer<typeof SongRequestedMessageSchema>;
 
+export const SongRequestSubmittedMessageSchema = z.object({
+  type: z.literal(ServerEvents.SONG_REQUEST_SUBMITTED),
+  payload: z.object({
+    song: SongDataSchema,
+  }),
+});
+
+export type SongRequestSubmittedMessage = z.infer<
+  typeof SongRequestSubmittedMessageSchema
+>;
+
 export const SongApprovedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.SONG_APPROVED),
+  type: z.literal(ServerEvents.SONG_APPROVED),
   payload: z.object({
     songId: z.string().min(1),
   }),
@@ -196,16 +213,19 @@ export const SongApprovedMessageSchema = z.object({
 export type SongApprovedMessage = z.infer<typeof SongApprovedMessageSchema>;
 
 export const SongRejectedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.SONG_REJECTED),
+  type: z.literal(ServerEvents.SONG_REJECTED),
   payload: z.object({
     songId: z.string().min(1),
+    name: z.string().min(1),
+    artist: z.string().min(1),
+    requestedByUserId: z.string().min(1).nullable(),
   }),
 });
 
 export type SongRejectedMessage = z.infer<typeof SongRejectedMessageSchema>;
 
 export const ErrorMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR),
+  type: z.literal(ServerEvents.ERROR),
   payload: z.object({
     message: z.string().min(1),
   }),
@@ -214,32 +234,66 @@ export const ErrorMessageSchema = z.object({
 export type ErrorMessage = z.infer<typeof ErrorMessageSchema>;
 
 export const AdminNotJoinedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.ADMIN_NOT_JOINED),
+  type: z.literal(ServerEvents.WAITING_FOR_ADMIN),
   payload: z.object({}),
 });
 
 export type AdminNotJoinedMessage = z.infer<typeof AdminNotJoinedMessageSchema>;
 
 export const AdminLeftMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.ADMIN_LEFT),
+  type: z.literal(ServerEvents.ADMIN_LEFT),
   payload: z.object({}),
 });
 
 export type AdminLeftMessage = z.infer<typeof AdminLeftMessageSchema>;
 
 export const JoinedRoomMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.JOINED_ROOM),
+  type: z.literal(ServerEvents.ROOM_JOINED),
   payload: z.object({
     roomId: z.string().min(1),
     config: RoomConfigSchema,
-    queue: z.array(SongDataSchema),
+    upvotesUsed: z.number().int().nonnegative(),
+  }),
+});
+
+export const RoomUserLimitReachedMessageSchema = z.object({
+  type: z.literal(ServerEvents.ROOM_USER_LIMIT_REACHED),
+  payload: z.object({
+    maxUsers: z.number().int().nonnegative(),
   }),
 });
 
+export type RoomUserLimitReachedMessage = z.infer<
+  typeof RoomUserLimitReachedMessageSchema
+>;
+
+export const RoomUpvoteLimitReachedMessageSchema = z.object({
+  type: z.literal(ServerEvents.ROOM_UPVOTE_LIMIT_REACHED),
+  payload: z.object({
+    maxUpvotes: z.number().int().nonnegative(),
+  }),
+});
+
+export type RoomUpvoteLimitReachedMessage = z.infer<
+  typeof RoomUpvoteLimitReachedMessageSchema
+>;
+
+export const UserUpvotesUsageMessageSchema = z.object({
+  type: z.literal(ServerEvents.USER_UPVOTES_USAGE),
+  payload: z.object({
+    used: z.number().int().nonnegative(),
+    maxUpvotes: z.number().int().nonnegative(),
+  }),
+});
+
+export type UserUpvotesUsageMessage = z.infer<
+  typeof UserUpvotesUsageMessageSchema
+>;
+
 export type JoinedRoomMessage = z.infer<typeof JoinedRoomMessageSchema>;
 
 export const ListUsersMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.LIST_USERS),
+  type: z.literal(ServerEvents.MEMBERS_UPDATED),
   payload: z.object({
     users: z.array(UserPayloadSchema),
   }),
@@ -248,14 +302,14 @@ export const ListUsersMessageSchema = z.object({
 export type ListUsersMessage = z.infer<typeof ListUsersMessageSchema>;
 
 export const JoinRequestedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.JOIN_REQUESTED),
+  type: z.literal(ServerEvents.USER_JOIN_REQUESTED),
   payload: UserShortPayloadSchema,
 });
 
 export type JoinRequestedMessage = z.infer<typeof JoinRequestedMessageSchema>;
 
 export const RequestAlreadySentMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.REQUEST_ALREADY_SENT),
+  type: z.literal(ServerEvents.JOIN_ALREADY_PENDING),
   payload: z.object({}),
 });
 
@@ -264,27 +318,31 @@ export type RequestAlreadySentMessage = z.infer<
 >;
 
 export const AdminJoinedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.ADMIN_JOINED),
+  type: z.literal(ServerEvents.ADMIN_JOINED),
   payload: z.object({}),
 });
 
 export type AdminJoinedMessage = z.infer<typeof AdminJoinedMessageSchema>;
 
 export const UserApprovedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.USER_APPROVED),
+  type: z.literal(ServerEvents.USER_APPROVED),
   payload: UserShortPayloadSchema,
 });
 
 export type UserApprovedMessage = z.infer<typeof UserApprovedMessageSchema>;
 
 export const UserRejectedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.USER_REJECTED),
+  type: z.literal(ServerEvents.USER_REJECTED),
+  payload: z.object({
+    roomId: z.string().min(1),
+    message: z.string().min(1),
+  }),
 });
 
 export type UserRejectedMessage = z.infer<typeof UserRejectedMessageSchema>;
 
 export const UsersRequestedListMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.USERS_REQUESTED_LIST),
+  type: z.literal(ServerEvents.PENDING_JOIN_REQUESTS),
   payload: z.object({
     users: z.array(UserShortPayloadSchema),
   }),
@@ -294,8 +352,19 @@ export type UsersRequestedListMessage = z.infer<
   typeof UsersRequestedListMessageSchema
 >;
 
+export const PendingSongRequestsMessageSchema = z.object({
+  type: z.literal(ServerEvents.PENDING_SONG_REQUESTS),
+  payload: z.object({
+    songs: z.array(SongDataSchema),
+  }),
+});
+
+export type PendingSongRequestsMessage = z.infer<
+  typeof PendingSongRequestsMessageSchema
+>;
+
 export const NowPlayingUpdateMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.NOW_PLAYING_UPDATE),
+  type: z.literal(ServerEvents.NOW_PLAYING_UPDATED),
   payload: z.object({
     song: SongDataSchema.nullable(),
   }),
@@ -308,6 +377,7 @@ export type NowPlayingUpdateMessage = z.infer<
 export const OutgoingMessageSchema = z.discriminatedUnion("type", [
   QueueUpdateMessageSchema,
   SongRequestedMessageSchema,
+  SongRequestSubmittedMessageSchema,
   SongApprovedMessageSchema,
   SongRejectedMessageSchema,
   ErrorMessageSchema,
@@ -315,6 +385,9 @@ export const OutgoingMessageSchema = z.discriminatedUnion("type", [
   AdminJoinedMessageSchema,
   AdminLeftMessageSchema,
   JoinedRoomMessageSchema,
+  RoomUserLimitReachedMessageSchema,
+  RoomUpvoteLimitReachedMessageSchema,
+  UserUpvotesUsageMessageSchema,
   ListUsersMessageSchema,
   JoinRequestedMessageSchema,
   RequestAlreadySentMessageSchema,
@@ -322,6 +395,7 @@ export const OutgoingMessageSchema = z.discriminatedUnion("type", [
   UserRejectedMessageSchema,
   UsersRequestedListMessageSchema,
   NowPlayingUpdateMessageSchema,
+  PendingSongRequestsMessageSchema,
 ]);
 
 export type OutgoingMessage = z.infer<typeof OutgoingMessageSchema>;
diff --git a/apps/web/app/api/rooms/[id]/route.ts b/apps/web/app/api/rooms/[id]/route.ts
index 0f287b9..47ea87b 100644
--- a/apps/web/app/api/rooms/[id]/route.ts
+++ b/apps/web/app/api/rooms/[id]/route.ts
@@ -1,15 +1,14 @@
 import { NextRequest, NextResponse } from "next/server";
-import { auth } from "@/lib/auth";
+import { requireSession } from "@/lib/require-session";
 import { prisma } from "@repo/db";
 
 export async function GET(
   req: NextRequest,
   { params }: { params: Promise<{ id: string }> },
 ) {
-  const session = await auth.api.getSession({ headers: req.headers });
-
-  if (!session) {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  const authResult = await requireSession(req);
+  if (!authResult.ok) {
+    return authResult.response;
   }
 
   const { id } = await params;
diff --git a/apps/web/app/api/rooms/route.ts b/apps/web/app/api/rooms/route.ts
index a7bee90..55382e5 100644
--- a/apps/web/app/api/rooms/route.ts
+++ b/apps/web/app/api/rooms/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { auth } from "@/lib/auth";
+import { requireSession } from "@/lib/require-session";
 import { prisma } from "@repo/db";
 import { z } from "zod";
 
@@ -10,11 +10,11 @@ const createRoomBodySchema = z.object({
 });
 
 export async function GET(req: NextRequest) {
-  const session = await auth.api.getSession({ headers: req.headers });
-
-  if (!session) {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  const authResult = await requireSession(req);
+  if (!authResult.ok) {
+    return authResult.response;
   }
+  const { session } = authResult;
 
   const rooms = await prisma.room.findMany({
     where: { adminId: session.user.id },
@@ -32,11 +32,11 @@ export async function GET(req: NextRequest) {
 }
 
 export async function POST(req: NextRequest) {
-  const session = await auth.api.getSession({ headers: req.headers });
-
-  if (!session) {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  const authResult = await requireSession(req);
+  if (!authResult.ok) {
+    return authResult.response;
   }
+  const { session } = authResult;
 
   const parsedBody = createRoomBodySchema.safeParse(await req.json());
 
diff --git a/apps/web/app/api/spotify/search/route.ts b/apps/web/app/api/spotify/search/route.ts
index 39c3236..35cedba 100644
--- a/apps/web/app/api/spotify/search/route.ts
+++ b/apps/web/app/api/spotify/search/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { auth } from "@/lib/auth";
+import { requireSession } from "@/lib/require-session";
 import { prisma } from "@repo/db";
 import { SPOTIFY_BASE_URL, SPOTIFY_TOKEN_PATH } from "@/lib/constants";
 
@@ -91,10 +91,11 @@ async function getValidToken(userId: string): Promise<string | null> {
 }
 
 export async function GET(req: NextRequest) {
-  const session = await auth.api.getSession({ headers: req.headers });
-  if (!session) {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  const authResult = await requireSession(req);
+  if (!authResult.ok) {
+    return authResult.response;
   }
+  const { session } = authResult;
 
   const q = req.nextUrl.searchParams.get("q")?.trim();
   if (!q) {
diff --git a/apps/web/app/api/spotify/status/route.ts b/apps/web/app/api/spotify/status/route.ts
index 33a0db8..6794f16 100644
--- a/apps/web/app/api/spotify/status/route.ts
+++ b/apps/web/app/api/spotify/status/route.ts
@@ -1,15 +1,13 @@
 import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@repo/db";
-import { auth } from "@/lib/auth";
+import { requireSession } from "@/lib/require-session";
 
 export async function GET(req: NextRequest) {
-  const session = await auth.api.getSession({
-    headers: req.headers,
-  });
-
-  if (!session) {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  const authResult = await requireSession(req);
+  if (!authResult.ok) {
+    return authResult.response;
   }
+  const { session } = authResult;
 
   const user = await prisma.user.findUnique({
     where: { id: session.user.id },
diff --git a/apps/web/app/api/spotify/token/route.ts b/apps/web/app/api/spotify/token/route.ts
index bc92726..2ba05b3 100644
--- a/apps/web/app/api/spotify/token/route.ts
+++ b/apps/web/app/api/spotify/token/route.ts
@@ -1,4 +1,4 @@
-import { auth } from "@/lib/auth";
+import { requireSession } from "@/lib/require-session";
 import { SPOTIFY_BASE_URL, SPOTIFY_TOKEN_PATH } from "@/lib/constants";
 import { prisma } from "@repo/db";
 import { NextRequest, NextResponse } from "next/server";
@@ -12,13 +12,11 @@ type SpotifyRefreshResponse = {
 };
 
 export async function GET(req: NextRequest) {
-  const session = await auth.api.getSession({
-    headers: req.headers,
-  });
-
-  if (!session) {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  const authResult = await requireSession(req);
+  if (!authResult.ok) {
+    return authResult.response;
   }
+  const { session } = authResult;
 
   const user = await prisma.user.findUnique({
     where: { id: session.user.id },
diff --git a/apps/web/app/api/ws/token/route.ts b/apps/web/app/api/ws/token/route.ts
new file mode 100644
index 0000000..33de6b1
--- /dev/null
+++ b/apps/web/app/api/ws/token/route.ts
@@ -0,0 +1,36 @@
+import { requireSession } from "@/lib/require-session";
+import { generateRoomToken } from "@/lib/room-utils";
+import { prisma } from "@repo/db";
+import { NextRequest, NextResponse } from "next/server";
+
+export async function GET(req: NextRequest) {
+  const authResult = await requireSession(req);
+  if (!authResult.ok) {
+    return authResult.response;
+  }
+  const { session } = authResult;
+
+  const roomId = req.nextUrl.searchParams.get("roomId");
+  if (!roomId) {
+    return NextResponse.json({ error: "Room ID is required" }, { status: 400 });
+  }
+
+  const room = await prisma.room.findUnique({
+    where: { id: roomId },
+    select: { id: true },
+  });
+
+  if (!room) {
+    return NextResponse.json({ error: "Room not found" }, { status: 404 });
+  }
+
+  try {
+    const token = await generateRoomToken(session.user.id, roomId);
+    return NextResponse.json({ token });
+  } catch {
+    return NextResponse.json(
+      { error: "WebSocket authentication is not configured" },
+      { status: 500 },
+    );
+  }
+}
diff --git a/apps/web/app/layout.tsx b/apps/web/app/layout.tsx
index d548a77..3b61703 100644
--- a/apps/web/app/layout.tsx
+++ b/apps/web/app/layout.tsx
@@ -21,8 +21,9 @@ const fontMono = Fira_Code({
 });
 
 export const metadata: Metadata = {
-  title: "Create Turborepo",
-  description: "Generated by create turbo",
+  title: "Spotofy",
+  description:
+    "Spotofy is a collaborative Spotify listening app. Room admins create listening rooms; guests join, request songs, and upvote tracks. The room admin plays music through Spotify and controls the queue in real time.",
 };
 
 export default function RootLayout({
diff --git a/apps/web/app/room/[code]/_components/_client.tsx b/apps/web/app/room/[code]/_components/_client.tsx
index dea8cf9..ac016a7 100644
--- a/apps/web/app/room/[code]/_components/_client.tsx
+++ b/apps/web/app/room/[code]/_components/_client.tsx
@@ -40,17 +40,20 @@ export default function ClientPage({
     approveUser,
     rejectUser,
     requestNextSong,
+    broadcastNowPlaying,
     users,
     nowPlaying,
-  } = useWebSocket();
+    upvotesUsed,
+    canUpvote,
+  } = useWebSocket(code, user.userId);
 
   const [isAdmin] = useState(user.isAdmin);
 
   useEffect(() => {
     if (isConnected) {
-      joinRoom(code, user);
+      joinRoom(code);
     }
-  }, [isConnected, code, user, joinRoom, isAdmin]);
+  }, [isConnected, code, joinRoom]);
 
   const isJoiningScreenVisible = !isAdmin && joinState !== "joined";
 
@@ -77,6 +80,7 @@ export default function ClientPage({
                   spotifyToken={spotifyToken}
                   nowPlaying={nowPlaying}
                   requestNextSong={requestNextSong}
+                  onPlayerReady={broadcastNowPlaying}
                 />
 
                 <RequestSongSection
@@ -107,10 +111,17 @@ export default function ClientPage({
                   queue={queue}
                   userId={user.userId}
                   isConnected={isConnected}
+                  canUpvote={canUpvote}
+                  upvotesUsed={upvotesUsed}
+                  maxUpvotes={roomConfig?.maxUpvotes ?? 0}
                   upvoteSong={upvoteSong}
                 />
 
-                <UsersSidebar users={users} currentUserId={user.userId} />
+                <UsersSidebar
+                  users={users}
+                  currentUserId={user.userId}
+                  maxUsers={roomConfig?.maxUsers}
+                />
               </div>
             </div>
           )}
diff --git a/apps/web/app/room/[code]/_components/join-status-screen.tsx b/apps/web/app/room/[code]/_components/join-status-screen.tsx
index 9ca5029..a6a91d9 100644
--- a/apps/web/app/room/[code]/_components/join-status-screen.tsx
+++ b/apps/web/app/room/[code]/_components/join-status-screen.tsx
@@ -16,26 +16,36 @@ export default function JoinStatusScreen({
   joinState,
   joinError,
 }: JoinStatusScreenProps) {
-  const isWaitingForAdminApproval =
-    joinState === "blocked" || joinState === "joining";
+  const isWaitingForAdmin = joinState === "blocked";
+  const isWaitingForAdminApproval = joinState === "joining";
   const isRejected = joinState === "rejected";
+  const isRoomFull = joinState === "full";
 
   const joinStatusTitle = isRejected
     ? "Entry rejected by admin"
-    : isWaitingForAdminApproval
-      ? "Waiting for your entry approval by admin"
-      : "Joining room";
+    : isRoomFull
+      ? "Room is full"
+      : isWaitingForAdmin
+        ? "Waiting for the room admin"
+        : isWaitingForAdminApproval
+          ? "Waiting for your entry approval"
+          : "Joining room";
 
   const joinStatusDescription = isRejected
     ? (joinError ??
       "Your entry request was rejected by the admin. Please go back and try again later.")
-    : isWaitingForAdminApproval
-      ? "Please wait while the admin approves your entry into the room."
-      : connectionState === "error"
-        ? "There was a problem connecting to the room server."
-        : connectionState === "disconnected"
-          ? "Connecting you back to the room server."
-          : "We’re connecting you to the room. This screen will update once your join succeeds.";
+    : isRoomFull
+      ? (joinError ??
+        "This room has reached its member limit. Try again later or ask the admin to raise the limit.")
+      : isWaitingForAdmin
+        ? "The admin has not joined this room yet. You will be notified once they arrive."
+        : isWaitingForAdminApproval
+          ? "The admin is online. Please wait while they approve your entry into the room."
+          : connectionState === "error"
+            ? "There was a problem connecting to the room server."
+            : connectionState === "disconnected"
+              ? "Connecting you back to the room server."
+              : "We’re connecting you to the room. This screen will update once your join succeeds.";
 
   return (
     <motion.section
@@ -48,8 +58,10 @@ export default function JoinStatusScreen({
         <div className="absolute inset-0 bg-linear-to-b from-primary/5 via-transparent to-transparent pointer-events-none" />
         <div className="relative flex flex-col items-center text-center gap-5">
           <div className="flex h-16 w-16 items-center justify-center rounded-2xl bg-linear-to-br from-primary/20 to-accent/20">
-            {isRejected ? (
-              <AlertCircle className="w-8 h-8 text-red-500" />
+            {isRejected || isRoomFull ? (
+              <AlertCircle
+                className={`w-8 h-8 ${isRoomFull ? "text-amber-500" : "text-red-500"}`}
+              />
             ) : joinState === "blocked" ? (
               <Clock className="w-8 h-8 text-primary" />
             ) : (
diff --git a/apps/web/app/room/[code]/_components/now-playing-section.tsx b/apps/web/app/room/[code]/_components/now-playing-section.tsx
index 9ed8a9f..33ac7e1 100644
--- a/apps/web/app/room/[code]/_components/now-playing-section.tsx
+++ b/apps/web/app/room/[code]/_components/now-playing-section.tsx
@@ -11,6 +11,7 @@ type NowPlayingSectionProps = {
   spotifyToken: string | null;
   nowPlaying: SongData | null;
   requestNextSong: () => void;
+  onPlayerReady?: () => void;
 };
 
 export default function NowPlayingSection({
@@ -18,6 +19,7 @@ export default function NowPlayingSection({
   spotifyToken,
   nowPlaying,
   requestNextSong,
+  onPlayerReady,
 }: NowPlayingSectionProps) {
   return (
     <motion.section
@@ -66,6 +68,7 @@ export default function NowPlayingSection({
                 token={spotifyToken}
                 nowPlayingUrl={nowPlaying.url}
                 onSongEnd={requestNextSong}
+                onReady={onPlayerReady}
               />
             ) : (
               <div className="flex flex-col sm:flex-row gap-4 sm:gap-6 items-center sm:items-start">
diff --git a/apps/web/app/room/[code]/_components/queue-sidebar.tsx b/apps/web/app/room/[code]/_components/queue-sidebar.tsx
index b69d333..6f10604 100644
--- a/apps/web/app/room/[code]/_components/queue-sidebar.tsx
+++ b/apps/web/app/room/[code]/_components/queue-sidebar.tsx
@@ -1,5 +1,5 @@
 import { motion } from "motion/react";
-import { Clock, Music, ThumbsUp } from "lucide-react";
+import { Clock, Music, ThumbsUp, AlertTriangle } from "lucide-react";
 import Image from "next/image";
 
 import { Button } from "@repo/ui/components/ui/button";
@@ -9,6 +9,9 @@ type QueueSidebarProps = {
   queue: SongData[];
   userId: string;
   isConnected: boolean;
+  canUpvote: boolean;
+  upvotesUsed: number;
+  maxUpvotes: number;
   upvoteSong: (songId: string, userId: string) => void;
 };
 
@@ -16,8 +19,12 @@ export default function QueueSidebar({
   queue,
   userId,
   isConnected,
+  canUpvote,
+  upvotesUsed,
+  maxUpvotes,
   upvoteSong,
 }: QueueSidebarProps) {
+  const upvoteLimitReached = maxUpvotes > 0 && upvotesUsed >= maxUpvotes;
   return (
     <motion.aside
       initial={{ opacity: 0, y: 18 }}
@@ -33,6 +40,21 @@ export default function QueueSidebar({
         <span className="text-xs text-muted-foreground">{queue.length} songs</span>
       </div>
 
+      {upvoteLimitReached && (
+        <div className="mx-3 mt-3 flex items-start gap-2 rounded-lg border border-amber-500/30 bg-amber-500/10 px-3 py-2 text-xs text-amber-200">
+          <AlertTriangle className="mt-0.5 h-3.5 w-3.5 shrink-0" />
+          <p>
+            You&apos;ve used all {maxUpvotes} upvotes allowed in this room.
+          </p>
+        </div>
+      )}
+
+      {!upvoteLimitReached && maxUpvotes > 0 && upvotesUsed > 0 && (
+        <p className="px-4 pt-3 text-xs text-muted-foreground">
+          {upvotesUsed} / {maxUpvotes} upvotes used
+        </p>
+      )}
+
       <div className="p-3 space-y-2 max-h-80 sm:max-h-100 overflow-y-auto">
         {queue.length === 0 ? (
           <div className="text-center py-8 text-muted-foreground">
@@ -67,7 +89,12 @@ export default function QueueSidebar({
                   <motion.div whileHover={{ scale: 1.05 }} whileTap={{ scale: 0.95 }}>
                     <Button
                       onClick={() => upvoteSong(song.id, userId)}
-                      disabled={!isConnected}
+                      disabled={!isConnected || !canUpvote}
+                      title={
+                        !canUpvote
+                          ? `Upvote limit reached (${maxUpvotes} per room)`
+                          : undefined
+                      }
                       variant="outline"
                       className="h-auto rounded-lg bg-primary/10 hover:bg-primary/20 px-2 py-1 text-xs font-medium text-primary"
                       type="button"
diff --git a/apps/web/app/room/[code]/_components/request-song-section.tsx b/apps/web/app/room/[code]/_components/request-song-section.tsx
index a20399e..e78803a 100644
--- a/apps/web/app/room/[code]/_components/request-song-section.tsx
+++ b/apps/web/app/room/[code]/_components/request-song-section.tsx
@@ -30,6 +30,7 @@ type RequestSongSectionProps = {
   isConnected: boolean;
   autoApproveSongs: boolean;
   requestSong: (song: {
+    songId: string;
     name: string;
     artist: string;
     url: string;
@@ -92,6 +93,7 @@ export default function RequestSongSection({
   const handleRequestSong = () => {
     if (!selectedSong) return;
     requestSong({
+      songId: selectedSong.id,
       name: selectedSong.name,
       artist: selectedSong.artist,
       url: selectedSong.url,
diff --git a/apps/web/app/room/[code]/_components/spotify-player.tsx b/apps/web/app/room/[code]/_components/spotify-player.tsx
index 2b83fa1..60f0dfb 100644
--- a/apps/web/app/room/[code]/_components/spotify-player.tsx
+++ b/apps/web/app/room/[code]/_components/spotify-player.tsx
@@ -12,8 +12,13 @@ import {
   Pause,
   ChevronRight,
   Repeat,
+  Repeat1,
 } from "lucide-react";
 
+/** SDK repeat_mode: 0 = off, 1 = context, 2 = track */
+type SdkRepeatMode = 0 | 1 | 2;
+type RepeatApiState = "off" | "track" | "context";
+
 type SpotifyPlayer = {
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   addListener: (event: string, cb: (arg: any) => void) => void;
@@ -27,7 +32,10 @@ type SpotifyPlayer = {
 
 type SpotifyPlaybackState = {
   paused: boolean;
-  track_window: { current_track: SpotifyTrack };
+  track_window: {
+    previous_tracks: SpotifyTrack[];
+    current_track: SpotifyTrack;
+  };
 };
 
 declare global {
@@ -44,6 +52,7 @@ declare global {
 }
 
 type SpotifyTrack = {
+  id: string;
   uri: string;
   name: string;
   artists: { name: string }[];
@@ -60,13 +69,7 @@ type Props = {
 type ExtendedPlaybackState = SpotifyPlaybackState & {
   position: number;
   duration: number;
-};
-
-type PlaybackSnapshot = {
-  uri: string;
-  paused: boolean;
-  position: number;
-  duration: number;
+  repeat_mode: SdkRepeatMode;
 };
 
 function reportPlayerError(
@@ -119,27 +122,51 @@ export default function SpotifyWebPlayer({
   const nowPlayingUrlRef = useRef<string | null | undefined>(nowPlayingUrl);
   const onReadyRef = useRef(onReady);
   const onSongEndRef = useRef(onSongEnd);
-  const prevPlaybackRef = useRef<PlaybackSnapshot | null>(null);
-  const songEndFiredRef = useRef(false);
   const [isPaused, setPaused] = useState(false);
   const [isActive, setActive] = useState(false);
   const [currentTrack, setCurrentTrack] = useState<SpotifyTrack | null>(null);
+  const [repeatMode, setRepeatMode] = useState<SdkRepeatMode>(0);
+  const lastEndedTrackIdRef = useRef<string | null>(null);
+  const endOfTrackDebounceRef = useRef<NodeJS.Timeout | null>(null);
 
-  useEffect(() => {
-    tokenRef.current = token;
-  }, [token]);
+  tokenRef.current = token;
+  nowPlayingUrlRef.current = nowPlayingUrl;
+  onReadyRef.current = onReady;
+  onSongEndRef.current = onSongEnd;
 
-  useEffect(() => {
-    nowPlayingUrlRef.current = nowPlayingUrl;
-  }, [nowPlayingUrl]);
+  const setRepeat = useCallback(async (state: RepeatApiState): Promise<boolean> => {
+    const deviceId = deviceIdRef.current;
+    if (!deviceId) return false;
+
+    const fresh = await fetchFreshToken();
+    const accessToken = fresh ?? tokenRef.current;
+    const response = await fetch(
+      `https://api.spotify.com/v1/me/player/repeat?state=${state}&device_id=${deviceId}`,
+      {
+        method: "PUT",
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          "Content-Type": "application/json",
+        },
+      },
+    );
+
+    if (!response.ok) {
+      reportPlayerError(
+        "Failed to update repeat mode.",
+        undefined,
+        "spotify-player-repeat-error",
+      );
+      return false;
+    }
 
-  // useEffect(() => {
-  //   onReadyRef.current = onReady;
-  // }, [onReady]);
+    return true;
+  }, []);
 
-  useEffect(() => {
-    onSongEndRef.current = onSongEnd;
-  }, [onSongEnd]);
+  const toggleRepeat = useCallback(async () => {
+    const nextState: RepeatApiState = repeatMode === 0 ? "track" : "off";
+    await setRepeat(nextState);
+  }, [repeatMode, setRepeat]);
 
   const play = useCallback(async () => {
     const currentNowPlayingUrl = nowPlayingUrlRef.current;
@@ -171,36 +198,11 @@ export default function SpotifyWebPlayer({
         undefined,
         "spotify-player-play-error",
       );
+      return;
     }
-  }, []);
-
-  const stopRepeat = useCallback(async () => {
-    const fresh = await fetchFreshToken();
-    const accessToken = fresh ?? tokenRef.current;
-    await fetch(
-      `https://api.spotify.com/v1/me/player/repeat?state=off&device_id=${deviceIdRef.current}`,
-      {
-        method: "PUT",
-        headers: {
-          Authorization: `Bearer ${accessToken}`,
-          "Content-Type": "application/json",
-        },
-      },
-    );
-  }, []);
-
-  useEffect(() => {
-    console.log("Nowplaying URL:", nowPlayingUrl);
-    console.log("Player active status:", isActive);
-    if (!nowPlayingUrl || !deviceIdRef.current || !isActive) return;
-    // prevTrackNameRef.current = nowPlayingUrl;
-    play().catch(console.error);
-  }, [nowPlayingUrl, isActive, play]);
 
-  // useEffect(() => {
-  //   if (!isActive || !nowPlayingUrl) return;
-  //   play().catch(console.error);
-  // }, [isActive]);
+    await setRepeat("off");
+  }, [setRepeat]);
 
   async function activateDevice(deviceId: string) {
     const fresh = await fetchFreshToken();
@@ -226,6 +228,7 @@ export default function SpotifyWebPlayer({
     }
   }
 
+  // --- Effects ---
   useEffect(() => {
     const script = document.createElement("script");
     script.src = "https://sdk.scdn.co/spotify-player.js";
@@ -269,39 +272,47 @@ export default function SpotifyWebPlayer({
         const s = state as ExtendedPlaybackState | null;
         if (!s) {
           setActive(false);
-          prevPlaybackRef.current = null;
           return;
         }
-        const track = s.track_window.current_track;
-        const prev = prevPlaybackRef.current;
-
-        const endedNaturally =
-          !!prev &&
-          !prev.paused &&
-          s.paused &&
-          s.position === 0 &&
-          prev.uri === track.uri &&
-          prev.duration > 0 &&
-          prev.position >= Math.max(0, prev.duration - 1500);
-
-        console.log("Ended naturally:", endedNaturally);
-        if (endedNaturally && !songEndFiredRef.current) {
-          songEndFiredRef.current = true;
-          onSongEndRef.current?.();
-        }
 
-        if (prev?.uri !== track.uri || (!s.paused && s.position > 0)) {
-          songEndFiredRef.current = false;
-        }
+        const { paused, position, track_window, repeat_mode } = s;
+        const { previous_tracks, current_track } = track_window;
 
-        prevPlaybackRef.current = {
-          uri: track.uri,
-          paused: s.paused,
-          position: s.position,
-          duration: s.duration,
-        };
+        setRepeatMode(repeat_mode ?? 0);
+
+        console.log("[SpotifyPlayer] Player state changed:", {
+          paused,
+          position,
+          repeat_mode,
+          track_window,
+          previous_tracks,
+          current_track,
+        });
+
+        const trackJustEnded =
+          paused &&
+          position === 0 &&
+          previous_tracks.length > 0 &&
+          previous_tracks[0]?.id === current_track.id;
+
+        console.log("Track just ended:", trackJustEnded);
+        if (trackJustEnded) {
+          if (lastEndedTrackIdRef.current !== current_track.id) {
+            lastEndedTrackIdRef.current = current_track.id;
+
+            if (endOfTrackDebounceRef.current)
+              clearTimeout(endOfTrackDebounceRef.current);
+            endOfTrackDebounceRef.current = setTimeout(() => {
+              onSongEndRef.current?.();
+            }, 1000);
+          }
+        } else {
+          if (!paused && position > 0) {
+            lastEndedTrackIdRef.current = null;
+          }
+        }
 
-        setCurrentTrack(track);
+        setCurrentTrack(current_track);
         setPaused(s.paused);
         player.getCurrentState().then((currentState) => {
           // console.log("CURRENT_STATE:", !!currentState);
@@ -326,6 +337,13 @@ export default function SpotifyWebPlayer({
     };
   }, [token, play]);
 
+  useEffect(() => {
+    console.log("Nowplaying URL:", nowPlayingUrl);
+    console.log("Player active status:", isActive);
+    if (!nowPlayingUrl || !deviceIdRef.current || !isActive) return;
+    play().catch(console.error);
+  }, [nowPlayingUrl, isActive, play]);
+
   if (!isActive || !currentTrack) {
     return (
       <div className="flex flex-col sm:flex-row gap-4 sm:gap-6 items-center sm:items-start p-2">
@@ -411,11 +429,34 @@ export default function SpotifyWebPlayer({
             <Button
               size="icon"
               variant="secondary"
-              className="w-12 h-12 rounded-full bg-background/80 hover:bg-muted text-muted-foreground hover:text-foreground shrink-0 shadow-xs"
+              className={`w-12 h-12 rounded-full shrink-0 shadow-xs ${
+                repeatMode !== 0
+                  ? "bg-primary/10 text-primary hover:bg-primary/20 hover:text-primary"
+                  : "bg-background/80 hover:bg-muted text-muted-foreground hover:text-foreground"
+              }`}
               type="button"
-              onClick={() => stopRepeat()}
+              title={
+                repeatMode === 2
+                  ? "Repeat track on — click to turn off"
+                  : repeatMode === 1
+                    ? "Repeat context on — click to turn off"
+                    : "Repeat off — click to repeat track"
+              }
+              aria-label={
+                repeatMode === 2
+                  ? "Repeat track on"
+                  : repeatMode === 1
+                    ? "Repeat context on"
+                    : "Repeat off"
+              }
+              aria-pressed={repeatMode !== 0}
+              onClick={() => toggleRepeat()}
             >
-              <Repeat className="w-5 h-5" />
+              {repeatMode === 2 ? (
+                <Repeat1 className="w-5 h-5" />
+              ) : (
+                <Repeat className="w-5 h-5" />
+              )}
             </Button>
           </div>
 
diff --git a/apps/web/app/room/[code]/_components/users-sidebar.tsx b/apps/web/app/room/[code]/_components/users-sidebar.tsx
index b455fff..74775d0 100644
--- a/apps/web/app/room/[code]/_components/users-sidebar.tsx
+++ b/apps/web/app/room/[code]/_components/users-sidebar.tsx
@@ -1,5 +1,5 @@
 import { motion } from "motion/react";
-import { Crown, Users } from "lucide-react";
+import { AlertTriangle, Crown, Users } from "lucide-react";
 
 import { Badge } from "@repo/ui/components/ui/badge";
 import type { UserPayload } from "@/types/websocket";
@@ -7,12 +7,16 @@ import type { UserPayload } from "@/types/websocket";
 type UsersSidebarProps = {
   users: UserPayload[];
   currentUserId: string;
+  maxUsers?: number;
 };
 
 export default function UsersSidebar({
   users,
   currentUserId,
+  maxUsers,
 }: UsersSidebarProps) {
+  const isAtCapacity =
+    maxUsers !== undefined && maxUsers > 0 && users.length >= maxUsers;
   return (
     <motion.aside
       initial={{ opacity: 0, y: 18 }}
@@ -27,12 +31,24 @@ export default function UsersSidebar({
         </div>
         <Badge
           variant="outline"
-          className="text-xs px-2 py-1 h-auto rounded-full bg-primary/10 border-primary/20 text-primary font-medium"
+          className={`text-xs px-2 py-1 h-auto rounded-full font-medium ${
+            isAtCapacity
+              ? "bg-amber-500/10 border-amber-500/30 text-amber-200"
+              : "bg-primary/10 border-primary/20 text-primary"
+          }`}
         >
-          {users.length} online
+          {users.length}
+          {maxUsers !== undefined ? ` / ${maxUsers}` : ""} online
         </Badge>
       </div>
 
+      {isAtCapacity && (
+        <div className="mb-3 flex items-start gap-2 rounded-lg border border-amber-500/30 bg-amber-500/10 px-3 py-2 text-xs text-amber-200">
+          <AlertTriangle className="mt-0.5 h-3.5 w-3.5 shrink-0" />
+          <p>Room is at capacity. New guests cannot join until someone leaves.</p>
+        </div>
+      )}
+
       <div className="flex flex-wrap gap-2">
         {users.map((user) => {
           const isSelf = user.userId === currentUserId;
diff --git a/apps/web/components/navbar.tsx b/apps/web/components/navbar.tsx
index 8e5a29a..40e8291 100644
--- a/apps/web/components/navbar.tsx
+++ b/apps/web/components/navbar.tsx
@@ -1,5 +1,8 @@
 "use client";
 
+import { useRouter } from "next/navigation";
+import { Button } from "@repo/ui/components/ui/button";
+import { signOut, useSession } from "@/lib/auth-client";
 import ThemeToggle from "./theme-toggle";
 import Logo from "./logo";
 
@@ -18,6 +21,20 @@ export default function Navbar({
   className = "fixed top-0 left-0 right-0 z-50 backdrop-blur-xl bg-background/70 border-b border-border/50",
   containerClassName = "max-w-7xl mx-auto px-4 sm:px-6 lg:px-8",
 }: NavbarProps) {
+  const router = useRouter();
+  const { data: session } = useSession();
+
+  const handleSignOut = async () => {
+    await signOut({
+      fetchOptions: {
+        onSuccess: () => {
+          router.push("/");
+          router.refresh();
+        },
+      },
+    });
+  };
+
   return (
     <nav className={className}>
       <div className={containerClassName}>
@@ -34,6 +51,11 @@ export default function Navbar({
 
           <div className="flex items-center gap-2 sm:gap-3">
             {children}
+            {session && (
+              <Button variant="outline" size="sm" onClick={handleSignOut}>
+                Sign Out
+              </Button>
+            )}
             <ThemeToggle />
           </div>
         </div>
diff --git a/apps/web/hooks/useWebSocket.ts b/apps/web/hooks/useWebSocket.ts
index 2de9a9d..3544050 100644
--- a/apps/web/hooks/useWebSocket.ts
+++ b/apps/web/hooks/useWebSocket.ts
@@ -1,10 +1,9 @@
 import { useEffect, useRef, useState, useCallback } from "react";
 import {
-  CLIENT_TO_SERVER_MESSAGE_TYPES,
-  SERVER_TO_CLIENT_MESSAGE_TYPES,
+  ClientEvents,
+  ServerEvents,
 } from "@/lib/constants";
 import type {
-  UserPayload,
   RoomConfig,
   SongData,
   SongPayload,
@@ -13,12 +12,36 @@ import type {
   ConnectionState,
   JoinState,
   UserShortPayload,
+  UserPayload,
 } from "@/types/websocket";
 import { toast } from "@repo/ui/components/ui/sonner";
 import { ClientMessageSchema, ServerMessageSchema } from "@/types/websocket";
 
-export function useWebSocket() {
+const RECONNECT_BASE_MS = 1000;
+const RECONNECT_MAX_MS = 30000;
+
+async function fetchWsToken(roomId: string): Promise<string | null> {
+  const res = await fetch(
+    `/api/ws/token?roomId=${encodeURIComponent(roomId)}`,
+    { credentials: "include" },
+  );
+
+  if (!res.ok) return null;
+
+  const data = (await res.json()) as { token?: string };
+  return data.token ?? null;
+}
+
+export function useWebSocket(roomId: string, userId: string) {
   const wsRef = useRef<WebSocket | null>(null);
+  const currentUserIdRef = useRef(userId);
+  const currentRoomIdRef = useRef(roomId);
+  const shouldReconnectRef = useRef(true);
+  const reconnectTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const reconnectAttemptRef = useRef(0);
+  const joinStateRef = useRef<JoinState>("idle");
+  const connectRef = useRef<() => void>(() => {});
+
   const [connectionState, setConnectionState] =
     useState<ConnectionState>("disconnected");
   const [joinState, setJoinState] = useState<JoinState>("idle");
@@ -30,6 +53,18 @@ export function useWebSocket() {
   const [users, setUsers] = useState<UserPayload[]>([]);
   const [nowPlaying, setNowPlaying] = useState<SongData | null>(null);
   const [isAdminJoined, setIsAdminJoined] = useState(false);
+  const [upvotesUsed, setUpvotesUsed] = useState(0);
+
+  currentUserIdRef.current = userId;
+  currentRoomIdRef.current = roomId;
+
+  const setJoinStateAndRef = useCallback((next: JoinState | ((prev: JoinState) => JoinState)) => {
+    setJoinState((prev) => {
+      const value = typeof next === "function" ? next(prev) : next;
+      joinStateRef.current = value;
+      return value;
+    });
+  }, []);
 
   const reportError = useCallback(
     (message: string, details?: unknown, toastId?: string) => {
@@ -42,24 +77,63 @@ export function useWebSocket() {
     [],
   );
 
+  const sendJoinMessage = useCallback((ws: WebSocket, targetRoomId: string) => {
+    setJoinStateAndRef("joining");
+    ws.send(
+      JSON.stringify({
+        type: ClientEvents.JOIN_ROOM,
+        payload: { roomId: targetRoomId },
+      }),
+    );
+  }, [setJoinStateAndRef]);
+
   const handleServerMessage = useCallback(
     (message: ServerMessage) => {
       switch (message.type) {
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.LIST_USERS: {
+        case ServerEvents.MEMBERS_UPDATED: {
           setUsers(message.payload.users);
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.JOINED_ROOM: {
-          setJoinState("joined");
+        case ServerEvents.ROOM_JOINED: {
+          setJoinStateAndRef("joined");
           setJoinError(null);
           setRoomConfig(message.payload.config);
-          setQueue(message.payload.queue);
+          setUpvotesUsed(message.payload.upvotesUsed);
+          break;
+        }
+
+        case ServerEvents.ROOM_USER_LIMIT_REACHED: {
+          setJoinStateAndRef("full");
+          setJoinError(
+            `This room is full (${message.payload.maxUsers} users max). Try again later.`,
+          );
+          setRoomConfig(null);
+          setQueue([]);
+          setPendingRequests([]);
+          setPendingUsers([]);
+          setUsers([]);
+          setNowPlaying(null);
+          setUpvotesUsed(0);
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.ADMIN_NOT_JOINED: {
-          setJoinState("blocked");
+        case ServerEvents.ROOM_UPVOTE_LIMIT_REACHED: {
+          reportError(
+            `You've used all ${message.payload.maxUpvotes} upvotes for this room`,
+            undefined,
+            "websocket-upvote-limit",
+          );
+          break;
+        }
+
+        case ServerEvents.USER_UPVOTES_USAGE: {
+          setUpvotesUsed(message.payload.used);
+          break;
+        }
+
+        case ServerEvents.WAITING_FOR_ADMIN: {
+          setJoinStateAndRef("blocked");
           setJoinError(null);
           setRoomConfig(null);
           setQueue([]);
@@ -70,9 +144,9 @@ export function useWebSocket() {
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.USER_REJECTED: {
-          setJoinState("rejected");
-          setJoinError("Your entry request was rejected by the admin.");
+        case ServerEvents.USER_REJECTED: {
+          setJoinStateAndRef("rejected");
+          setJoinError(message.payload.message);
           setRoomConfig(null);
           setQueue([]);
           setPendingRequests([]);
@@ -83,46 +157,72 @@ export function useWebSocket() {
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.ADMIN_JOINED: {
+        case ServerEvents.JOIN_ALREADY_PENDING: {
+          setJoinStateAndRef("joining");
+          setJoinError(null);
+          break;
+        }
+
+        case ServerEvents.ADMIN_JOINED: {
           setIsAdminJoined(true);
+          setJoinStateAndRef((prev) => (prev === "blocked" ? "joining" : prev));
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.ADMIN_LEFT: {
+        case ServerEvents.ADMIN_LEFT: {
           setIsAdminJoined(false);
+          setJoinStateAndRef((prev) => (prev === "joining" ? "blocked" : prev));
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.QUEUE_UPDATE: {
+        case ServerEvents.QUEUE_UPDATED: {
           setQueue(message.payload.queue);
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.SONG_REQUESTED: {
+        case ServerEvents.SONG_REQUESTED: {
           setPendingRequests((prev) => [...prev, message.payload.song]);
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.SONG_APPROVED: {
+        case ServerEvents.SONG_REQUEST_SUBMITTED: {
+          toast.success("Song submitted for approval");
+          break;
+        }
+
+        case ServerEvents.SONG_APPROVED: {
           setPendingRequests((prev) =>
             prev.filter((song) => song.id !== message.payload.songId),
           );
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.SONG_REJECTED: {
+        case ServerEvents.SONG_REJECTED: {
           setPendingRequests((prev) =>
             prev.filter((song) => song.id !== message.payload.songId),
           );
+          if (
+            message.payload.requestedByUserId &&
+            message.payload.requestedByUserId === currentUserIdRef.current
+          ) {
+            toast.error(
+              `"${message.payload.name}" by ${message.payload.artist} was not approved`,
+            );
+          }
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.USERS_REQUESTED_LIST: {
+        case ServerEvents.PENDING_JOIN_REQUESTS: {
           setPendingUsers(message.payload.users);
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.JOIN_REQUESTED: {
+        case ServerEvents.PENDING_SONG_REQUESTS: {
+          setPendingRequests(message.payload.songs);
+          break;
+        }
+
+        case ServerEvents.USER_JOIN_REQUESTED: {
           setPendingUsers((prev) => {
             if (prev.some((u) => u.userId === message.payload.userId)) {
               return prev;
@@ -132,12 +232,12 @@ export function useWebSocket() {
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.NOW_PLAYING_UPDATE: {
+        case ServerEvents.NOW_PLAYING_UPDATED: {
           setNowPlaying(message.payload.song);
           break;
         }
 
-        case SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR: {
+        case ServerEvents.ERROR: {
           reportError(
             message.payload.message,
             undefined,
@@ -154,29 +254,43 @@ export function useWebSocket() {
         }
       }
     },
-    [reportError],
+    [reportError, setJoinStateAndRef],
   );
 
-  const connect = useCallback(() => {
+  const connect = useCallback(async () => {
     if (wsRef.current?.readyState === WebSocket.OPEN) return;
 
     setConnectionState("connecting");
 
     try {
+      const token = await fetchWsToken(roomId);
+      if (!token) {
+        setConnectionState("error");
+        reportError(
+          "Failed to authenticate WebSocket connection",
+          undefined,
+          "websocket-auth-error",
+        );
+        return;
+      }
+
       const wsUrl = process.env.NEXT_PUBLIC_WS_URL || "ws://localhost:3001";
-      wsRef.current = new WebSocket(wsUrl);
+      const ws = new WebSocket(
+        `${wsUrl}?token=${encodeURIComponent(token)}`,
+      );
+      wsRef.current = ws;
 
-      wsRef.current.onopen = () => {
+      ws.onopen = () => {
+        reconnectAttemptRef.current = 0;
         setConnectionState("connected");
         console.log("WebSocket connected");
 
-        // // Rejoin room if we were in one
-        // if (currentRoomId) {
-        //   // Note: User needs to be passed, this is handled by joinRoom
-        // }
+        if (currentRoomIdRef.current) {
+          sendJoinMessage(ws, currentRoomIdRef.current);
+        }
       };
 
-      wsRef.current.onmessage = (event) => {
+      ws.onmessage = (event) => {
         try {
           console.log("Received message:", event.data);
 
@@ -203,12 +317,27 @@ export function useWebSocket() {
         }
       };
 
-      wsRef.current.onclose = () => {
+      ws.onclose = () => {
         setConnectionState("disconnected");
         console.log("WebSocket disconnected");
+
+        const terminal =
+          joinStateRef.current === "rejected" || joinStateRef.current === "full";
+        if (!shouldReconnectRef.current || terminal) return;
+
+        const attempt = reconnectAttemptRef.current;
+        const delay = Math.min(
+          RECONNECT_BASE_MS * Math.pow(2, attempt),
+          RECONNECT_MAX_MS,
+        );
+        reconnectAttemptRef.current = attempt + 1;
+        console.log(`Reconnecting in ${delay}ms (attempt ${attempt + 1})`);
+        reconnectTimerRef.current = setTimeout(() => {
+          if (shouldReconnectRef.current) connectRef.current();
+        }, delay);
       };
 
-      wsRef.current.onerror = (err) => {
+      ws.onerror = (err) => {
         setConnectionState("error");
         reportError(
           "WebSocket connection error",
@@ -224,7 +353,9 @@ export function useWebSocket() {
         "websocket-create-error",
       );
     }
-  }, [handleServerMessage, reportError]);
+  }, [handleServerMessage, reportError, roomId, sendJoinMessage]);
+
+  connectRef.current = connect;
 
   const sendMessage = useCallback(
     (message: ClientMessage) => {
@@ -253,21 +384,21 @@ export function useWebSocket() {
   );
 
   const joinRoom = useCallback(
-    (roomId: string, user: UserPayload) => {
-      setJoinState("joining");
+    (targetRoomId: string) => {
+      currentRoomIdRef.current = targetRoomId;
       setJoinError(null);
-      sendMessage({
-        type: CLIENT_TO_SERVER_MESSAGE_TYPES.JOIN_ROOM,
-        payload: { roomId, user },
-      });
+
+      if (wsRef.current?.readyState === WebSocket.OPEN) {
+        sendJoinMessage(wsRef.current, targetRoomId);
+      }
     },
-    [sendMessage],
+    [sendJoinMessage],
   );
 
   const requestSong = useCallback(
     (song: SongPayload) => {
       sendMessage({
-        type: CLIENT_TO_SERVER_MESSAGE_TYPES.REQUEST_SONG,
+        type: ClientEvents.REQUEST_SONG,
         payload: { song },
       });
     },
@@ -275,10 +406,10 @@ export function useWebSocket() {
   );
 
   const upvoteSong = useCallback(
-    (songId: string, userId: string) => {
+    (songId: string, upvoteUserId: string) => {
       sendMessage({
-        type: CLIENT_TO_SERVER_MESSAGE_TYPES.UPVOTE_SONG,
-        payload: { songId, userId },
+        type: ClientEvents.UPVOTE_SONG,
+        payload: { songId, userId: upvoteUserId },
       });
     },
     [sendMessage],
@@ -287,7 +418,7 @@ export function useWebSocket() {
   const approveSong = useCallback(
     (songId: string) => {
       sendMessage({
-        type: CLIENT_TO_SERVER_MESSAGE_TYPES.APPROVE_SONG,
+        type: ClientEvents.APPROVE_SONG,
         payload: { songId },
       });
     },
@@ -297,7 +428,7 @@ export function useWebSocket() {
   const rejectSong = useCallback(
     (songId: string) => {
       sendMessage({
-        type: CLIENT_TO_SERVER_MESSAGE_TYPES.REJECT_SONG,
+        type: ClientEvents.REJECT_SONG,
         payload: { songId },
       });
     },
@@ -305,44 +436,52 @@ export function useWebSocket() {
   );
 
   const approveUser = useCallback(
-    (userId: string, username: string) => {
-      setPendingUsers((prev) => prev.filter((u) => u.userId !== userId));
+    (approveUserId: string, username: string) => {
       sendMessage({
-        type: CLIENT_TO_SERVER_MESSAGE_TYPES.APPROVE_USER,
-        payload: { userId, username },
+        type: ClientEvents.APPROVE_USER,
+        payload: { userId: approveUserId, username },
       });
     },
     [sendMessage],
   );
 
   const rejectUser = useCallback(
-    (userId: string, username: string) => {
-      setPendingUsers((prev) => prev.filter((u) => u.userId !== userId));
+    (rejectUserId: string, username: string) => {
       sendMessage({
-        type: CLIENT_TO_SERVER_MESSAGE_TYPES.REJECT_USER,
-        payload: { userId, username },
+        type: ClientEvents.REJECT_USER,
+        payload: { userId: rejectUserId, username },
       });
     },
     [sendMessage],
   );
 
   const broadcastNowPlaying = useCallback(() => {
-    sendMessage({ type: CLIENT_TO_SERVER_MESSAGE_TYPES.BROADCAST_NOW_PLAYING });
+    sendMessage({ type: ClientEvents.SYNC_NOW_PLAYING });
   }, [sendMessage]);
 
   const requestNextSong = useCallback(() => {
-    sendMessage({ type: CLIENT_TO_SERVER_MESSAGE_TYPES.NEXT_SONG });
+    sendMessage({ type: ClientEvents.SKIP_TO_NEXT });
   }, [sendMessage]);
 
   useEffect(() => {
+    shouldReconnectRef.current = true;
     connect();
+
     return () => {
+      shouldReconnectRef.current = false;
+      if (reconnectTimerRef.current) {
+        clearTimeout(reconnectTimerRef.current);
+        reconnectTimerRef.current = null;
+      }
       if (wsRef.current) {
         wsRef.current.close();
       }
     };
   }, [connect]);
 
+  const maxUpvotes = roomConfig?.maxUpvotes ?? 0;
+  const canUpvote = joinState === "joined" && upvotesUsed < maxUpvotes;
+
   return {
     connectionState,
     joinState,
@@ -353,6 +492,8 @@ export function useWebSocket() {
     queue,
     pendingRequests,
     pendingUsers,
+    upvotesUsed,
+    canUpvote,
     joinRoom,
     requestSong,
     upvoteSong,
diff --git a/apps/web/lib/auth-client.ts b/apps/web/lib/auth-client.ts
index 41aa5ca..90ea8c6 100644
--- a/apps/web/lib/auth-client.ts
+++ b/apps/web/lib/auth-client.ts
@@ -1,6 +1,7 @@
-import { createAuthClient } from "better-auth/client";
-const authClient = createAuthClient({
-  baseURL: process.env.WEB_APP_URL,
+import { createAuthClient } from "better-auth/react";
+
+export const authClient = createAuthClient({
+  baseURL: process.env.NEXT_PUBLIC_WEB_APP_URL ?? process.env.WEB_APP_URL,
 });
 
-export const { signIn, signOut } = authClient;
+export const { signIn, signOut, useSession } = authClient;
diff --git a/apps/web/lib/constants.ts b/apps/web/lib/constants.ts
index 82f61a8..90bb086 100644
--- a/apps/web/lib/constants.ts
+++ b/apps/web/lib/constants.ts
@@ -2,41 +2,42 @@ export const SPOTIFY_BASE_URL = "https://accounts.spotify.com/";
 export const SPOTIFY_AUTHORIZE_PATH = "authorize";
 export const SPOTIFY_TOKEN_PATH = "api/token";
 
-export const CLIENT_TO_SERVER_MESSAGE_TYPES = {
-  JOIN_ROOM: "join_room",
-  REQUEST_SONG: "request_song",
-  UPVOTE_SONG: "upvote_song",
-  APPROVE_SONG: "approve_song",
-  REJECT_SONG: "reject_song",
-  APPROVE_USER: "approve_user",
-  REJECT_USER: "reject_user",
-  BROADCAST_NOW_PLAYING: "broadcast_now_playing",
-  NEXT_SONG: "next_song",
+export const ClientEvents = {
+  JOIN_ROOM: "room.join",
+  REQUEST_SONG: "song.request",
+  UPVOTE_SONG: "song.upvote",
+  APPROVE_SONG: "song.approve",
+  REJECT_SONG: "song.reject",
+  APPROVE_USER: "user.approve",
+  REJECT_USER: "user.reject",
+  SYNC_NOW_PLAYING: "now_playing.sync",
+  SKIP_TO_NEXT: "queue.next",
 } as const;
 
-export const SERVER_TO_CLIENT_MESSAGE_TYPES = {
-  QUEUE_UPDATE: "queue_update",
-  SONG_REQUESTED: "song_requested",
-  SONG_APPROVED: "song_approved",
-  SONG_REJECTED: "song_rejected",
+export const ServerEvents = {
+  QUEUE_UPDATED: "queue.updated",
+  SONG_REQUESTED: "song.requested",
+  SONG_REQUEST_SUBMITTED: "song.request_submitted",
+  SONG_APPROVED: "song.approved",
+  SONG_REJECTED: "song.rejected",
   ERROR: "error",
-  ADMIN_NOT_JOINED: "admin_not_joined",
-  ADMIN_LEFT: "admin_left",
-  ADMIN_JOINED: "admin_joined",
-  JOINED_ROOM: "joined_room",
-  LIST_USERS: "list_users",
-  JOIN_REQUESTED: "join_requested",
-  REQUEST_ALREADY_SENT: "request_already_sent",
-  USER_APPROVED: "user_approved",
-  USER_REJECTED: "user_rejected",
-  USERS_REQUESTED_LIST: "users_requested_list",
-  NOW_PLAYING_UPDATE: "now_playing_update",
+  WAITING_FOR_ADMIN: "room.waiting_for_admin",
+  ADMIN_LEFT: "room.admin_left",
+  ADMIN_JOINED: "room.admin_joined",
+  ROOM_JOINED: "room.joined",
+  MEMBERS_UPDATED: "room.members_updated",
+  USER_JOIN_REQUESTED: "user.join_requested",
+  JOIN_ALREADY_PENDING: "user.join_already_pending",
+  USER_APPROVED: "user.approved",
+  USER_REJECTED: "user.rejected",
+  PENDING_JOIN_REQUESTS: "room.pending_join_requests",
+  PENDING_SONG_REQUESTS: "room.pending_song_requests",
+  NOW_PLAYING_UPDATED: "now_playing.updated",
+  ROOM_USER_LIMIT_REACHED: "room.user_limit_reached",
+  ROOM_UPVOTE_LIMIT_REACHED: "room.upvote_limit_reached",
+  USER_UPVOTES_USAGE: "user.upvotes_usage",
 } as const;
 
-export const ALL_CLIENT_TO_SERVER_MESSAGE_TYPES = Object.values(
-  CLIENT_TO_SERVER_MESSAGE_TYPES,
-);
+export const ALL_CLIENT_EVENTS = Object.values(ClientEvents);
 
-export const ALL_SERVER_TO_CLIENT_MESSAGE_TYPES = Object.values(
-  SERVER_TO_CLIENT_MESSAGE_TYPES,
-);
+export const ALL_SERVER_EVENTS = Object.values(ServerEvents);
diff --git a/apps/web/lib/require-session.ts b/apps/web/lib/require-session.ts
new file mode 100644
index 0000000..5abc1b1
--- /dev/null
+++ b/apps/web/lib/require-session.ts
@@ -0,0 +1,23 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/lib/auth";
+
+type Session = NonNullable<Awaited<ReturnType<typeof auth.api.getSession>>>;
+
+type RequireSessionResult =
+  | { ok: true; session: Session }
+  | { ok: false; response: NextResponse };
+
+export async function requireSession(
+  req: NextRequest,
+): Promise<RequireSessionResult> {
+  const session = await auth.api.getSession({ headers: req.headers });
+
+  if (!session?.user) {
+    return {
+      ok: false,
+      response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }),
+    };
+  }
+
+  return { ok: true, session };
+}
diff --git a/apps/web/lib/room-utils.ts b/apps/web/lib/room-utils.ts
index 22e2553..b142ae4 100644
--- a/apps/web/lib/room-utils.ts
+++ b/apps/web/lib/room-utils.ts
@@ -1,4 +1,5 @@
 import { prisma } from "@repo/db";
+import * as jose from "jose";
 
 export async function isRoomAdmin(code: string, userId: string) {
   const room = await prisma.room.findUnique({
@@ -13,3 +14,18 @@ export async function isRoomAdmin(code: string, userId: string) {
 
   return room.adminId === userId;
 }
+
+function getWsSecret(): Uint8Array {
+  const secret = process.env.WS_SECRET;
+  if (!secret) {
+    throw new Error("WS_SECRET is not configured");
+  }
+  return new TextEncoder().encode(secret);
+}
+
+export async function generateRoomToken(userId: string, roomId: string) {
+  return new jose.SignJWT({ userId, roomId })
+    .setProtectedHeader({ alg: "HS256" })
+    .setExpirationTime("15m")
+    .sign(getWsSecret());
+}
diff --git a/apps/web/package.json b/apps/web/package.json
index 4cffc90..6140b35 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -17,6 +17,7 @@
     "@repo/ui": "*",
     "better-auth": "^1.4.17",
     "dotenv-cli": "^11.0.0",
+    "jose": "^6.2.3",
     "lucide-react": "^0.563.0",
     "motion": "^12.31.0",
     "next": "16.0.10",
diff --git a/apps/web/proxy.ts b/apps/web/proxy.ts
index adb2d49..c7e2d81 100644
--- a/apps/web/proxy.ts
+++ b/apps/web/proxy.ts
@@ -14,21 +14,14 @@ export async function proxy(request: NextRequest) {
     headers: await headers(),
   });
 
-  // THIS IS NOT SECURE!
-  // This is the recommended approach to optimistically redirect users
-  // We recommend handling auth checks in each page/route
-  // if (!session) {
-  //   return NextResponse.redirect(new URL("/login", request.url));
-  // }
-
-  // console.log(session);
-
+  const { pathname } = request.nextUrl;
   const isLoggedIn = !!session;
-  const isAuthRoute = authRoutes.includes(request.nextUrl.pathname);
-  const isPublicRoute = publicRoutes.includes(request.nextUrl.pathname);
-  const isApiAuthRoute = authPrefix.includes(request.nextUrl.pathname);
-  const isProtectedRoute = protectedRoutes.includes(request.nextUrl.pathname);
-  // const isAuthProtectedRoute=authProtectedRoutes.includes(request.nextUrl.pathname);
+  const isAuthRoute = authRoutes.includes(pathname);
+  const isPublicRoute = publicRoutes.includes(pathname);
+  const isApiAuthRoute = pathname.startsWith(authPrefix);
+  const isProtectedRoute = protectedRoutes.some(
+    (route) => pathname === route || pathname.startsWith(route + "/"),
+  );
 
   if (isApiAuthRoute || isPublicRoute) {
     return NextResponse.next();
@@ -41,7 +34,9 @@ export async function proxy(request: NextRequest) {
   }
 
   if (!isLoggedIn && isProtectedRoute) {
-    return NextResponse.redirect(new URL("/login", request.url));
+    return NextResponse.redirect(
+      new URL(`/login?callbackUrl=${encodeURIComponent(pathname)}`, request.url),
+    );
   }
 
   return NextResponse.next();
diff --git a/apps/web/types/websocket.ts b/apps/web/types/websocket.ts
index 73bc6b8..752241e 100644
--- a/apps/web/types/websocket.ts
+++ b/apps/web/types/websocket.ts
@@ -2,8 +2,8 @@ import type { SongStatus } from "@repo/db";
 
 import { z } from "zod";
 import {
-  CLIENT_TO_SERVER_MESSAGE_TYPES,
-  SERVER_TO_CLIENT_MESSAGE_TYPES,
+  ClientEvents,
+  ServerEvents,
 } from "@/lib/constants";
 
 export const SongStatusSchema = z.enum([
@@ -31,6 +31,7 @@ export type UserShortPayload = z.infer<typeof UserShortPayloadSchema>;
 
 export const SongSchema = z.object({
   id: z.string().min(1),
+  songId: z.string().min(1),
   name: z.string().min(1),
   artist: z.string().min(1),
   url: z.url(),
@@ -68,17 +69,16 @@ export type RoomConfig = z.infer<typeof RoomConfigSchema>;
 // --- Client -> Server Messages (Outgoing from client) ---
 
 export const JoinRoomMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.JOIN_ROOM),
+  type: z.literal(ClientEvents.JOIN_ROOM),
   payload: z.object({
     roomId: z.string().min(1),
-    user: UserPayloadSchema,
   }),
 });
 
 export type JoinRoomMessage = z.infer<typeof JoinRoomMessageSchema>;
 
 export const RequestSongMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.REQUEST_SONG),
+  type: z.literal(ClientEvents.REQUEST_SONG),
   payload: z.object({
     song: SongPayloadSchema,
   }),
@@ -87,7 +87,7 @@ export const RequestSongMessageSchema = z.object({
 export type RequestSongMessage = z.infer<typeof RequestSongMessageSchema>;
 
 export const UpvoteSongMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.UPVOTE_SONG),
+  type: z.literal(ClientEvents.UPVOTE_SONG),
   payload: z.object({
     songId: z.string().min(1),
     userId: z.string().min(1),
@@ -97,7 +97,7 @@ export const UpvoteSongMessageSchema = z.object({
 export type UpvoteSongMessage = z.infer<typeof UpvoteSongMessageSchema>;
 
 export const ApproveSongMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.APPROVE_SONG),
+  type: z.literal(ClientEvents.APPROVE_SONG),
   payload: z.object({
     songId: z.string().min(1),
   }),
@@ -106,7 +106,7 @@ export const ApproveSongMessageSchema = z.object({
 export type ApproveSongMessage = z.infer<typeof ApproveSongMessageSchema>;
 
 export const RejectSongMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.REJECT_SONG),
+  type: z.literal(ClientEvents.REJECT_SONG),
   payload: z.object({
     songId: z.string().min(1),
   }),
@@ -115,7 +115,7 @@ export const RejectSongMessageSchema = z.object({
 export type RejectSongMessage = z.infer<typeof RejectSongMessageSchema>;
 
 export const BroadcastNowPlayingMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.BROADCAST_NOW_PLAYING),
+  type: z.literal(ClientEvents.SYNC_NOW_PLAYING),
 });
 
 export type BroadcastNowPlayingMessage = z.infer<
@@ -123,20 +123,20 @@ export type BroadcastNowPlayingMessage = z.infer<
 >;
 
 export const NextSongMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.NEXT_SONG),
+  type: z.literal(ClientEvents.SKIP_TO_NEXT),
 });
 
 export type NextSongMessage = z.infer<typeof NextSongMessageSchema>;
 
 export const ApproveUserMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.APPROVE_USER),
+  type: z.literal(ClientEvents.APPROVE_USER),
   payload: UserShortPayloadSchema,
 });
 
 export type ApproveUserMessage = z.infer<typeof ApproveUserMessageSchema>;
 
 export const RejectUserMessageSchema = z.object({
-  type: z.literal(CLIENT_TO_SERVER_MESSAGE_TYPES.REJECT_USER),
+  type: z.literal(ClientEvents.REJECT_USER),
   payload: UserShortPayloadSchema,
 });
 
@@ -159,7 +159,7 @@ export type ClientMessage = z.infer<typeof ClientMessageSchema>;
 // --- Server -> Client Messages (Incoming to client) ---
 
 export const QueueUpdateMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.QUEUE_UPDATE),
+  type: z.literal(ServerEvents.QUEUE_UPDATED),
   payload: z.object({
     queue: z.array(SongDataSchema),
   }),
@@ -168,7 +168,7 @@ export const QueueUpdateMessageSchema = z.object({
 export type QueueUpdateMessage = z.infer<typeof QueueUpdateMessageSchema>;
 
 export const SongRequestedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.SONG_REQUESTED),
+  type: z.literal(ServerEvents.SONG_REQUESTED),
   payload: z.object({
     song: SongDataSchema,
   }),
@@ -176,8 +176,19 @@ export const SongRequestedMessageSchema = z.object({
 
 export type SongRequestedMessage = z.infer<typeof SongRequestedMessageSchema>;
 
+export const SongRequestSubmittedMessageSchema = z.object({
+  type: z.literal(ServerEvents.SONG_REQUEST_SUBMITTED),
+  payload: z.object({
+    song: SongDataSchema,
+  }),
+});
+
+export type SongRequestSubmittedMessage = z.infer<
+  typeof SongRequestSubmittedMessageSchema
+>;
+
 export const SongApprovedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.SONG_APPROVED),
+  type: z.literal(ServerEvents.SONG_APPROVED),
   payload: z.object({
     songId: z.string().min(1),
   }),
@@ -186,16 +197,19 @@ export const SongApprovedMessageSchema = z.object({
 export type SongApprovedMessage = z.infer<typeof SongApprovedMessageSchema>;
 
 export const SongRejectedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.SONG_REJECTED),
+  type: z.literal(ServerEvents.SONG_REJECTED),
   payload: z.object({
     songId: z.string().min(1),
+    name: z.string().min(1),
+    artist: z.string().min(1),
+    requestedByUserId: z.string().min(1).nullable(),
   }),
 });
 
 export type SongRejectedMessage = z.infer<typeof SongRejectedMessageSchema>;
 
 export const ErrorMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.ERROR),
+  type: z.literal(ServerEvents.ERROR),
   payload: z.object({
     message: z.string().min(1),
   }),
@@ -204,39 +218,73 @@ export const ErrorMessageSchema = z.object({
 export type ErrorMessage = z.infer<typeof ErrorMessageSchema>;
 
 export const AdminNotJoinedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.ADMIN_NOT_JOINED),
+  type: z.literal(ServerEvents.WAITING_FOR_ADMIN),
   payload: z.object({}),
 });
 
 export type AdminNotJoinedMessage = z.infer<typeof AdminNotJoinedMessageSchema>;
 
 export const AdminLeftMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.ADMIN_LEFT),
+  type: z.literal(ServerEvents.ADMIN_LEFT),
   payload: z.object({}),
 });
 
 export type AdminLeftMessage = z.infer<typeof AdminLeftMessageSchema>;
 
 export const AdminJoinedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.ADMIN_JOINED),
+  type: z.literal(ServerEvents.ADMIN_JOINED),
   payload: z.object({}),
 });
 
 export type AdminJoinedMessage = z.infer<typeof AdminJoinedMessageSchema>;
 
 export const JoinedRoomMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.JOINED_ROOM),
+  type: z.literal(ServerEvents.ROOM_JOINED),
   payload: z.object({
     roomId: z.string().min(1),
     config: RoomConfigSchema,
-    queue: z.array(SongDataSchema),
+    upvotesUsed: z.number().int().nonnegative(),
+  }),
+});
+
+export const RoomUserLimitReachedMessageSchema = z.object({
+  type: z.literal(ServerEvents.ROOM_USER_LIMIT_REACHED),
+  payload: z.object({
+    maxUsers: z.number().int().nonnegative(),
+  }),
+});
+
+export type RoomUserLimitReachedMessage = z.infer<
+  typeof RoomUserLimitReachedMessageSchema
+>;
+
+export const RoomUpvoteLimitReachedMessageSchema = z.object({
+  type: z.literal(ServerEvents.ROOM_UPVOTE_LIMIT_REACHED),
+  payload: z.object({
+    maxUpvotes: z.number().int().nonnegative(),
   }),
 });
 
+export type RoomUpvoteLimitReachedMessage = z.infer<
+  typeof RoomUpvoteLimitReachedMessageSchema
+>;
+
+export const UserUpvotesUsageMessageSchema = z.object({
+  type: z.literal(ServerEvents.USER_UPVOTES_USAGE),
+  payload: z.object({
+    used: z.number().int().nonnegative(),
+    maxUpvotes: z.number().int().nonnegative(),
+  }),
+});
+
+export type UserUpvotesUsageMessage = z.infer<
+  typeof UserUpvotesUsageMessageSchema
+>;
+
 export type JoinedRoomMessage = z.infer<typeof JoinedRoomMessageSchema>;
 
 export const ListUsersMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.LIST_USERS),
+  type: z.literal(ServerEvents.MEMBERS_UPDATED),
   payload: z.object({
     users: z.array(UserPayloadSchema),
   }),
@@ -245,14 +293,14 @@ export const ListUsersMessageSchema = z.object({
 export type ListUsersMessage = z.infer<typeof ListUsersMessageSchema>;
 
 export const JoinRequestedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.JOIN_REQUESTED),
+  type: z.literal(ServerEvents.USER_JOIN_REQUESTED),
   payload: UserShortPayloadSchema,
 });
 
 export type JoinRequestedMessage = z.infer<typeof JoinRequestedMessageSchema>;
 
 export const RequestAlreadySentMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.REQUEST_ALREADY_SENT),
+  type: z.literal(ServerEvents.JOIN_ALREADY_PENDING),
   payload: z.object({}),
 });
 
@@ -261,20 +309,24 @@ export type RequestAlreadySentMessage = z.infer<
 >;
 
 export const UserApprovedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.USER_APPROVED),
+  type: z.literal(ServerEvents.USER_APPROVED),
   payload: UserShortPayloadSchema,
 });
 
 export type UserApprovedMessage = z.infer<typeof UserApprovedMessageSchema>;
 
 export const UserRejectedMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.USER_REJECTED),
+  type: z.literal(ServerEvents.USER_REJECTED),
+  payload: z.object({
+    roomId: z.string().min(1),
+    message: z.string().min(1),
+  }),
 });
 
 export type UserRejectedMessage = z.infer<typeof UserRejectedMessageSchema>;
 
 export const UsersRequestedListMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.USERS_REQUESTED_LIST),
+  type: z.literal(ServerEvents.PENDING_JOIN_REQUESTS),
   payload: z.object({
     users: z.array(UserShortPayloadSchema),
   }),
@@ -284,8 +336,19 @@ export type UsersRequestedListMessage = z.infer<
   typeof UsersRequestedListMessageSchema
 >;
 
+export const PendingSongRequestsMessageSchema = z.object({
+  type: z.literal(ServerEvents.PENDING_SONG_REQUESTS),
+  payload: z.object({
+    songs: z.array(SongDataSchema),
+  }),
+});
+
+export type PendingSongRequestsMessage = z.infer<
+  typeof PendingSongRequestsMessageSchema
+>;
+
 export const NowPlayingUpdateMessageSchema = z.object({
-  type: z.literal(SERVER_TO_CLIENT_MESSAGE_TYPES.NOW_PLAYING_UPDATE),
+  type: z.literal(ServerEvents.NOW_PLAYING_UPDATED),
   payload: z.object({
     song: SongDataSchema.nullable(),
   }),
@@ -298,6 +361,7 @@ export type NowPlayingUpdateMessage = z.infer<
 export const ServerMessageSchema = z.discriminatedUnion("type", [
   QueueUpdateMessageSchema,
   SongRequestedMessageSchema,
+  SongRequestSubmittedMessageSchema,
   SongApprovedMessageSchema,
   SongRejectedMessageSchema,
   ErrorMessageSchema,
@@ -305,6 +369,9 @@ export const ServerMessageSchema = z.discriminatedUnion("type", [
   AdminLeftMessageSchema,
   AdminJoinedMessageSchema,
   JoinedRoomMessageSchema,
+  RoomUserLimitReachedMessageSchema,
+  RoomUpvoteLimitReachedMessageSchema,
+  UserUpvotesUsageMessageSchema,
   ListUsersMessageSchema,
   JoinRequestedMessageSchema,
   RequestAlreadySentMessageSchema,
@@ -312,6 +379,7 @@ export const ServerMessageSchema = z.discriminatedUnion("type", [
   UserRejectedMessageSchema,
   UsersRequestedListMessageSchema,
   NowPlayingUpdateMessageSchema,
+  PendingSongRequestsMessageSchema,
 ]);
 
 export type ServerMessage = z.infer<typeof ServerMessageSchema>;
@@ -324,7 +392,13 @@ export type ConnectionState =
   | "disconnected"
   | "error";
 
-export type JoinState = "idle" | "joining" | "joined" | "blocked" | "rejected";
+export type JoinState =
+  | "idle"
+  | "joining"
+  | "joined"
+  | "blocked"
+  | "rejected"
+  | "full";
 
 export type UseWebSocketReturn = {
   connectionState: ConnectionState;
@@ -335,7 +409,7 @@ export type UseWebSocketReturn = {
   roomConfig: RoomConfig | null;
   queue: SongData[];
   pendingRequests: SongData[];
-  joinRoom: (roomId: string, user: UserPayload) => void;
+  joinRoom: (roomId: string) => void;
   requestSong: (song: SongPayload) => void;
   upvoteSong: (songId: string, userId: string) => void;
   approveSong: (songId: string) => void;
diff --git a/bun.lock b/bun.lock
index be070d8..89d9703 100644
--- a/bun.lock
+++ b/bun.lock
@@ -21,6 +21,7 @@
         "@paralleldrive/cuid2": "^3.3.0",
         "@repo/db": "*",
         "dotenv-cli": "^11.0.0",
+        "jose": "^6.2.3",
         "ws": "^8.19.0",
       },
       "devDependencies": {
@@ -45,6 +46,7 @@
         "@repo/ui": "*",
         "better-auth": "^1.4.17",
         "dotenv-cli": "^11.0.0",
+        "jose": "^6.2.3",
         "lucide-react": "^0.563.0",
         "motion": "^12.31.0",
         "next": "16.0.10",
@@ -505,7 +507,7 @@
 
     "@ts-morph/common": ["@ts-morph/common@0.27.0", "", { "dependencies": { "fast-glob": "^3.3.3", "minimatch": "^10.0.1", "path-browserify": "^1.0.1" } }, "sha512-Wf29UqxWDpc+i61k3oIOzcUfQt79PIT9y/MWfAGlrkjg6lBC1hwDECLXPVJAhWjiGbfBCxZd65F/LIZF3+jeJQ=="],
 
-    "@types/bun": ["@types/bun@1.3.10", "", { "dependencies": { "bun-types": "1.3.10" } }, "sha512-0+rlrUrOrTSskibryHbvQkDOWRJwJZqZlxrUs1u4oOoTln8+WIXBPmAuCF35SWB2z4Zl3E84Nl/D0P7803nigQ=="],
+    "@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
 
     "@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
 
@@ -611,7 +613,7 @@
 
     "browserslist": ["browserslist@4.28.1", "", { "dependencies": { "baseline-browser-mapping": "^2.9.0", "caniuse-lite": "^1.0.30001759", "electron-to-chromium": "^1.5.263", "node-releases": "^2.0.27", "update-browserslist-db": "^1.2.0" }, "bin": { "browserslist": "cli.js" } }, "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA=="],
 
-    "bun-types": ["bun-types@1.3.10", "", { "dependencies": { "@types/node": "*" } }, "sha512-tcpfCCl6XWo6nCVnpcVrxQ+9AYN1iqMIzgrSKYMB/fjLtV2eyAVEg7AxQJuCq/26R6HpKWykQXuSOq/21RYcbg=="],
+    "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
 
     "bundle-name": ["bundle-name@4.1.0", "", { "dependencies": { "run-applescript": "^7.0.0" } }, "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q=="],
 
@@ -1065,7 +1067,7 @@
 
     "jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
 
-    "jose": ["jose@6.1.3", "", {}, "sha512-0TpaTfihd4QMNwrz/ob2Bp7X04yuxJkjRGi4aKmOqwhov54i6u79oCv7T+C7lo70MKH6BesI3vscD1yb/yzKXQ=="],
+    "jose": ["jose@6.2.3", "", {}, "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw=="],
 
     "js-cookie": ["js-cookie@2.2.1", "", {}, "sha512-HvdH2LzI/EAZcUwA8+0nKNtWHqS+ZmijLA30RwZA0bo7ToCckjK5MkGhjED9KoRcXO6BaGI3I9UIzSA1FKFPOQ=="],
 
@@ -1687,6 +1689,8 @@
 
     "@modelcontextprotocol/sdk/hono": ["hono@4.12.0", "", {}, "sha512-NekXntS5M94pUfiVZ8oXXK/kkri+5WpX2/Ik+LVsl+uvw+soj4roXIsPqO+XsWrAw20mOzaXOZf3Q7PfB9A/IA=="],
 
+    "@modelcontextprotocol/sdk/jose": ["jose@6.1.3", "", {}, "sha512-0TpaTfihd4QMNwrz/ob2Bp7X04yuxJkjRGi4aKmOqwhov54i6u79oCv7T+C7lo70MKH6BesI3vscD1yb/yzKXQ=="],
+
     "@modelcontextprotocol/sdk/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
     "@noble/curves/@noble/hashes": ["@noble/hashes@1.8.0", "", {}, "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A=="],
@@ -1723,6 +1727,8 @@
 
     "ajv-formats/ajv": ["ajv@8.18.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A=="],
 
+    "better-auth/jose": ["jose@6.1.3", "", {}, "sha512-0TpaTfihd4QMNwrz/ob2Bp7X04yuxJkjRGi4aKmOqwhov54i6u79oCv7T+C7lo70MKH6BesI3vscD1yb/yzKXQ=="],
+
     "c12/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
 
     "cliui/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
diff --git a/packages/db/prisma/migrations/20260531120000_add_song_spotify_id/migration.sql b/packages/db/prisma/migrations/20260531120000_add_song_spotify_id/migration.sql
new file mode 100644
index 0000000..a01ead1
--- /dev/null
+++ b/packages/db/prisma/migrations/20260531120000_add_song_spotify_id/migration.sql
@@ -0,0 +1,17 @@
+-- AlterTable
+ALTER TABLE "song" ADD COLUMN "songId" TEXT;
+
+-- Backfill Spotify track IDs from existing URLs where possible
+UPDATE "song"
+SET "songId" = (regexp_match("url", 'track/([^/?]+)'))[1]
+WHERE "songId" IS NULL;
+
+-- Fall back to internal id for legacy rows without a parseable track URL
+UPDATE "song"
+SET "songId" = "id"
+WHERE "songId" IS NULL OR "songId" = '';
+
+ALTER TABLE "song" ALTER COLUMN "songId" SET NOT NULL;
+
+-- CreateIndex
+CREATE INDEX "song_roomId_songId_idx" ON "song"("roomId", "songId");
diff --git a/packages/db/prisma/migrations/20260606000000_add_requested_by_user_to_song/migration.sql b/packages/db/prisma/migrations/20260606000000_add_requested_by_user_to_song/migration.sql
new file mode 100644
index 0000000..fb201d0
--- /dev/null
+++ b/packages/db/prisma/migrations/20260606000000_add_requested_by_user_to_song/migration.sql
@@ -0,0 +1,11 @@
+-- AlterTable
+ALTER TABLE "song" ADD COLUMN "requestedByUserId" TEXT;
+
+-- CreateIndex
+CREATE INDEX "song_requestedByUserId_idx" ON "song"("requestedByUserId");
+
+-- AddForeignKey
+ALTER TABLE "song"
+ADD CONSTRAINT "song_requestedByUserId_fkey"
+FOREIGN KEY ("requestedByUserId") REFERENCES "user"("id")
+ON DELETE SET NULL ON UPDATE CASCADE;
diff --git a/packages/db/prisma/migrations/20260609000000_drop_song_active_track_unique/migration.sql b/packages/db/prisma/migrations/20260609000000_drop_song_active_track_unique/migration.sql
new file mode 100644
index 0000000..4fe1571
--- /dev/null
+++ b/packages/db/prisma/migrations/20260609000000_drop_song_active_track_unique/migration.sql
@@ -0,0 +1,2 @@
+-- Remove partial unique index; duplicate prevention is handled in room-server queue logic.
+DROP INDEX IF EXISTS "song_roomId_songId_active_key";
diff --git a/packages/db/prisma/migrations/20260614000000_song_upvote_history_fks/migration.sql b/packages/db/prisma/migrations/20260614000000_song_upvote_history_fks/migration.sql
new file mode 100644
index 0000000..ff47030
--- /dev/null
+++ b/packages/db/prisma/migrations/20260614000000_song_upvote_history_fks/migration.sql
@@ -0,0 +1,17 @@
+-- Clean up orphaned rows that would violate the new FK constraints
+DELETE FROM "song_upvote_history" h
+WHERE NOT EXISTS (SELECT 1 FROM "room" r WHERE r."id" = h."roomId")
+   OR NOT EXISTS (SELECT 1 FROM "song" s WHERE s."id" = h."songId")
+   OR NOT EXISTS (SELECT 1 FROM "user" u WHERE u."id" = h."userId");
+
+-- AddForeignKey
+ALTER TABLE "song_upvote_history" ADD CONSTRAINT "song_upvote_history_roomId_fkey"
+  FOREIGN KEY ("roomId") REFERENCES "room"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "song_upvote_history" ADD CONSTRAINT "song_upvote_history_songId_fkey"
+  FOREIGN KEY ("songId") REFERENCES "song"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "song_upvote_history" ADD CONSTRAINT "song_upvote_history_userId_fkey"
+  FOREIGN KEY ("userId") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/packages/db/prisma/schema.prisma b/packages/db/prisma/schema.prisma
index 2963857..22ccd4e 100644
--- a/packages/db/prisma/schema.prisma
+++ b/packages/db/prisma/schema.prisma
@@ -30,7 +30,9 @@ model User {
   sessions              Session[]
   accounts              Account[]
   rooms                 Room[]
+  requestedSongs        Song[]
   spotifyOAuthState     SpotifyOAuthState?
+  songUpvoteHistory     SongUpvoteHistory[]
 
   @@unique([email])
   @@map("user")
@@ -96,17 +98,18 @@ model Verification {
 }
 
 model Room {
-  id               String   @id @default(cuid())
-  name             String
-  adminId          String
-  admin            User     @relation(fields: [adminId], references: [id], onDelete: Cascade)
-  maxUpvotes       Int      @default(5)
-  maxUsers         Int      @default(10)
-  autoApproveSongs Boolean  @default(false)
-  autoApproveUsers Boolean  @default(false)
-  createdAt        DateTime @default(now())
-  updatedAt        DateTime @updatedAt
-  songs            Song[]
+  id                 String               @id @default(cuid())
+  name               String
+  adminId            String
+  admin              User                 @relation(fields: [adminId], references: [id], onDelete: Cascade)
+  maxUpvotes         Int                  @default(5)
+  maxUsers           Int                  @default(10)
+  autoApproveSongs   Boolean              @default(false)
+  autoApproveUsers   Boolean              @default(false)
+  createdAt          DateTime             @default(now())
+  updatedAt          DateTime             @updatedAt
+  songs              Song[]
+  songUpvoteHistory  SongUpvoteHistory[]
 
   @@index([adminId])
   @@map("room")
@@ -120,26 +123,35 @@ enum SongStatus {
 }
 
 model Song {
-  id        String     @id @default(cuid())
-  name      String
-  artist    String
-  url       String
-  upvotes   Int        @default(0)
-  imgUrl    String
-  status    SongStatus @default(REQUESTED)
-  roomId    String
-  room      Room       @relation(fields: [roomId], references: [id], onDelete: Cascade)
-  createdAt DateTime   @default(now())
+  id                String              @id @default(cuid())
+  songId            String
+  name              String
+  artist            String
+  url               String
+  upvotes           Int                 @default(0)
+  imgUrl            String
+  status            SongStatus          @default(REQUESTED)
+  requestedByUserId String?
+  requestedBy       User?               @relation(fields: [requestedByUserId], references: [id], onDelete: SetNull)
+  roomId            String
+  room              Room                @relation(fields: [roomId], references: [id], onDelete: Cascade)
+  createdAt         DateTime            @default(now())
+  upvoteHistory     SongUpvoteHistory[]
 
   @@index([roomId])
+  @@index([requestedByUserId])
+  @@index([roomId, songId])
   @@map("song")
 }
 
 model SongUpvoteHistory {
   id        String   @id @default(cuid())
   roomId    String
+  room      Room     @relation(fields: [roomId], references: [id], onDelete: Cascade)
   songId    String
+  song      Song     @relation(fields: [songId], references: [id], onDelete: Cascade)
   userId    String
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
   createdAt DateTime @default(now())
 
   @@unique([roomId, songId, userId])
diff --git a/turbo.json b/turbo.json
index 2c4e0e5..b8a3e1d 100644
--- a/turbo.json
+++ b/turbo.json
@@ -9,14 +9,22 @@
       "env": [
         "DATABASE_URL",
         "WEB_APP_URL",
+        "NEXT_PUBLIC_WEB_APP_URL",
         "BETTER_AUTH_SECRET",
         "GOOGLE_CLIENT_*",
         "WS_PORT",
+        "WS_SECRET",
         "SPOTIFY_*"
       ]
     },
     "lint": {
-      "dependsOn": ["^lint"]
+      "dependsOn": ["^lint"],
+      "env": [
+        "WEB_APP_URL",
+        "NEXT_PUBLIC_WEB_APP_URL",
+        "WS_PORT",
+        "WS_SECRET"
+      ]
     },
     "check-types": {
       "dependsOn": ["^check-types"]