1import type { FastifyInstance } from "fastify";2import { and, db, desc, eq, favorites, gameStatistics, games, sql, userGameStats } from "@spinza/database";3import { getGame, FIRST_GAME_RECOMMENDATIONS } from "@spinza/games";4import { spinSchema, type GameCard, type GameInfo } from "@spinza/shared";5import { requireUser } from "../plugins/auth";6import { errors } from "../lib/errors";7import { flag } from "../lib/settings";8import { spin } from "../services/spin";9import { rateLimit, redis } from "../lib/redis";10import { clientIp, logSecurity } from "../lib/security";11import { z } from "zod";1213type GameRow = typeof games.$inferSelect;1415function toCard(g: GameRow, extra: { popularity?: number; favorite?: boolean; lastPlayedAt?: Date | null } = {}): GameCard {16 const s = g.summary as Record<string, unknown>;17 return {18 slug: g.slug,19 name: g.name,20 tagline: s.tagline as string,21 theme: s.theme as string,22 volatility: s.volatility as GameCard["volatility"],23 version: g.version,24 grid: s.grid as GameCard["grid"],25 minBet: s.minBet as number,26 maxBet: s.maxBet as number,27 maxMultiplier: s.maxMultiplier as number,28 features: (s.features as string[]) ?? [],29 tags: (s.tags as string[]) ?? [],30 palette: s.palette as GameCard["palette"],31 presentation: s.presentation32 ? { frame: (s.presentation as GameCard["presentation"])!.frame, backdrop: (s.presentation as GameCard["presentation"])!.backdrop, particles: (s.presentation as GameCard["presentation"])!.particles, ambience: (s.presentation as GameCard["presentation"])!.ambience }33 : undefined,34 lifecycle: g.lifecycle as GameCard["lifecycle"],35 isNew: g.isNew,36 isFeatured: g.isFeatured,37 isJackpot: !!s.isJackpot,38 popularity: extra.popularity ?? 0,39 favorite: extra.favorite,40 lastPlayedAt: extra.lastPlayedAt ? extra.lastPlayedAt.toISOString() : null,41 };42}4344export async function publishedGames(): Promise<GameRow[]> {45 const rows = await db.select().from(games).where(eq(games.lifecycle, "published")).orderBy(games.sortOrder);46 return rows.filter((g) => flag(`game.${g.slug}.enabled`));47}4849export async function gameRoutes(app: FastifyInstance) {50 /** Public lobby data. When signed in, includes favorites + continue playing. */51 app.get("/api/games", async (req) => {52 const rows = await publishedGames();53 const stats = await db.select({ gameId: gameStatistics.gameId, spins: gameStatistics.spins, launches: gameStatistics.launches }).from(gameStatistics);54 const statMap = new Map(stats.map((s) => [s.gameId, s]));55 let favs = new Set<string>();56 let recent = new Map<string, Date>();57 if (req.user) {58 const f = await db.select({ gameId: favorites.gameId }).from(favorites).where(eq(favorites.userId, req.user.id));59 favs = new Set(f.map((x) => x.gameId));60 const r = await db.select({ gameId: userGameStats.gameId, at: userGameStats.lastPlayedAt }).from(userGameStats).where(eq(userGameStats.userId, req.user.id));61 recent = new Map(r.map((x) => [x.gameId, x.at]));62 }63 const live = await redis().zcount("live:players", Date.now() - 5 * 60_000, "+inf").catch(() => 0);64 const cards = rows.map((g) => {65 const st = statMap.get(g.id);66 return toCard(g, { popularity: Number(st?.spins ?? 0) + Number(st?.launches ?? 0) * 20, favorite: favs.has(g.id), lastPlayedAt: recent.get(g.id) ?? null });67 });68 return { games: cards, livePlayers: live, recommendations: FIRST_GAME_RECOMMENDATIONS };69 });7071 app.get("/api/games/:slug", async (req) => {72 const { slug } = req.params as { slug: string };73 const g = await db.query.games.findFirst({ where: eq(games.slug, slug) });74 const def = getGame(slug);75 if (!g || !def || g.lifecycle !== "published" || !flag(`game.${slug}.enabled`)) throw errors.notFound("Game not found");76 const s = g.summary as Record<string, unknown>;77 const cert = (s.certification as GameInfo["certification"] | null) ?? null;78 let favorite = false;79 if (req.user) favorite = !!(await db.query.favorites.findFirst({ where: and(eq(favorites.userId, req.user.id), eq(favorites.gameId, g.id)) }));80 const info: GameInfo = {81 ...toCard(g, { favorite }),82 rtp: def.rtp,83 hitFrequency: cert?.hitRate ?? null,84 description: def.description,85 rules: def.rules,86 paytable: def.symbols87 .filter((sym) => sym.pays || sym.scatterPays)88 .map((sym) => ({89 symbol: sym.id,90 label: sym.name,91 // Displayed as multiples of total bet (payScale/betDivisor applied), rounded to 2 decimals.92 pays: Object.fromEntries(93 Object.entries(sym.pays ?? sym.scatterPays ?? {}).map(([k, v]) => [k, Number(((v * def.payScale) / (sym.pays ? def.betDivisor : 1)).toFixed(3))]),94 ),95 })),96 certification: cert,97 };98 return { game: info, definition: clientDefinition(def) };99 });100101 app.post("/api/games/:slug/launch", async (req) => {102 const { slug } = req.params as { slug: string };103 const g = await db.query.games.findFirst({ where: eq(games.slug, slug), columns: { id: true } });104 if (!g) throw errors.notFound();105 await db.update(gameStatistics).set({ launches: sql`${gameStatistics.launches} + 1` }).where(eq(gameStatistics.gameId, g.id));106 if (req.user) {107 // Persisted game state for meters/heat so the client can render them on load.108 const st = await db.execute(sql`select state from game_states where user_id = ${req.user.id} and game_id = ${g.id}`);109 return { ok: true, state: (st.rows[0] as { state?: unknown } | undefined)?.state ?? null };110 }111 return { ok: true, state: null };112 });113114 app.post("/api/games/:slug/spin", async (req) => {115 const user = requireUser(req);116 const { slug } = req.params as { slug: string };117 const retry = await rateLimit(`spin:${user.id}`, 240, 60);118 if (retry) {119 await logSecurity(req, "spin.suspicious", { userId: user.id, severity: "warn", meta: { slug, ip: clientIp(req) } });120 throw errors.rateLimited(retry);121 }122 const parsed = spinSchema.safeParse(req.body);123 if (!parsed.success) throw errors.badRequest("Invalid spin request.", parsed.error.flatten());124 return spin({ userId: user.id, slug, bet: parsed.data.bet, clientRoundId: parsed.data.clientRoundId });125 });126127 app.get("/api/games/:slug/history", async (req) => {128 const user = requireUser(req);129 const { slug } = req.params as { slug: string };130 const q = z.object({ limit: z.coerce.number().int().min(1).max(50).default(20) }).parse(req.query);131 const rows = await db.execute(sql`select round_id, bet, win, multiplier, balance_after, created_at, features from game_rounds where user_id = ${user.id} and game_slug = ${slug} order by created_at desc limit ${q.limit}`);132 return {133 entries: (rows.rows as Record<string, unknown>[]).map((r) => ({134 roundId: r.round_id,135 bet: Number(r.bet),136 win: Number(r.win),137 multiplier: Number(r.multiplier),138 balanceAfter: Number(r.balance_after),139 createdAt: (r.created_at as Date).toISOString(),140 features: r.features,141 })),142 };143 });144145 app.post("/api/games/:slug/favorite", async (req) => {146 const user = requireUser(req);147 const { slug } = req.params as { slug: string };148 const g = await db.query.games.findFirst({ where: eq(games.slug, slug), columns: { id: true } });149 if (!g) throw errors.notFound();150 const existing = await db.query.favorites.findFirst({ where: and(eq(favorites.userId, user.id), eq(favorites.gameId, g.id)) });151 if (existing) {152 await db.delete(favorites).where(and(eq(favorites.userId, user.id), eq(favorites.gameId, g.id)));153 await db.update(gameStatistics).set({ favorites: sql`greatest(${gameStatistics.favorites} - 1, 0)` }).where(eq(gameStatistics.gameId, g.id));154 return { favorite: false };155 }156 await db.insert(favorites).values({ userId: user.id, gameId: g.id });157 await db.update(gameStatistics).set({ favorites: sql`${gameStatistics.favorites} + 1` }).where(eq(gameStatistics.gameId, g.id));158 return { favorite: true };159 });160161 app.get("/api/user/games", async (req) => {162 const user = requireUser(req);163 const rows = await db164 .select({ slug: games.slug, name: games.name, spins: userGameStats.spins, won: userGameStats.won, wagered: userGameStats.wagered, biggestWin: userGameStats.biggestWin, biggestMultiplier: userGameStats.biggestMultiplier, lastPlayedAt: userGameStats.lastPlayedAt })165 .from(userGameStats)166 .innerJoin(games, eq(games.id, userGameStats.gameId))167 .where(eq(userGameStats.userId, user.id))168 .orderBy(desc(userGameStats.lastPlayedAt));169 return { games: rows.map((r) => ({ ...r, biggestMultiplier: Number(r.biggestMultiplier), lastPlayedAt: r.lastPlayedAt.toISOString() })) };170 });171}172173/** Definition data the renderer needs (symbols, grid, presentation). Weights are public "Game Info" data too. */174export function clientDefinition(def: ReturnType<typeof getGame> & object) {175 return {176 slug: def.slug,177 name: def.name,178 version: def.version,179 grid: def.grid,180 payModel: def.payModel,181 symbols: def.symbols.map((s) => ({ id: s.id, name: s.name, kind: s.kind, tier: s.tier, style: s.style })),182 wild: def.wild ? { id: def.wild.id, expanding: !!def.wild.expanding, sticky: !!def.wild.sticky, multiplier: !!def.wild.multiplier, exploding: !!def.wild.exploding, moving: !!def.wild.moving } : null,183 scatter: def.scatter ? { id: def.scatter.id, triggers: def.scatter.triggers } : null,184 cascades: !!def.cascades,185 spinCollect: def.spinCollect ? { symbolId: def.spinCollect.symbolId, ladder: def.spinCollect.ladder } : null,186 holdRespin: def.holdRespin ? { symbolId: def.holdRespin.symbolId, respins: def.holdRespin.respins, jackpots: def.holdRespin.jackpots } : null,187 meter: def.meter ? { id: def.meter.id, name: def.meter.name, symbolId: def.meter.symbolId, max: def.meter.max, label: def.meter.onFull.label } : null,188 heat: def.heat ? { max: def.heat.max, ladder: def.heat.ladder, bandSize: def.heat.bandSize, label: def.heat.meltdown.label } : null,189 mystery: def.mystery ? { symbolId: def.mystery.symbolId } : null,190 quantum: !!def.quantum,191 dynamicGrid: def.dynamicGrid ?? null,192 jackpot: def.jackpot ? { tiers: def.jackpot.tiers.map((t) => ({ id: t.id, multiplier: t.multiplier })) } : null,193 pickBonuses: def.pickBonuses?.map((b) => ({ id: b.id, name: b.name, cells: b.cells, picks: b.picks })) ?? [],194 minBet: def.minBet,195 maxBet: def.maxBet,196 maxMultiplier: def.maxMultiplier,197 volatility: def.volatility,198 presentation: def.presentation,199 featureNames: def.featureNames,200 };201}202