@moneypot/hub 1.11.0 → 1.12.0-dev.1

package/README.md

@@ -76,10 +76,16 @@ insert into hub.api_key default values returning key;
 
 ## Changelog
 
-### 1.10.x
+### 1.12.x
+
+- Added `hub.audit_log` table to track balance and bankroll changes.
+  - Read more: <https://docs.moneypot.com/hub/balance-audit>
+- Removed built-in hub faucet and old withdraw system.
+
+### 1.11.x
 
 - Migrated database-related "globals" into a `ServerContext` object.
-  - Changed `configureApp(app: ExpressServer)` to `configureApp(args: { app: ExpressServer, context: ServerContext })`
+  - Changed `configureApp(app: ExpressServer)` to `configureApp(args: { app: ExpressServer, superuserPool: pg.Pool })`
   - In a postgraphile plugin, you can access the superuser database pool via `const $superuserPool = context().get("superuserPool");`
 
 ### 1.9.x

package/dist/src/audit-log.d.ts

@@ -0,0 +1,32 @@
+import { DbBalance, DbBankroll } from "./db/types.js";
+import { QueryExecutor } from "./db/util.js";
+export type AuditLogType = "player-balance" | "house-bankroll" | "both";
+type AuditAction = "hub:init" | "hub:deposit" | "hub:take_request:pending" | "hub:take_request:refund" | "hub:outcome_bet";
+type AuditRefType = "hub.deposit" | "hub.outcome_bet" | "hub.take_request";
+export type BaseAudit = {
+    action: AuditAction;
+    metadata?: Record<string, unknown> | null;
+} & ({
+    refType: AuditRefType;
+    refId: string;
+} | {
+    refType?: null;
+    refId?: null;
+});
+export type NewBalanceAudit = {
+    balanceId: DbBalance["id"];
+    balanceOld: DbBalance["amount"];
+    balanceNew: DbBalance["amount"];
+    balanceDelta: DbBalance["amount"];
+};
+export type NewBankrollAudit = {
+    bankrollId: DbBankroll["id"];
+    bankrollOld: DbBankroll["amount"];
+    bankrollNew: DbBankroll["amount"];
+    bankrollDelta: DbBankroll["amount"];
+};
+export type NewBothAudit = NewBalanceAudit & NewBankrollAudit;
+export declare function insertAuditLog(pgClient: QueryExecutor, type: "player-balance", audit: NewBalanceAudit & BaseAudit): Promise<void>;
+export declare function insertAuditLog(pgClient: QueryExecutor, type: "house-bankroll", audit: NewBankrollAudit & BaseAudit): Promise<void>;
+export declare function insertAuditLog(pgClient: QueryExecutor, type: "both", audit: NewBothAudit & BaseAudit): Promise<void>;
+export {};

package/dist/src/audit-log.js

@@ -0,0 +1,47 @@
+import { logger } from "./logger.js";
+export async function insertAuditLog(pgClient, type, audit) {
+    await pgClient.query(`
+    INSERT INTO hub.audit_log (
+      balance_id, 
+      bankroll_id,
+
+      balance_old, 
+      balance_new,
+      balance_delta, 
+
+      bankroll_old, 
+      bankroll_new,
+      bankroll_delta, 
+
+      action, 
+      metadata, 
+
+      ref_type, 
+      ref_id
+    )
+    VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+    `, buildAuditParams(type, audit));
+    logger.info({ ...audit }, "audit log inserted");
+}
+function buildAuditParams(type, audit) {
+    const balance = type === "player-balance" || type === "both"
+        ? audit
+        : null;
+    const bankroll = type === "house-bankroll" || type === "both"
+        ? audit
+        : null;
+    return [
+        balance?.balanceId ?? null,
+        bankroll?.bankrollId ?? null,
+        balance?.balanceOld ?? null,
+        balance?.balanceNew ?? null,
+        balance?.balanceDelta ?? null,
+        bankroll?.bankrollOld ?? null,
+        bankroll?.bankrollNew ?? null,
+        bankroll?.bankrollDelta ?? null,
+        audit.action,
+        audit.metadata,
+        audit.refType ?? null,
+        audit.refId ?? null,
+    ];
+}

package/dist/src/db/index.js

@@ -4,6 +4,7 @@ import { exactlyOneRow, maybeOneRow } from "./util.js";
 import { logger } from "../logger.js";
 import { setTimeout } from "node:timers/promises";
 import { assert } from "tsafe";
+import { insertAuditLog } from "../audit-log.js";
 export * from "../hash-chain/db-hash-chain.js";
 export * from "./types.js";
 export * from "./public.js";
@@ -172,28 +173,51 @@ export async function insertDeposit(pool, o) {
         throw new UserFriendlyError("amount must be positive");
     }
     return withPgPoolTransaction(pool, async (client) => {
-        const result = await client.query(`
+        let dbDeposit;
+        try {
+            dbDeposit = await client
+                .query(`
         INSERT INTO hub.deposit(casino_id, mp_transfer_id, user_id, experience_id, amount, currency_key)
         VALUES ($1, $2, $3, $4, $5, $6)
-        ON CONFLICT (casino_id, mp_transfer_id) DO NOTHING
         RETURNING id
       `, [
-            o.casinoId,
-            o.mpTransferId,
-            o.userId,
-            o.experienceId,
-            o.amount,
-            o.currency,
-        ]);
-        if (result.rowCount === 0) {
-            return null;
+                o.casinoId,
+                o.mpTransferId,
+                o.userId,
+                o.experienceId,
+                o.amount,
+                o.currency,
+            ])
+                .then(exactlyOneRow);
         }
-        await client.query(`
+        catch (e) {
+            if (e instanceof pg.DatabaseError && e.code === "23505") {
+                if (e.constraint === "deposit_casino_id_mp_transfer_id_key") {
+                    return null;
+                }
+                logger.error(e, `Unexpected dupe violation constraint. Expected "deposit_casino_id_mp_transfer_id_key" but got ${e.constraint}`);
+                return null;
+            }
+            throw e;
+        }
+        const dbBalance = await client
+            .query(`
         insert into hub.balance(casino_id, user_id, experience_id, currency_key, amount)
         values ($1, $2, $3, $4, $5)
         on conflict (casino_id, user_id, experience_id, currency_key) do update
         set amount = balance.amount + excluded.amount
-      `, [o.casinoId, o.userId, o.experienceId, o.currency, o.amount]);
+        returning id, amount
+      `, [o.casinoId, o.userId, o.experienceId, o.currency, o.amount])
+            .then(exactlyOneRow);
+        await insertAuditLog(client, "player-balance", {
+            balanceId: dbBalance.id,
+            balanceOld: dbBalance.amount - o.amount,
+            balanceNew: dbBalance.amount,
+            balanceDelta: o.amount,
+            action: "hub:deposit",
+            refType: "hub.deposit",
+            refId: dbDeposit.id,
+        });
     });
 }
 export async function processWithdrawal(pgClient, { casinoId, mpTransferId, userId, experienceId, amount, currency, status, }) {

package/dist/src/pg-versions/011-audit-log.sql

@@ -0,0 +1,95 @@
+create table hub.audit_log (
+  id uuid primary key default hub_hidden.uuid_generate_v7(),
+
+  balance_id uuid null references hub.balance(id),
+  bankroll_id uuid null references hub.bankroll(id),
+
+  -- how much? 
+  -- we require all three fields to force callsite to assert its assumptions and
+  -- catch potential desync between assumption and data
+  balance_old float null,
+  balance_new float null,
+  balance_delta float null,
+
+  bankroll_old float null,
+  bankroll_new float null,
+  bankroll_delta float null,
+
+  -- what happened?
+  action text not null, -- hub:init, hub:deposit, hub:take_request:pending, hub:take_request:refund, hub:outcome_bet, etc.
+  metadata jsonb null,
+
+  -- link to the item that caused the change, i.e. deposit, payout, send, take, etc.
+  ref_type text null,
+  ref_id text null, -- not a uuid since users might use it for their own non-uuid ids
+
+   -- Ensure we have at least one type of change
+  check (
+    (balance_delta is not null) or 
+    (bankroll_delta is not null)
+  ),
+  -- Ensure old/new/delta are all present or all null
+  check (
+    (balance_old is null) = (balance_new is null) AND
+    (balance_old is null) = (balance_delta is null)
+  ),
+  check (
+    (bankroll_old is null) = (bankroll_new is null) AND
+    (bankroll_old is null) = (bankroll_delta is null)
+  )
+);
+
+create index on hub.audit_log(balance_id) where balance_id is not null;
+create index on hub.audit_log(bankroll_id) where bankroll_id is not null;
+
+
+
+-- seed audit_log with current balances
+insert into hub.audit_log (
+  bankroll_id,
+  bankroll_old,
+  bankroll_new,
+  bankroll_delta,
+  action
+) 
+select
+  b.id,
+  b.amount,
+  b.amount,
+  0,
+  'hub:init'
+from hub.bankroll b;
+
+
+-- seed audit_log with current balances
+insert into hub.audit_log (
+  balance_id,
+  balance_old,
+  balance_new,
+  balance_delta,
+  action
+)
+select
+  b.id,
+  b.amount,
+  b.amount,
+  0,
+  'hub:init'
+from hub.balance b
+join hub.user u on u.id = b.user_id
+;
+
+-- This view adds convenience fields that can be derived from the row data.
+create view hub.audit_log_view as
+  select
+    al.*,
+    coalesce(b.currency_key, br.currency_key) as currency_key,
+    b.user_id,
+    u.uname,
+    u.mp_user_id,
+    coalesce(b.casino_id, br.casino_id) as casino_id,
+    b.experience_id
+  from hub.audit_log al
+  left join hub.balance b on b.id = al.balance_id
+  left join hub.user u on u.id = b.user_id
+  left join hub.bankroll br on br.id = al.bankroll_id;

package/dist/src/plugins/hub-make-outcome-bet.js

@@ -9,6 +9,7 @@ import { getIntermediateHash, getPreimageHash, } from "../hash-chain/get-hash.js
 import { makeFinalHash, pickRandomOutcome } from "../hash-chain/util.js";
 import { logger } from "../logger.js";
 import { validateRisk } from "../risk-policy.js";
+import { insertAuditLog } from "../audit-log.js";
 const FLOAT_EPSILON = 1e-10;
 function sum(ns) {
     return ns.reduce((a, b) => a + b, 0);
@@ -272,36 +273,26 @@ export function MakeOutcomeBetPlugin({ betConfigs }) {
                                     }, FLOAT_EPSILON);
                                     const outcome = input.outcomes[outcomeIdx];
                                     const netPlayerAmount = input.wager * outcome.profit;
+                                    const houseBankrollDelta = -netPlayerAmount;
                                     await pgClient.query({
                                         text: `
                     UPDATE hub.balance
                     SET amount = amount + $1
-                    WHERE user_id = $2
-                      AND casino_id = $3
-                      AND experience_id = $4
-                      AND currency_key = $5
+                    WHERE id = $2
                   `,
-                                        values: [
-                                            netPlayerAmount,
-                                            session.user_id,
-                                            session.casino_id,
-                                            session.experience_id,
-                                            dbCurrency.key,
-                                        ],
+                                        values: [netPlayerAmount, dbPlayerBalance.id],
                                     });
                                     await pgClient.query({
                                         text: `
                     UPDATE hub.bankroll
-                    SET amount = amount - $1,
+                    SET amount = amount + $2,
                         bets = bets + 1,
-                        wagered = wagered + $4
-                    WHERE currency_key = $2
-                      AND casino_id = $3
+                        wagered = wagered + $3
+                    WHERE id = $1
                   `,
                                         values: [
-                                            netPlayerAmount,
-                                            dbCurrency.key,
-                                            session.casino_id,
+                                            dbHouseBankroll.id,
+                                            houseBankrollDelta,
                                             input.wager,
                                         ],
                                     });
@@ -371,6 +362,23 @@ export function MakeOutcomeBetPlugin({ betConfigs }) {
                                         ],
                                     })
                                         .then(exactlyOneRow);
+                                    await insertAuditLog(pgClient, "both", {
+                                        balanceId: dbPlayerBalance.id,
+                                        balanceOld: dbPlayerBalance.amount,
+                                        balanceNew: dbPlayerBalance.amount + netPlayerAmount,
+                                        balanceDelta: netPlayerAmount,
+                                        bankrollId: dbHouseBankroll.id,
+                                        bankrollOld: dbHouseBankroll.amount,
+                                        bankrollNew: dbHouseBankroll.amount + houseBankrollDelta,
+                                        bankrollDelta: houseBankrollDelta,
+                                        action: "hub:outcome_bet",
+                                        refType: "hub.outcome_bet",
+                                        refId: bet.id,
+                                        metadata: {
+                                            wager: input.wager,
+                                            profit: outcome.profit,
+                                        },
+                                    });
                                     return {
                                         __typename: "HubMakeOutcomeBetSuccess",
                                         betId: bet.id,

package/dist/src/server/graphile.config.js

@@ -8,9 +8,7 @@ import * as db from "../db/index.js";
 import { SmartTagsPlugin } from "../smart-tags.js";
 import { HubAuthenticatePlugin } from "../plugins/hub-authenticate.js";
 import { IdToNodeIdPlugin } from "../plugins/id-to-node-id.js";
-import { HubClaimFaucetPlugin } from "../plugins/hub-claim-faucet.js";
 import { DebugPlugin } from "../plugins/debug.js";
-import { HubWithdrawPlugin } from "../plugins/hub-withdraw.js";
 import { HubPrefixPlugin } from "../plugins/hub-schema-prefix.js";
 import { isUuid } from "../util.js";
 import { HubUserBalanceByCurrencyPlugin } from "../plugins/hub-user-balance-by-currency.js";
@@ -31,7 +29,6 @@ export const requiredPlugins = [
     HubPrefixPlugin,
     HubAuthenticatePlugin,
     HubCurrentXPlugin,
-    HubWithdrawPlugin,
     HubBalanceAlertPlugin,
     HubPutAlertPlugin,
     HubUserBalanceByCurrencyPlugin,
@@ -45,7 +42,6 @@ export const defaultPlugins = [
     HubBadHashChainErrorPlugin,
     HubCreateHashChainPlugin,
     HubUserActiveHashChainPlugin,
-    HubClaimFaucetPlugin,
     customPgOmitArchivedPlugin("deleted"),
 ];
 export function createPreset({ plugins, exportSchemaSDLPath, extraPgSchemas, abortSignal, context, }) {

package/dist/src/take-request/process-take-request.d.ts

@@ -16,7 +16,7 @@ export declare function processSingleTakeRequest({ mpTakeRequestId, mpTakeReques
     casinoId: string;
     graphqlClient: GraphQLClient;
     pool: pg.Pool;
-}): Promise<string | null>;
+}): Promise<string | null | undefined>;
 export declare function completeTransfer({ mpTakeRequestId, takeRequestId, mpTransferId, graphqlClient, casinoId, pool, }: {
     mpTakeRequestId: string;
     takeRequestId: string;

package/dist/src/take-request/process-take-request.js

@@ -5,6 +5,7 @@ import { assert } from "tsafe";
 import { PgAdvisoryLock } from "../pg-advisory-lock.js";
 import { useFragment } from "../__generated__/fragment-masking.js";
 import { logger } from "../logger.js";
+import { insertAuditLog } from "../audit-log.js";
 export const MP_TAKE_REQUEST_FIELDS = gql(`
   fragment MpTakeRequestFields on TakeRequest {
     id
@@ -305,7 +306,16 @@ async function createAndProcessNewTakeRequest({ pgClient, mpTakeRequest, casinoI
     `,
         values: [LocalTakeRequestStatus.PROCESSING, newTakeRequest.id],
     });
-    return await attemptTransfer({
+    await insertAuditLog(pgClient, "player-balance", {
+        balanceId: dbBalance.id,
+        balanceOld: dbBalance.amount,
+        balanceNew: dbBalance.amount - amountToTransfer,
+        balanceDelta: -amountToTransfer,
+        action: "hub:take_request:pending",
+        refType: "hub.take_request",
+        refId: newTakeRequest.id,
+    });
+    await attemptTransfer({
         pgClient,
         takeRequestId: newTakeRequest.id,
         mpTakeRequestId: mpTakeRequest.id,
@@ -582,7 +592,8 @@ export async function completeTransfer({ mpTakeRequestId, takeRequestId, mpTrans
                             logger.warn({ mpTransferId, takeRequestId }, `[completeTransfer] Transfer was already refunded. This should never happen.`);
                             break;
                         }
-                        await pgClient.query({
+                        const dbBalanceAfterUpdate = await pgClient
+                            .query({
                             text: `
                 UPDATE hub.balance
                 SET amount = amount + $1
@@ -590,6 +601,8 @@ export async function completeTransfer({ mpTakeRequestId, takeRequestId, mpTrans
                   AND experience_id = $3 
                   AND casino_id = $4 
                   AND currency_key = $5
+
+                RETURNING id, amount
               `,
                             values: [
                                 takeRequestData.reserved_amount,
@@ -598,6 +611,16 @@ export async function completeTransfer({ mpTakeRequestId, takeRequestId, mpTrans
                                 takeRequestData.casino_id,
                                 takeRequestData.currency_key,
                             ],
+                        })
+                            .then(exactlyOneRow);
+                        await insertAuditLog(pgClient, "player-balance", {
+                            balanceId: dbBalanceAfterUpdate.id,
+                            balanceOld: dbBalanceAfterUpdate.amount - takeRequestData.reserved_amount,
+                            balanceNew: dbBalanceAfterUpdate.amount,
+                            balanceDelta: takeRequestData.reserved_amount,
+                            action: "hub:take_request:refund",
+                            refType: "hub.take_request",
+                            refId: takeRequestId,
                         });
                         await pgClient.query({
                             text: `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moneypot/hub",
-  "version": "1.11.0",
+  "version": "1.12.0-dev.1",
   "author": "moneypot.com",
   "homepage": "https://moneypot.com/hub",
   "keywords": [

package/dist/src/plugins/hub-claim-faucet.d.ts

@@ -1 +0,0 @@
-export declare const HubClaimFaucetPlugin: GraphileConfig.Plugin;

package/dist/src/plugins/hub-claim-faucet.js

@@ -1,93 +0,0 @@
-import { object } from "grafast";
-import { gql, makeExtendSchemaPlugin } from "postgraphile/utils";
-import { withPgPoolTransaction, } from "../db/index.js";
-import { constant, context, sideEffect } from "postgraphile/grafast";
-import { assert } from "tsafe";
-const CLAIM_AMOUNT = 1000;
-export const HubClaimFaucetPlugin = makeExtendSchemaPlugin(() => {
-    return {
-        typeDefs: gql `
-      type HubClaimFaucetPayload {
-        success: Boolean!
-        query: Query
-      }
-
-      extend type Mutation {
-        hubClaimFaucet: HubClaimFaucetPayload
-      }
-    `,
-        objects: {
-            Mutation: {
-                plans: {
-                    hubClaimFaucet() {
-                        const $context = context();
-                        const $identity = $context.get("identity");
-                        const $superuserPool = $context.get("superuserPool");
-                        const $result = sideEffect([$identity, $superuserPool], ([identity, superuserPool]) => {
-                            if (identity?.kind !== "user") {
-                                throw new Error("Must be logged in as user");
-                            }
-                            const { session } = identity;
-                            return withPgPoolTransaction(superuserPool, async (pgClient) => {
-                                await upsertPlayCurrency(pgClient, session.casino_id);
-                                await pgClient.query({
-                                    text: `
-                  insert into hub.faucet_claim (user_id, casino_id, experience_id, currency_key, amount)
-                  values ($1, $2, $3, $4, $5)
-                `,
-                                    values: [
-                                        session.user_id,
-                                        session.casino_id,
-                                        session.experience_id,
-                                        "PLAY",
-                                        CLAIM_AMOUNT,
-                                    ],
-                                });
-                                await pgClient.query({
-                                    text: `
-                  INSERT INTO hub.balance (user_id, experience_id, casino_id, currency_key, amount)
-                  VALUES ($1, $2, $3, $4, $5)
-                  ON CONFLICT (user_id, experience_id, casino_id, currency_key) DO UPDATE
-                  SET amount = balance.amount + EXCLUDED.amount
-               `,
-                                    values: [
-                                        session.user_id,
-                                        session.experience_id,
-                                        session.casino_id,
-                                        "PLAY",
-                                        CLAIM_AMOUNT,
-                                    ],
-                                });
-                                return true;
-                            });
-                        });
-                        return object({
-                            result: $result,
-                        });
-                    },
-                },
-            },
-            HubClaimFaucetPayload: {
-                plans: {
-                    success($data) {
-                        return $data.get("result");
-                    },
-                    query() {
-                        return constant(true);
-                    },
-                },
-            },
-        },
-    };
-});
-async function upsertPlayCurrency(pgClient, casinoId) {
-    assert(pgClient._inTransaction, "pgClient must be in transaction");
-    return pgClient.query({
-        text: `
-      insert into hub.currency (casino_id, key, display_unit_name, display_unit_scale)
-      values ($1, 'PLAY', 'tokens', 1)
-      on conflict (casino_id, key) do nothing
-    `,
-        values: [casinoId],
-    });
-}