dubs-server 1.0.0

package/routes/adminRoutes.js

@@ -0,0 +1,370 @@
+/**
+ * Admin Routes - Protected endpoints for administrative actions
+ * Only accessible to the admin wallet
+ */
+
+const express = require('express');
+const router = express.Router();
+const { pool } = require('../services/db'); // Shared database pool
+
+// Admin wallet - only this address can use admin endpoints
+const ADMIN_WALLET = 'Hvv1ctqHLR5wonuuRguefS6EpGUe7tFRBX2YWHGr3mes';
+
+/**
+ * Check if a wallet address is an admin
+ */
+function isAdmin(walletAddress) {
+  return walletAddress === ADMIN_WALLET;
+}
+
+/**
+ * Middleware to verify admin wallet from request
+ * Expects wallet address in Authorization header or query param
+ */
+function requireAdmin(req, res, next) {
+  const walletAddress = req.headers['x-wallet-address'] || req.query.wallet;
+
+  if (!walletAddress) {
+    return res.status(401).json({
+      success: false,
+      error: 'Wallet address required'
+    });
+  }
+
+  if (!isAdmin(walletAddress)) {
+    return res.status(403).json({
+      success: false,
+      error: 'Admin access required'
+    });
+  }
+
+  req.adminWallet = walletAddress;
+  next();
+}
+
+/**
+ * GET /api/admin/games/pending
+ * Get all unresolved automatic games for admin review
+ */
+router.get('/games/pending', requireAdmin, async (req, res) => {
+  try {
+    const result = await pool.query(`
+      SELECT
+        g.game_id,
+        g.buy_in,
+        g.game_mode,
+        g.is_locked,
+        g.is_resolved,
+        g.automatic_status,
+        g.sports_event,
+        g.created_at,
+        g.updated_at,
+        g.matchup_image_url,
+        (SELECT COUNT(*) FROM user_game_refs ugr WHERE ugr.game_id = g.game_id AND ugr.team_choice = 'home') as home_count,
+        (SELECT COUNT(*) FROM user_game_refs ugr WHERE ugr.game_id = g.game_id AND ugr.team_choice = 'away') as away_count,
+        (SELECT COUNT(*) FROM user_game_refs ugr WHERE ugr.game_id = g.game_id AND ugr.team_choice = 'draw') as draw_count
+      FROM games g
+      WHERE g.game_mode = 4
+        AND g.is_resolved = false
+      ORDER BY g.created_at DESC
+    `);
+
+    const games = result.rows.map(row => ({
+      gameId: row.game_id,
+      buyIn: parseFloat(row.buy_in),
+      gameMode: row.game_mode,
+      isLocked: row.is_locked,
+      isResolved: row.is_resolved,
+      automaticStatus: row.automatic_status,
+      sportsEvent: row.sports_event,
+      matchupImageUrl: row.matchup_image_url,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at,
+      homeCount: parseInt(row.home_count),
+      awayCount: parseInt(row.away_count),
+      drawCount: parseInt(row.draw_count),
+      totalPlayers: parseInt(row.home_count) + parseInt(row.away_count) + parseInt(row.draw_count)
+    }));
+
+    console.log(`[Admin] Found ${games.length} pending games`);
+
+    res.json({
+      success: true,
+      games
+    });
+
+  } catch (error) {
+    console.error('[Admin] Error fetching pending games:', error);
+    res.status(500).json({
+      success: false,
+      error: 'Failed to fetch pending games'
+    });
+  }
+});
+
+/**
+ * POST /api/admin/games/:gameId/resolve
+ * Manually resolve a game (admin escape hatch)
+ * This updates the database only - on-chain resolution should be handled separately
+ */
+router.post('/games/:gameId/resolve', requireAdmin, async (req, res) => {
+  try {
+    const { gameId } = req.params;
+    const { winner, homeScore, awayScore } = req.body;
+
+    console.log(`[Admin] Manual resolution requested for game: ${gameId}`);
+    console.log(`[Admin]    Winner: ${winner}, Score: ${homeScore}-${awayScore}`);
+    console.log(`[Admin]    Requested by: ${req.adminWallet}`);
+
+    // Validate winner
+    if (!['home', 'away', 'draw', null].includes(winner)) {
+      return res.status(400).json({
+        success: false,
+        error: 'Invalid winner. Must be "home", "away", "draw", or null (for refund)'
+      });
+    }
+
+    // Check if game exists and is not already resolved
+    const checkResult = await pool.query(`
+      SELECT game_id, is_resolved, automatic_status, sports_event
+      FROM games WHERE game_id = $1
+    `, [gameId]);
+
+    if (checkResult.rows.length === 0) {
+      return res.status(404).json({
+        success: false,
+        error: 'Game not found'
+      });
+    }
+
+    if (checkResult.rows[0].is_resolved) {
+      return res.status(400).json({
+        success: false,
+        error: 'Game is already resolved'
+      });
+    }
+
+    // Update game status in PostgreSQL
+    const result = await pool.query(`
+      UPDATE games
+      SET
+        is_resolved = true,
+        automatic_status = 'resolved',
+        sports_event = COALESCE(sports_event, '{}'::jsonb) || $1::jsonb,
+        updated_at = NOW()
+      WHERE game_id = $2
+      RETURNING *
+    `, [
+      JSON.stringify({
+        finalScore: {
+          winner,
+          homeScore: homeScore || 0,
+          awayScore: awayScore || 0,
+          resolvedAt: new Date().toISOString(),
+          resolvedBy: 'admin_manual'
+        }
+      }),
+      gameId
+    ]);
+
+    if (result.rows.length === 0) {
+      return res.status(404).json({
+        success: false,
+        error: 'Failed to update game'
+      });
+    }
+
+    console.log(`[Admin] Successfully resolved game ${gameId} - Winner: ${winner}`);
+
+    const resolvedGame = result.rows[0];
+    const sportsEvent = resolvedGame.sports_event;
+
+    // Broadcast game state update to all clients via global chatNamespace
+    const chatNamespace = global.chatNamespace;
+    if (chatNamespace) {
+      chatNamespace.emit('game:stateUpdate', {
+        gameId,
+        isResolved: true,
+        winner,
+        homeScore: homeScore || 0,
+        awayScore: awayScore || 0,
+        resolvedBy: 'admin_manual',
+        timestamp: Date.now()
+      });
+      console.log(`[Admin] Broadcasted game:stateUpdate for ${gameId}`);
+    }
+
+    // Send notifications to all participants (won/lost/refund)
+    try {
+      console.log(`[Admin] Sending notifications to participants...`);
+
+      // Get all participants
+      const participantsResult = await pool.query(`
+        SELECT wallet_address, team_choice
+        FROM user_game_refs
+        WHERE game_id = $1
+      `, [gameId]);
+
+      const participants = participantsResult.rows;
+      console.log(`[Admin] Found ${participants.length} participant(s) to notify`);
+
+      // Build gameInvite metadata for notifications
+      const gameInvite = {
+        gameId: gameId,
+        gameAddress: resolvedGame.game_address || '',
+        title: resolvedGame.title,
+        imageUrl: resolvedGame.image_url,
+        matchupImageUrl: resolvedGame.matchup_image_url,
+        buyIn: parseFloat(resolvedGame.buy_in),
+        homeTeam: sportsEvent?.strHomeTeam,
+        awayTeam: sportsEvent?.strAwayTeam,
+        homeTeamBadge: sportsEvent?.strHomeTeamBadge,
+        awayTeamBadge: sportsEvent?.strAwayTeamBadge,
+        league: sportsEvent?.strLeague,
+        strTimestamp: sportsEvent?.strTimestamp,
+      };
+
+      const finalScore = {
+        winner,
+        homeScore: homeScore || 0,
+        awayScore: awayScore || 0,
+      };
+
+      // Send notification to each participant
+      for (const participant of participants) {
+        try {
+          const isRefund = winner === null;
+          const userWon = !isRefund && participant.team_choice === winner;
+          const notificationType = isRefund ? 'game_refund' : (userWon ? 'game_won' : 'game_lost');
+          const message = `${homeScore || 0}-${awayScore || 0}`;
+
+          // Insert notification into database
+          await pool.query(`
+            INSERT INTO chat_notifications (
+              wallet_address,
+              notification_type,
+              message,
+              game_invite,
+              final_score,
+              is_read,
+              created_at
+            ) VALUES ($1, $2, $3, $4, $5, false, NOW())
+          `, [
+            participant.wallet_address,
+            notificationType,
+            message,
+            JSON.stringify(gameInvite),
+            JSON.stringify(finalScore)
+          ]);
+
+          // Emit WebSocket notification to the specific user
+          if (chatNamespace) {
+            chatNamespace.to(`user:${participant.wallet_address}`).emit('notification', {
+              type: notificationType,
+              message,
+              gameInvite,
+              finalScore,
+              timestamp: Date.now()
+            });
+          }
+
+          console.log(`[Admin] Notified ${participant.wallet_address}: ${notificationType}`);
+        } catch (notifyError) {
+          console.error(`[Admin] Failed to notify ${participant.wallet_address}:`, notifyError.message);
+        }
+      }
+
+      console.log(`[Admin] Sent notifications to ${participants.length} participant(s)`);
+    } catch (notificationError) {
+      console.error('[Admin] Error sending notifications:', notificationError.message);
+      // Don't fail the request - notifications are non-critical
+    }
+
+    res.json({
+      success: true,
+      message: `Game ${gameId} resolved successfully`,
+      game: {
+        gameId,
+        winner,
+        homeScore: homeScore || 0,
+        awayScore: awayScore || 0,
+        resolvedAt: new Date().toISOString()
+      }
+    });
+
+  } catch (error) {
+    console.error('[Admin] Error resolving game:', error);
+    res.status(500).json({
+      success: false,
+      error: 'Failed to resolve game'
+    });
+  }
+});
+
+/**
+ * DELETE /api/admin/games/:gameId
+ * Delete a game (admin only - for cleaning up test/duplicate games)
+ */
+router.delete('/games/:gameId', requireAdmin, async (req, res) => {
+  try {
+    const { gameId } = req.params;
+
+    console.log(`[Admin] Delete requested for game: ${gameId}`);
+    console.log(`[Admin]    Requested by: ${req.adminWallet}`);
+
+    // First delete user_game_refs (foreign key constraint)
+    await pool.query(`DELETE FROM user_game_refs WHERE game_id = $1`, [gameId]);
+
+    // Then delete the game
+    const result = await pool.query(`
+      DELETE FROM games WHERE game_id = $1 RETURNING game_id
+    `, [gameId]);
+
+    if (result.rows.length === 0) {
+      return res.status(404).json({
+        success: false,
+        error: 'Game not found'
+      });
+    }
+
+    console.log(`[Admin] Successfully deleted game ${gameId}`);
+
+    res.json({
+      success: true,
+      message: `Game ${gameId} deleted successfully`
+    });
+
+  } catch (error) {
+    console.error('[Admin] Error deleting game:', error);
+    res.status(500).json({
+      success: false,
+      error: 'Failed to delete game'
+    });
+  }
+});
+
+/**
+ * POST /api/admin/cache/flush-games
+ * Flush all games cache from Redis. Safe for production — requests fall through
+ * to PostgreSQL and re-warm automatically.
+ */
+router.post('/cache/flush-games', requireAdmin, async (req, res) => {
+  try {
+    const gamesCacheService = require('../services/gamesCacheService');
+    console.log(`[Admin] Games cache flush requested by ${req.adminWallet}`);
+
+    const result = await gamesCacheService.flushAllGamesCaches();
+
+    console.log(`[Admin] Games cache flushed: ${result.deletedKeys} keys deleted`);
+    res.json({
+      success: true,
+      message: `Flushed ${result.deletedKeys} games cache keys`,
+      deletedKeys: result.deletedKeys,
+    });
+  } catch (error) {
+    console.error('[Admin] Error flushing games cache:', error);
+    res.status(500).json({ success: false, error: error.message });
+  }
+});
+
+module.exports = router;