dubs-server 1.0.0

package/routes/portfolioRoutes.js

@@ -0,0 +1,217 @@
+/**
+ * Portfolio API Routes
+ *
+ * Public endpoints for fetching Solana wallet portfolios (SOL + SPL tokens).
+ * Data is fetched directly from Solana RPC with 30-second caching.
+ * Also includes admin endpoints for browsing all users' portfolios.
+ */
+
+const express = require('express');
+const router = express.Router();
+const redisService = require('../services/redisService');
+
+// Cache key for users list
+const USERS_CACHE_KEY = 'portfolio:users:list';
+const USERS_CACHE_TTL = 60; // 1 minute TTL for users list
+
+module.exports = (portfolioService, dbPool) => {
+  /**
+   * GET /api/portfolio/health
+   * Health check endpoint for the portfolio service
+   * NOTE: Must be defined BEFORE /:walletAddress to avoid route collision
+   */
+  router.get('/health', async (req, res) => {
+    const stats = portfolioService.getCacheStats();
+    res.json({
+      success: true,
+      status: 'healthy',
+      cache: stats,
+    });
+  });
+
+  /**
+   * GET /api/portfolio/users
+   * Get list of all users with wallet addresses (for admin portfolio browsing)
+   * Returns: id, wallet_address, username, avatar
+   * Cached in Redis for 1 minute
+   * NOTE: Must be defined BEFORE /:walletAddress to avoid route collision
+   */
+  router.get('/users', async (req, res) => {
+    try {
+      // Check Redis cache first
+      if (redisService.isAvailable()) {
+        try {
+          const cached = await redisService.get(USERS_CACHE_KEY);
+          if (cached) {
+            const data = JSON.parse(cached);
+            return res.json({
+              success: true,
+              data: data.users,
+              totalUsers: data.totalUsers,
+              fromCache: true,
+              cachedAt: data.cachedAt,
+            });
+          }
+        } catch (e) {
+          console.error('[Portfolio] Redis cache read error:', e.message);
+        }
+      }
+
+      // Fetch from database
+      const result = await dbPool.query(`
+        SELECT
+          id,
+          wallet_address,
+          username,
+          avatar,
+          created_at
+        FROM users
+        WHERE wallet_address IS NOT NULL
+        ORDER BY created_at DESC
+      `);
+
+      const users = result.rows.map(row => ({
+        id: row.id,
+        walletAddress: row.wallet_address,
+        username: row.username || null,
+        avatar: row.avatar || null,
+        createdAt: row.created_at,
+      }));
+
+      const cacheData = {
+        users,
+        totalUsers: users.length,
+        cachedAt: new Date().toISOString(),
+      };
+
+      // Cache in Redis
+      if (redisService.isAvailable()) {
+        try {
+          await redisService.set(USERS_CACHE_KEY, JSON.stringify(cacheData), USERS_CACHE_TTL);
+        } catch (e) {
+          console.error('[Portfolio] Redis cache write error:', e.message);
+        }
+      }
+
+      res.json({
+        success: true,
+        data: users,
+        totalUsers: users.length,
+        fromCache: false,
+      });
+    } catch (error) {
+      console.error('[Portfolio] Error fetching users:', error.message);
+      res.status(500).json({
+        success: false,
+        error: 'Failed to fetch users list',
+      });
+    }
+  });
+
+  /**
+   * GET /api/portfolio/:walletAddress
+   * Get full portfolio for a wallet (SOL balance + all SPL tokens)
+   *
+   * Query params:
+   *   - network: 'mainnet-beta' | 'devnet' (default: mainnet-beta)
+   *
+   * Response:
+   * {
+   *   success: true,
+   *   data: {
+   *     walletAddress: "8syiXBXMF55...",
+   *     network: "mainnet-beta",
+   *     nativeBalance: { symbol: "SOL", balance: 1.5, ... },
+   *     tokens: [...],
+   *     totalTokens: 5,
+   *     cachedAt: "2026-02-01T...",
+   *     fromCache: true/false
+   *   }
+   * }
+   */
+  router.get('/:walletAddress', async (req, res) => {
+    try {
+      const { walletAddress } = req.params;
+      const network = req.query.network || 'mainnet-beta';
+
+      // Validate network parameter
+      const validNetworks = ['mainnet-beta', 'devnet'];
+      if (!validNetworks.includes(network)) {
+        return res.status(400).json({
+          success: false,
+          error: `Invalid network. Must be one of: ${validNetworks.join(', ')}`,
+        });
+      }
+
+      const portfolio = await portfolioService.getPortfolio(walletAddress, network, false);
+
+      res.json({
+        success: true,
+        data: portfolio,
+      });
+    } catch (error) {
+      console.error('[Portfolio] Error:', error.message);
+
+      // Handle specific error types
+      if (error.message === 'Invalid wallet address') {
+        return res.status(400).json({
+          success: false,
+          error: 'Invalid wallet address format',
+        });
+      }
+
+      res.status(500).json({
+        success: false,
+        error: error.message || 'Failed to fetch portfolio',
+      });
+    }
+  });
+
+  /**
+   * GET /api/portfolio/:walletAddress/refresh
+   * Force cache refresh and return fresh portfolio data
+   *
+   * Query params:
+   *   - network: 'mainnet-beta' | 'devnet' (default: mainnet-beta)
+   */
+  router.get('/:walletAddress/refresh', async (req, res) => {
+    try {
+      const { walletAddress } = req.params;
+      const network = req.query.network || 'mainnet-beta';
+
+      // Validate network parameter
+      const validNetworks = ['mainnet-beta', 'devnet'];
+      if (!validNetworks.includes(network)) {
+        return res.status(400).json({
+          success: false,
+          error: `Invalid network. Must be one of: ${validNetworks.join(', ')}`,
+        });
+      }
+
+      // Force refresh by passing true
+      const portfolio = await portfolioService.getPortfolio(walletAddress, network, true);
+
+      res.json({
+        success: true,
+        data: portfolio,
+        refreshed: true,
+      });
+    } catch (error) {
+      console.error('[Portfolio] Refresh error:', error.message);
+
+      if (error.message === 'Invalid wallet address') {
+        return res.status(400).json({
+          success: false,
+          error: 'Invalid wallet address format',
+        });
+      }
+
+      res.status(500).json({
+        success: false,
+        error: error.message || 'Failed to refresh portfolio',
+      });
+    }
+  });
+
+  return router;
+};

package/routes/promoRoutes.js

@@ -0,0 +1,418 @@
+/**
+ * Promo Routes - Handle promo code validation and sponsored game joins
+ *
+ * Endpoints:
+ *   POST /promo/validate     - Validate a promo code (check if available)
+ *   POST /promo/reserve      - Reserve a promo code for a user
+ *   GET  /promo/active       - Get user's active promo code
+ *   GET  /promo/status       - Get treasury status (admin)
+ *   GET  /promo/stats        - Get promo code statistics (admin)
+ *   POST /promo/generate     - Generate new promo codes (admin)
+ */
+
+const express = require('express');
+const router = express.Router();
+const { authenticate } = require('../middleware/authenticate');
+const promoService = require('../services/promoService');
+const promoTreasuryService = require('../services/promoTreasuryService');
+
+// Admin wallet addresses that can manage promo codes
+const ADMIN_WALLETS = [
+  'Hvv1ctqHLR5wonuuRguefS6EpGUe7tFRBX2YWHGr3mes', // Main admin
+  '27MAuzKZT5SfE6iwLJaaBpzcXeD474ybDsJEv4Fp7Cmj',
+];
+
+/**
+ * Middleware: Require admin wallet for sensitive operations
+ */
+function requireAdmin(req, res, next) {
+  if (!req.user || !ADMIN_WALLETS.includes(req.user.walletAddress)) {
+    return res.status(403).json({
+      success: false,
+      error: 'Admin access required',
+      code: 'ADMIN_REQUIRED',
+    });
+  }
+  next();
+}
+
+/**
+ * POST /promo/validate
+ * Validate a promo code (check if it exists and is available)
+ * Does NOT reserve the code - just checks validity
+ *
+ * Body: { code: "DUBS-XXXX-XXXX" }
+ * Response: { valid: boolean, amountSOL?: number, error?: string }
+ */
+router.post('/validate', async (req, res) => {
+  try {
+    const { code } = req.body;
+
+    if (!code) {
+      return res.status(400).json({ valid: false, error: 'Promo code is required' });
+    }
+
+    const result = await promoService.validateCode(code);
+    res.json(result);
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error validating code:', error.message);
+    res.status(500).json({ valid: false, error: 'Server error validating promo code' });
+  }
+});
+
+/**
+ * POST /promo/reserve
+ * Reserve a promo code for a user during onboarding
+ * Code is reserved for 30 minutes before expiring
+ *
+ * Body: { code: "DUBS-XXXX-XXXX", walletAddress: "..." }
+ * Response: { success: boolean, amountSOL?: number, expiresAt?: string, error?: string }
+ */
+router.post('/reserve', async (req, res) => {
+  try {
+    const { code, walletAddress } = req.body;
+
+    if (!code) {
+      return res.status(400).json({ success: false, error: 'Promo code is required' });
+    }
+
+    if (!walletAddress) {
+      return res.status(400).json({ success: false, error: 'Wallet address is required' });
+    }
+
+    // Check treasury balance before allowing reservation
+    const treasuryReady = promoTreasuryService.isReady();
+    if (!treasuryReady) {
+      return res.status(503).json({
+        success: false,
+        error: 'Promo system is currently unavailable'
+      });
+    }
+
+    const result = await promoService.reserveCode(code, walletAddress);
+
+    if (result.success) {
+      // Verify treasury has enough balance for this promo amount
+      const balanceCheck = await promoTreasuryService.hasEnoughBalance(result.amountLamports);
+      if (!balanceCheck.enough) {
+        // Release the reservation - treasury can't cover it
+        console.error('[PromoRoutes] Treasury balance insufficient, releasing reservation');
+        // Note: We don't have an explicit "release" function, but the reservation
+        // will auto-expire. For better UX, we could add one.
+        return res.status(503).json({
+          success: false,
+          error: 'Promo system temporarily unavailable - please try again later'
+        });
+      }
+    }
+
+    res.json(result);
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error reserving code:', error.message);
+    res.status(500).json({ success: false, error: 'Server error reserving promo code' });
+  }
+});
+
+/**
+ * GET /promo/active
+ * Get user's currently active (reserved but unused) promo code
+ *
+ * Query: ?walletAddress=...
+ * Response: { code?: string, amountSOL?: number, expiresAt?: string } or null
+ */
+router.get('/active', async (req, res) => {
+  try {
+    const { walletAddress } = req.query;
+
+    if (!walletAddress) {
+      return res.status(400).json({ error: 'Wallet address is required' });
+    }
+
+    const activePromo = await promoService.getActivePromoForUser(walletAddress);
+    res.json(activePromo || { hasActivePromo: false });
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error getting active promo:', error.message);
+    res.status(500).json({ error: 'Server error getting active promo' });
+  }
+});
+
+/**
+ * GET /promo/status
+ * Get treasury wallet status (for admin monitoring)
+ * PROTECTED: Admin only
+ *
+ * Response: { initialized: boolean, address?: string, balance?: { sol: number, isLow: boolean } }
+ */
+router.get('/status', authenticate, requireAdmin, async (req, res) => {
+  try {
+    const status = await promoTreasuryService.getStatus();
+    res.json(status);
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error getting treasury status:', error.message);
+    res.status(500).json({ error: 'Server error getting treasury status' });
+  }
+});
+
+/**
+ * GET /promo/stats
+ * Get promo code statistics (for admin dashboard)
+ * PROTECTED: Admin only
+ *
+ * Response: { totalCodes, available, reserved, used, outcomes: { won, lost, refunded }, totalUsedSOL }
+ */
+router.get('/stats', authenticate, requireAdmin, async (req, res) => {
+  try {
+    const stats = await promoService.getStats();
+    res.json(stats);
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error getting stats:', error.message);
+    res.status(500).json({ error: 'Server error getting promo stats' });
+  }
+});
+
+/**
+ * GET /promo/treasury
+ * Get treasury wallet balance (for admin dashboard)
+ * PROTECTED: Admin only
+ *
+ * Response: { address, balanceLamports, balanceSOL, network }
+ */
+router.get('/treasury', authenticate, requireAdmin, async (req, res) => {
+  try {
+    const treasuryInfo = await promoTreasuryService.getTreasuryInfo();
+    res.json(treasuryInfo);
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error getting treasury info:', error.message);
+    res.status(500).json({ error: 'Server error getting treasury info' });
+  }
+});
+
+/**
+ * POST /promo/generate
+ * Generate new promo codes (admin only)
+ * PROTECTED: Admin only
+ *
+ * Body: { count: number, amountSOL?: number, expiresAt?: string, batchId?: string }
+ * Response: { codes: [{ code, amountSOL }], batchId }
+ */
+router.post('/generate', authenticate, requireAdmin, async (req, res) => {
+  try {
+    const { count = 2, amountSOL, expiresAt, batchId, notes } = req.body;
+
+    if (count < 1 || count > 100) {
+      return res.status(400).json({ error: 'Count must be between 1 and 100' });
+    }
+
+    const options = {
+      batchId: batchId || `twitter-${new Date().toISOString().split('T')[0]}`,
+      notes
+    };
+
+    if (amountSOL) {
+      options.amountLamports = Math.floor(amountSOL * 1_000_000_000);
+    }
+
+    if (expiresAt) {
+      options.expiresAt = new Date(expiresAt);
+    }
+
+    const codes = await promoService.generateBatch(count, options);
+
+    res.json({
+      success: true,
+      batchId: options.batchId,
+      count: codes.length,
+      codes
+    });
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error generating codes:', error.message);
+    res.status(500).json({ error: 'Server error generating promo codes' });
+  }
+});
+
+/**
+ * GET /promo/all
+ * Get all promo codes (admin only)
+ * PROTECTED: Admin only
+ *
+ * Response: { codes: [...] }
+ */
+router.get('/all', authenticate, requireAdmin, async (req, res) => {
+  try {
+    const codes = await promoService.getAllCodes();
+    res.json({ codes });
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error getting all codes:', error.message);
+    res.status(500).json({ error: 'Server error getting promo codes' });
+  }
+});
+
+/**
+ * GET /promo/batch/:batchId
+ * Get all codes in a batch (for tracking Twitter giveaways)
+ * PROTECTED: Admin only
+ *
+ * Response: { codes: [...] }
+ */
+router.get('/batch/:batchId', authenticate, requireAdmin, async (req, res) => {
+  try {
+    const { batchId } = req.params;
+
+    const codes = await promoService.getCodesByBatch(batchId);
+    res.json({ batchId, count: codes.length, codes });
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error getting batch:', error.message);
+    res.status(500).json({ error: 'Server error getting batch codes' });
+  }
+});
+
+/**
+ * GET /promo/status/:walletAddress
+ * Get user's promo status for the in-app banner
+ * Returns info about their reserved or used promo code
+ *
+ * Response: {
+ *   hasActivePromo: boolean,
+ *   code: string | null,
+ *   amountSOL: number,
+ *   status: 'reserved' | 'used' | null,
+ *   gameOutcome: 'won' | 'lost' | 'refunded' | null,
+ *   bannerDismissed: boolean
+ * }
+ */
+router.get('/status/:walletAddress', async (req, res) => {
+  try {
+    const { walletAddress } = req.params;
+
+    if (!walletAddress) {
+      return res.status(400).json({ error: 'Wallet address is required' });
+    }
+
+    const status = await promoService.getUserPromoStatus(walletAddress);
+    res.json(status);
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error getting user promo status:', error.message);
+    res.status(500).json({ error: 'Server error getting promo status' });
+  }
+});
+
+/**
+ * POST /promo/release
+ * Release a promo code back to available status (admin only)
+ * Use this to clean up duplicate reservations
+ * PROTECTED: Admin only
+ *
+ * Body: { code: "DUBS-XXXX-XXXX" }
+ * Response: { success: boolean, code?: string, error?: string }
+ */
+router.post('/release', authenticate, requireAdmin, async (req, res) => {
+  try {
+    const { code } = req.body;
+
+    if (!code) {
+      return res.status(400).json({ success: false, error: 'Code is required' });
+    }
+
+    const result = await promoService.releaseCode(code);
+    res.json(result);
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error releasing code:', error.message);
+    res.status(500).json({ success: false, error: 'Server error releasing code' });
+  }
+});
+
+/**
+ * POST /promo/confirm-usage
+ * Confirm that a promo code was used (called AFTER transaction is confirmed on-chain)
+ * This is the only way to mark a promo as 'used' - prevents marking as used if user cancels
+ *
+ * Body: { code: "DUBS-XXXX-XXXX", walletAddress: "...", gameId: "...", signature: "..." }
+ * Response: { success: boolean, error?: string }
+ */
+router.post('/confirm-usage', async (req, res) => {
+  try {
+    const { code, walletAddress, gameId, signature } = req.body;
+
+    if (!code) {
+      return res.status(400).json({ success: false, error: 'Code is required' });
+    }
+
+    if (!walletAddress) {
+      return res.status(400).json({ success: false, error: 'Wallet address is required' });
+    }
+
+    if (!gameId) {
+      return res.status(400).json({ success: false, error: 'Game ID is required' });
+    }
+
+    if (!signature) {
+      return res.status(400).json({ success: false, error: 'Transaction signature is required - promo can only be marked used after confirmed tx' });
+    }
+
+    console.log('[PromoRoutes] Confirming usage:', { code, walletAddress, gameId, signature: signature.slice(0, 20) + '...' });
+
+    // Verify the code belongs to this wallet and is reserved
+    const activePromo = await promoService.getActivePromoForUser(walletAddress);
+
+    if (!activePromo) {
+      return res.status(400).json({ success: false, error: 'No active promo found for this wallet' });
+    }
+
+    if (activePromo.code !== code.trim().toUpperCase()) {
+      return res.status(400).json({
+        success: false,
+        error: `Code mismatch. Expected: ${activePromo.code}, Got: ${code}`
+      });
+    }
+
+    // Mark as used
+    const result = await promoService.markCodeAsUsed(code, walletAddress, gameId);
+
+    if (result.success) {
+      console.log('[PromoRoutes] ✅ Promo confirmed as used:', code, 'for game:', gameId);
+    }
+
+    res.json(result);
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error confirming usage:', error.message);
+    res.status(500).json({ success: false, error: 'Server error confirming promo usage' });
+  }
+});
+
+/**
+ * POST /promo/dismiss-banner
+ * Mark the promo banner as dismissed for a user
+ *
+ * Body: { walletAddress: "..." }
+ * Response: { success: boolean }
+ */
+router.post('/dismiss-banner', async (req, res) => {
+  try {
+    const { walletAddress } = req.body;
+
+    if (!walletAddress) {
+      return res.status(400).json({ success: false, error: 'Wallet address is required' });
+    }
+
+    const result = await promoService.dismissBanner(walletAddress);
+    res.json(result);
+
+  } catch (error) {
+    console.error('[PromoRoutes] Error dismissing banner:', error.message);
+    res.status(500).json({ success: false, error: 'Server error dismissing banner' });
+  }
+});
+
+module.exports = router;