web-next: herramientas de PD (transferir, comercio, códigos de promoción)

- /transfer-d-points: transferir PD a la cuenta dueña de un personaje
  (requiere token de seguridad; movimiento atómico con FOR UPDATE).
- /trade-points: comercio PD<->oro mediante códigos de 1 solo uso
  (contraseña + token + Turnstile; oro al creador por SOAP; expira 1h;
  lock de 5s tras canjear; rollback total si falla la entrega).
- /promo-code: canje de códigos por PD/PV (sensibles a mayúsculas/minúsculas,
  usos limitados, 1 canje por cuenta).
- /admin/promo: panel para crear / editar / activar / desactivar / borrar
  códigos de promoción.
- Tablas nuevas (sql/): home_tradecode, home_promocode, home_promoredemption.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web-next/app/api/admin/promo/[id]/route.ts

@@ -0,0 +1,31 @@
+import { getSession } from '@/lib/session'
+import { isAdmin } from '@/lib/admin'
+import { updatePromoCode, deletePromoCode } from '@/lib/admin-promo'
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const session = await getSession()
+  if (!(await isAdmin(session))) return Response.json({ success: false, error: 'forbidden' }, { status: 403 })
+  const { id } = await params
+  let b: Record<string, unknown> = {}
+  try {
+    b = await request.json()
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+  const pd = Number(b.pd)
+  const pv = Number(b.pv)
+  const maxUses = Number(b.maxUses)
+  if (!Number.isInteger(pd) || pd < 0 || !Number.isInteger(pv) || pv < 0 || !Number.isInteger(maxUses) || maxUses < 1) {
+    return Response.json({ success: false, error: 'emptyError' })
+  }
+  await updatePromoCode(Number(id), { pd, pv, maxUses, active: Boolean(b.active) })
+  return Response.json({ success: true })
+}
+
+export async function DELETE(_request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const session = await getSession()
+  if (!(await isAdmin(session))) return Response.json({ success: false, error: 'forbidden' }, { status: 403 })
+  const { id } = await params
+  await deletePromoCode(Number(id))
+  return Response.json({ success: true })
+}

web-next/app/api/admin/promo/route.ts

@@ -0,0 +1,28 @@
+import { getSession } from '@/lib/session'
+import { isAdmin } from '@/lib/admin'
+import { createPromoCode } from '@/lib/admin-promo'
+
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!(await isAdmin(session))) return Response.json({ success: false, error: 'forbidden' }, { status: 403 })
+  let b: Record<string, unknown> = {}
+  try {
+    b = await request.json()
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+  const code = String(b.code ?? '').trim()
+  const pd = Number(b.pd)
+  const pv = Number(b.pv)
+  const maxUses = Number(b.maxUses)
+  const expiresAt = String(b.expiresAt ?? '')
+  if (!code || !Number.isInteger(pd) || pd < 0 || !Number.isInteger(pv) || pv < 0) {
+    return Response.json({ success: false, error: 'emptyError' })
+  }
+  if (!Number.isInteger(maxUses) || maxUses < 1) return Response.json({ success: false, error: 'emptyError' })
+  if (pd === 0 && pv === 0) return Response.json({ success: false, error: 'emptyError' })
+
+  const r = await createPromoCode(code, pd, pv, maxUses, expiresAt)
+  if (r.error) return Response.json({ success: false, error: r.error })
+  return Response.json({ success: true, id: r.id })
+}

web-next/app/api/dpoints/trade/check/route.ts

@@ -0,0 +1,19 @@
+import { getSession } from '@/lib/session'
+import { checkTradeCode } from '@/lib/trade'
+
+/** COMPRA: consulta el valor en PD y el coste en oro de un código. */
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!session.accountId || !session.username) {
+    return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
+  }
+
+  let body: Record<string, unknown> = {}
+  try {
+    body = await request.json()
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+
+  return Response.json(await checkTradeCode(String(body.code ?? '')))
+}

web-next/app/api/dpoints/trade/create/route.ts

@@ -0,0 +1,33 @@
+import { getSession } from '@/lib/session'
+import { verifyTurnstile } from '@/lib/turnstile'
+import { createTradeCode } from '@/lib/trade'
+
+/** VENTA: crea un código de Comercio de PD. */
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!session.accountId || !session.username) {
+    return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
+  }
+
+  let body: Record<string, unknown> = {}
+  try {
+    body = await request.json()
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+
+  const ip = (request.headers.get('x-forwarded-for') || '').split(',')[0].trim() || undefined
+  const turnstileOk = await verifyTurnstile(String(body.turnstile ?? ''), ip)
+
+  const result = await createTradeCode({
+    creatorAccount: session.accountId,
+    creatorEmail: session.bnetEmail || '',
+    creatorCharacter: String(body.character ?? '').trim(),
+    points: Number(body.points),
+    gold: Number(body.gold),
+    password: String(body.password ?? ''),
+    token: String(body.token ?? '').trim(),
+    turnstileOk,
+  })
+  return Response.json(result)
+}

web-next/app/api/dpoints/trade/redeem/route.ts

@@ -0,0 +1,32 @@
+import { getSession } from '@/lib/session'
+import { verifyTurnstile } from '@/lib/turnstile'
+import { redeemTradeCode } from '@/lib/trade'
+
+/** COMPRA: canjea un código de Comercio de PD. */
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!session.accountId || !session.username) {
+    return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
+  }
+
+  let body: Record<string, unknown> = {}
+  try {
+    body = await request.json()
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+
+  const ip = (request.headers.get('x-forwarded-for') || '').split(',')[0].trim() || undefined
+  const turnstileOk = await verifyTurnstile(String(body.turnstile ?? ''), ip)
+
+  const result = await redeemTradeCode({
+    buyerAccount: session.accountId,
+    buyerEmail: session.bnetEmail || '',
+    buyerCharacter: String(body.character ?? '').trim(),
+    code: String(body.code ?? ''),
+    password: String(body.password ?? ''),
+    token: String(body.token ?? '').trim(),
+    turnstileOk,
+  })
+  return Response.json(result)
+}

web-next/app/api/dpoints/transfer/route.ts

@@ -0,0 +1,40 @@
+import { getSession } from '@/lib/session'
+import { checkSecurityToken } from '@/lib/security-token'
+import { getAccountIdByCharacterName } from '@/lib/characters'
+import { transferDPoints } from '@/lib/dpoints'
+
+/**
+ * Transfiere PD desde la cuenta en sesión a la cuenta dueña del personaje
+ * indicado. Requiere el token de seguridad de la cuenta. Acción irreversible.
+ */
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!session.accountId || !session.username) {
+    return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
+  }
+
+  let body: Record<string, unknown> = {}
+  try {
+    body = await request.json()
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+
+  const character = String(body.character ?? '').trim()
+  const token = String(body.token ?? '').trim()
+  const amount = Number(body.amount)
+
+  if (!character || !token) return Response.json({ success: false, error: 'missingFields' })
+  if (!Number.isInteger(amount) || amount <= 0) return Response.json({ success: false, error: 'invalidAmount' })
+
+  if (!(await checkSecurityToken(session.accountId, token))) {
+    return Response.json({ success: false, error: 'invalidToken' })
+  }
+
+  const destAccountId = await getAccountIdByCharacterName(character)
+  if (!destAccountId) return Response.json({ success: false, error: 'characterNotFound' })
+  if (destAccountId === session.accountId) return Response.json({ success: false, error: 'sameAccount' })
+
+  const result = await transferDPoints(session.accountId, destAccountId, amount)
+  return Response.json(result)
+}

web-next/app/api/promo/redeem/route.ts

@@ -0,0 +1,19 @@
+import { getSession } from '@/lib/session'
+import { redeemPromoCode } from '@/lib/promo'
+
+/** Canjea un código de promoción por PD/PV en la cuenta en sesión. */
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!session.accountId || !session.username) {
+    return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
+  }
+
+  let body: Record<string, unknown> = {}
+  try {
+    body = await request.json()
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+
+  return Response.json(await redeemPromoCode(session.accountId, String(body.code ?? '')))
+}