server.lua

local QBCore = exports['qb-core']:GetCoreObject()

-- Multi-source seed: wall time + high-res clock tick, then burn first 3 values
math.randomseed(os.time() + math.floor(os.clock() * 1e6))
math.random(); math.random(); math.random()

-- ─────────────────────────────────────────────────────────────────────────────
--  State
-- ─────────────────────────────────────────────────────────────────────────────

local activeRaffle      = nil   -- { name, prize, prizeType, prizeData, startedBy, startTime }
local enteredPlayers    = {}    -- [src] = playerName
local raffleHistory     = {}    -- array of completed raffle records
local activePresets     = nil   -- live-editable clone of Config.PresetPrizes
local cachedVehicleList = nil   -- built once from QBCore.Shared.Vehicles
local cachedItemList    = nil   -- built once from ox_inventory:Items()
local winnerCooldowns   = {}    -- [citizenid] = rafflesRemaining (decremented each draw)

-- ─────────────────────────────────────────────────────────────────────────────
--  Helpers
-- ─────────────────────────────────────────────────────────────────────────────

local function HasAdminPermission(src)
    local Player = QBCore.Functions.GetPlayer(src)
    if not Player then return false end
    for _, group in ipairs(Config.AdminGroups) do
        if QBCore.Functions.HasPermission(src, group) then return true end
    end
    return false
end

local function GetOnlinePlayers()
    local players = {}
    for _, src in ipairs(GetPlayers()) do
        local id = tonumber(src)
        if id then table.insert(players, id) end
    end
    return players
end

local function NotifyPlayer(src, msg, msgType)
    TriggerClientEvent('dynamic-raffle:notify', src, msg, msgType or 'inform')
end

local function NotifyAll(msg, msgType)
    TriggerClientEvent('dynamic-raffle:notify', -1, msg, msgType or 'inform')
end

local function SafeDate()
    local t  = os.date('*t')
    local h  = t.hour % 12
    if h == 0 then h = 12 end
    local ap = t.hour >= 12 and 'PM' or 'AM'
    return string.format('%02d/%02d/%04d %02d:%02d %s', t.month, t.day, t.year, h, t.min, ap)
end

-- ─────────────────────────────────────────────────────────────────────────────
--  Preset helpers
-- ─────────────────────────────────────────────────────────────────────────────

local function GetPresets()
    if not activePresets then
        activePresets = {}
        for _, v in ipairs(Config.PresetPrizes) do
            table.insert(activePresets, v)
        end
    end
    return activePresets
end

-- ─────────────────────────────────────────────────────────────────────────────
--  Vehicle list (built once from QBCore.Shared.Vehicles, then cached)
-- ─────────────────────────────────────────────────────────────────────────────

local function GetVehicleList()
    if cachedVehicleList then return cachedVehicleList end

    local list = {}
    for model, data in pairs(QBCore.Shared.Vehicles) do
        local brand = (data.brand and data.brand ~= '') and (data.brand .. ' ') or ''
        local name  = data.name or model
        table.insert(list, { model = model, label = brand .. name })
    end
    table.sort(list, function(a, b) return a.label < b.label end)

    cachedVehicleList = list
    return list
end

-- ─────────────────────────────────────────────────────────────────────────────
--  Item list (built once from ox_inventory, then cached)
-- ─────────────────────────────────────────────────────────────────────────────

local function GetItemList()
    if cachedItemList then return cachedItemList end

    local ok, items = pcall(function() return exports.ox_inventory:Items() end)
    if not ok or not items then return {} end

    local list = {}
    for name, data in pairs(items) do
        if type(data) == 'table' and data.label then
            table.insert(list, { name = name, label = data.label })
        end
    end
    table.sort(list, function(a, b) return a.label < b.label end)

    cachedItemList = list
    return list
end

-- ─────────────────────────────────────────────────────────────────────────────
--  Human-readable prize label (stored on raffle + shown in notifications)
-- ─────────────────────────────────────────────────────────────────────────────

local function BuildPrizeLabel(prizeType, prizeData)
    if prizeType == 'vehicle' then
        local veh   = QBCore.Shared.Vehicles[prizeData.model]
        local brand = (veh and veh.brand and veh.brand ~= '') and (veh.brand .. ' ') or ''
        local name  = (veh and veh.name) or prizeData.model
        return '🚗 ' .. brand .. name

    elseif prizeType == 'cash' then
        local acct = (prizeData.account == 'cash') and 'Cash' or 'Bank'
        return string.format('💰 $%s (%s)', tostring(prizeData.amount), acct)

    elseif prizeType == 'item' then
        return string.format('📦 %s x%d', prizeData.name, prizeData.count or 1)

    else -- 'custom'
        return prizeData.description or '??? Mystery Prize'
    end
end

-- ─────────────────────────────────────────────────────────────────────────────
--  Prize delivery — called after winner is drawn
-- ─────────────────────────────────────────────────────────────────────────────

local function DeliverPrize(winnerSrc, prizeType, prizeData)
    local Player = QBCore.Functions.GetPlayer(winnerSrc)
    if not Player then
        print('[dynamic-raffle] ERROR: Could not get player object for winner src=' .. tostring(winnerSrc))
        return
    end

    -- ── Cash ────────────────────────────────────────────────────────────────
    if prizeType == 'cash' then
        local account = prizeData.account or Config.CashAccount
        local amount  = math.floor(tonumber(prizeData.amount) or 0)

        Player.Functions.AddMoney(account, amount, 'raffle-prize')

        NotifyPlayer(winnerSrc,
            string.format(
                '💰 $%d has been added to your %s! Congrats!',
                amount,
                account == 'bank' and 'bank account' or 'cash'
            ),
            'success'
        )

        print(string.format('[dynamic-raffle] Delivered $%d (%s) to %s', amount, account, GetPlayerName(winnerSrc)))

    -- ── Vehicle ─────────────────────────────────────────────────────────────
    elseif prizeType == 'vehicle' then
        local model     = prizeData.model
        local citizenid = Player.PlayerData.citizenid
        local plate     = QBCore.Functions.GeneratePlate()
        local garage    = Config.DefaultGarage

        -- Insert directly into player_vehicles (same pattern as qb-garage)
        MySQL.insert(
            [[INSERT INTO player_vehicles
                (citizenid, vehicle, hash, mods, plate, garage, fuel, engine, body, in_garage, garage_id)
              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)]],
            {
                citizenid,
                model,
                GetHashKey(model),
                '{}',       -- empty mods, stock vehicle
                plate,
                garage,
                100,        -- fuel
                1000,       -- engine health
                1000,       -- body health
                1,          -- in_garage = true
                garage,     -- garage_id for jg-advancedgarages
            }
        )

        -- Hand keys to winner so they can see it in qb-vehiclekeys
        TriggerClientEvent('qb-vehiclekeys:client:AddKeys', winnerSrc, plate)

        local veh   = QBCore.Shared.Vehicles[model]
        local brand = (veh and veh.brand and veh.brand ~= '') and (veh.brand .. ' ') or ''
        local name  = (veh and veh.name) or model

        NotifyPlayer(winnerSrc,
            string.format(
                '🚗 Your prize vehicle %s%s has been added to %s garage!\n🔑 Plate: %s',
                brand, name, garage, plate
            ),
            'success'
        )

        print(string.format('[dynamic-raffle] Delivered vehicle %s (plate: %s, garage: %s) to %s', model, plate, garage, GetPlayerName(winnerSrc)))

    -- ── Item ────────────────────────────────────────────────────────────────
    elseif prizeType == 'item' then
        local itemName = prizeData.name
        local count    = math.floor(tonumber(prizeData.count) or 1)

        local added = exports.ox_inventory:AddItem(winnerSrc, itemName, count)

        if added then
            NotifyPlayer(winnerSrc,
                string.format('📦 %dx %s has been added to your inventory!', count, itemName),
                'success'
            )
            print(string.format('[dynamic-raffle] Delivered %dx %s to %s', count, itemName, GetPlayerName(winnerSrc)))
        else
            NotifyPlayer(winnerSrc,
                '⚠️ Could not add your prize item — your inventory may be full. Please contact staff.',
                'error'
            )
            print(string.format('[dynamic-raffle] WARN: Failed to add %dx %s to %s (inventory full?)', count, itemName, GetPlayerName(winnerSrc)))
        end

    -- ── Custom (no auto-delivery) ────────────────────────────────────────────
    else
        NotifyPlayer(winnerSrc,
            '🎁 Your prize is ready — a staff member will deliver it to you shortly!',
            'inform'
        )
    end
end

-- ─────────────────────────────────────────────────────────────────────────────
--  Build manage data payload (sent to client for /rafflemanage)
-- ─────────────────────────────────────────────────────────────────────────────

local function BuildManageData()
    local entries = {}
    for _, name in pairs(enteredPlayers) do
        table.insert(entries, name)
    end
    table.sort(entries)

    -- Build a human-readable cooldown list for the manage menu
    local cooldownList = {}
    for cid, remaining in pairs(winnerCooldowns) do
        -- Try to find the player's name from the online player list
        local displayName = cid
        for _, playerSrc in ipairs(GetPlayers()) do
            local P = QBCore.Functions.GetPlayer(tonumber(playerSrc))
            if P and P.PlayerData.citizenid == cid then
                displayName = GetPlayerName(tonumber(playerSrc))
                break
            end
        end
        table.insert(cooldownList, { name = displayName, remaining = remaining })
    end
    table.sort(cooldownList, function(a, b) return a.name < b.name end)

    return {
        active        = activeRaffle ~= nil,
        raffle        = activeRaffle,
        entries       = entries,
        history       = raffleHistory,
        presets       = GetPresets(),
        cooldowns     = cooldownList,
        cooldownLimit = Config.WinnerCooldownRaffles or 0,
        -- vehicle + item lists are NOT included here (too large).
        -- They are sent separately via requestStartDialog.
    }
end

-- ─────────────────────────────────────────────────────────────────────────────
--  Reminder broadcast
-- ─────────────────────────────────────────────────────────────────────────────

local function BroadcastReminder()
    if not activeRaffle then return end

    local count = 0
    for _ in pairs(enteredPlayers) do count = count + 1 end

    NotifyAll(
        '🎰 RAFFLE REMINDER — ' .. activeRaffle.name ..
        '\n🏆 Prize: ' .. activeRaffle.prize ..
        '\n👥 Entries: ' .. count ..
        '\nType /joinraffle in chat to enter!',
        'inform'
    )
end

local function ScheduleReminder(sessionName)
    SetTimeout(Config.ReminderInterval, function()
        if activeRaffle and activeRaffle.name == sessionName then
            BroadcastReminder()
            ScheduleReminder(sessionName)
        end
    end)
end

-- ─────────────────────────────────────────────────────────────────────────────
--  NET EVENTS
-- ─────────────────────────────────────────────────────────────────────────────

-- ── Start Raffle ─────────────────────────────────────────────────────────────
-- prizeType: 'custom' | 'vehicle' | 'cash' | 'item'
-- prizeData: type-specific table (see client.lua startRaffleFlow)

RegisterNetEvent('dynamic-raffle:server:startRaffle', function(raffleName, prizeType, prizeData)
    local src = source

    if not HasAdminPermission(src) then
        NotifyPlayer(src, '🚫 You do not have permission to start a raffle.', 'error')
        return
    end

    if activeRaffle then
        NotifyPlayer(src, '⚠️ A raffle is already active: ' .. activeRaffle.name .. '. Use /endraffle first.', 'error')
        return
    end

    if #GetOnlinePlayers() < Config.MinPlayers then
        NotifyPlayer(src, '⚠️ Not enough players online (minimum: ' .. Config.MinPlayers .. ').', 'error')
        return
    end

    prizeType  = prizeType  or 'custom'
    prizeData  = prizeData  or { description = '??? Mystery Prize' }
    raffleName = (raffleName and raffleName ~= '') and raffleName or 'Mystery Raffle'

    enteredPlayers = {}  -- clear any stale state

    activeRaffle = {
        name      = raffleName,
        prizeType = prizeType,
        prizeData = prizeData,
        prize     = BuildPrizeLabel(prizeType, prizeData),
        startedBy = GetPlayerName(src),
        startTime = os.time(),
    }

    NotifyAll(
        '🎉 RAFFLE STARTED — ' .. raffleName ..
        '\n🏆 Prize: ' .. activeRaffle.prize ..
        '\nType /joinraffle to enter! Good luck!',
        'success'
    )

    ScheduleReminder(raffleName)

    print(string.format('[dynamic-raffle] Started: "%s" | Type: %s | Prize: %s | By: %s',
        raffleName, prizeType, activeRaffle.prize, GetPlayerName(src)))
end)

-- ── Join Raffle ───────────────────────────────────────────────────────────────

RegisterNetEvent('dynamic-raffle:server:joinRaffle', function()
    local src = source

    if not activeRaffle then
        NotifyPlayer(src, '❌ No active raffle right now.', 'error')
        return
    end

    if enteredPlayers[src] then
        NotifyPlayer(src, '⚠️ You are already entered in this raffle!', 'error')
        return
    end

    enteredPlayers[src] = GetPlayerName(src)

    local count = 0
    for _ in pairs(enteredPlayers) do count = count + 1 end

    NotifyPlayer(src, '✅ You have entered the raffle! (' .. count .. ' total entries)', 'success')
    print('[dynamic-raffle] ' .. GetPlayerName(src) .. ' (src:' .. src .. ') joined.')
end)

-- ── End Raffle ────────────────────────────────────────────────────────────────

RegisterNetEvent('dynamic-raffle:server:endRaffle', function()
    local src = source

    if not HasAdminPermission(src) then
        NotifyPlayer(src, '🚫 You do not have permission to end a raffle.', 'error')
        return
    end

    if not activeRaffle then
        NotifyPlayer(src, '❌ No active raffle to end.', 'error')
        return
    end

    -- Build online lookup
    local onlineNow = {}
    for _, id in ipairs(GetPlayers()) do
        onlineNow[tonumber(id)] = true
    end

    -- Filter entries to players still in city
    local eligiblePool = {}
    for playerSrc in pairs(enteredPlayers) do
        if onlineNow[playerSrc] then
            table.insert(eligiblePool, playerSrc)
        end
    end

    if #eligiblePool == 0 then
        NotifyPlayer(src, '⚠️ No eligible players in city. Raffle cancelled.', 'error')
        activeRaffle   = nil
        enteredPlayers = {}
        return
    end

    -- ── Step 1: Session cooldown filter ─────────────────────────────────────────
    -- Decrement all existing cooldowns once per draw, then exclude active ones.
    for cid in pairs(winnerCooldowns) do
        winnerCooldowns[cid] = winnerCooldowns[cid] - 1
        if winnerCooldowns[cid] <= 0 then winnerCooldowns[cid] = nil end
    end

    local afterCooldownPool = {}
    if Config.WinnerCooldownRaffles and Config.WinnerCooldownRaffles > 0 then
        for _, playerSrc in ipairs(eligiblePool) do
            local P   = QBCore.Functions.GetPlayer(playerSrc)
            local cid = P and P.PlayerData.citizenid
            if not cid or not winnerCooldowns[cid] then
                table.insert(afterCooldownPool, playerSrc)
            end
        end
        if #afterCooldownPool == 0 then
            afterCooldownPool = eligiblePool   -- bypass: everyone is on session cooldown
            print('[dynamic-raffle] Cooldown bypass: all entries on session cooldown, using full pool.')
        end
    else
        afterCooldownPool = eligiblePool
    end

    -- ── Step 2: Persistent 7-day win limit (DB) ───────────────────────────────
    -- Single query fetches all citizenids that have hit the cap this period.
    local drawPool = afterCooldownPool

    if Config.MaxWinsPerPeriod and Config.MaxWinsPerPeriod > 0 then
        local overLimitRows = MySQL.query.await(
            'SELECT citizenid FROM raffle_wins WHERE won_at > DATE_SUB(NOW(), INTERVAL ? DAY) GROUP BY citizenid HAVING COUNT(*) >= ?',
            { Config.WinPeriodDays, Config.MaxWinsPerPeriod }
        )

        local overLimit = {}
        for _, row in ipairs(overLimitRows or {}) do
            overLimit[row.citizenid] = true
        end

        if next(overLimit) then   -- only filter if at least one player is over limit
            local dbFiltered = {}
            for _, playerSrc in ipairs(afterCooldownPool) do
                local P   = QBCore.Functions.GetPlayer(playerSrc)
                local cid = P and P.PlayerData.citizenid
                if not cid or not overLimit[cid] then
                    table.insert(dbFiltered, playerSrc)
                end
            end

            if #dbFiltered > 0 then
                drawPool = dbFiltered
            else
                -- Everyone in the pool has hit the 7-day cap — fall back gracefully
                drawPool = afterCooldownPool
                print('[dynamic-raffle] Win-limit bypass: all entries have hit the ' .. Config.WinPeriodDays .. '-day cap, using cooldown-filtered pool.')
            end
        end
    end

    -- ── Step 3: Fisher-Yates shuffle → pick first element ────────────────────
    -- Shuffling first eliminates table-ordering bias that can come from
    -- pairs() iteration order combined with a PRNG. Much more robust than
    -- a direct random index into an unshuffled array.
    math.randomseed(os.time() + math.floor(os.clock() * 1e6) + #drawPool)
    math.random(); math.random()

    local pool = {}   -- shallow copy so we don't mutate the original
    for i, v in ipairs(drawPool) do pool[i] = v end

    for i = #pool, 2, -1 do
        local j   = math.random(1, i)
        pool[i], pool[j] = pool[j], pool[i]
    end

    local winnerSrc  = pool[1]
    local winnerName = GetPlayerName(winnerSrc)
    local raffleName = activeRaffle.name
    local prizeLabel = activeRaffle.prize
    local prizeType  = activeRaffle.prizeType
    local prizeData  = activeRaffle.prizeData

    -- Collect all entry names (sorted) for history
    local allEntries = {}
    for _, name in pairs(enteredPlayers) do table.insert(allEntries, name) end
    table.sort(allEntries)

    -- Push to session history
    if #raffleHistory >= Config.MaxHistory then table.remove(raffleHistory, 1) end
    table.insert(raffleHistory, {
        name      = raffleName,
        prize     = prizeLabel,
        prizeType = prizeType,
        winner    = winnerName,
        entries   = allEntries,
        date      = SafeDate(),
    })

    -- Broadcast winner to everyone
    TriggerClientEvent('dynamic-raffle:announce', -1, winnerName, prizeLabel, raffleName)

    -- Special NUI screen for winner only
    TriggerClientEvent('dynamic-raffle:youWon', winnerSrc, prizeLabel, raffleName)

    -- Deliver the prize
    DeliverPrize(winnerSrc, prizeType, prizeData)

    -- Apply session cooldown to winner
    if Config.WinnerCooldownRaffles and Config.WinnerCooldownRaffles > 0 then
        local WP = QBCore.Functions.GetPlayer(winnerSrc)
        if WP then winnerCooldowns[WP.PlayerData.citizenid] = Config.WinnerCooldownRaffles end
    end

    -- Record win in DB for the persistent 7-day limit
    if Config.MaxWinsPerPeriod and Config.MaxWinsPerPeriod > 0 then
        local WP = QBCore.Functions.GetPlayer(winnerSrc)
        if WP then
            MySQL.insert(
                'INSERT INTO raffle_wins (citizenid, player_name, raffle_name, prize) VALUES (?, ?, ?, ?)',
                { WP.PlayerData.citizenid, winnerName, raffleName, prizeLabel }
            )
        end
    end

    print(string.format('[dynamic-raffle] "%s" ended. Winner: %s | Prize: %s | Pool size: %d/%d',
        raffleName, winnerName, prizeLabel, #drawPool, #eligiblePool))

    activeRaffle   = nil
    enteredPlayers = {}
end)

-- ── Status (admin quick-check) ───────────────────────────────────────────────

RegisterNetEvent('dynamic-raffle:server:status', function()
    local src = source
    if not HasAdminPermission(src) then return end

    if not activeRaffle then
        NotifyPlayer(src, 'ℹ️ No active raffle.', 'inform')
        return
    end

    local count = 0
    for _ in pairs(enteredPlayers) do count = count + 1 end

    NotifyPlayer(src,
        '📋 ' .. activeRaffle.name ..
        '\n🏆 ' .. activeRaffle.prize ..
        '\n👥 Entries: ' .. count ..
        '\n🕐 By: ' .. activeRaffle.startedBy,
        'inform'
    )
end)

-- ── Manual reminder ping ─────────────────────────────────────────────────────

RegisterNetEvent('dynamic-raffle:server:ping', function()
    local src = source
    if not HasAdminPermission(src) then return end

    if not activeRaffle then
        NotifyPlayer(src, '❌ No active raffle to ping.', 'error')
        return
    end

    BroadcastReminder()
    NotifyPlayer(src, '📣 Reminder sent to all players.', 'success')
end)

-- ── Manage Menu — fetch data ─────────────────────────────────────────────────

RegisterNetEvent('dynamic-raffle:server:getManageData', function()
    local src = source
    if not HasAdminPermission(src) then return end
    TriggerClientEvent('dynamic-raffle:client:openManage', src, BuildManageData())
end)

-- ── Start Dialog — fetch vehicle + item lists ─────────────────────────────────
-- Called before opening the start raffle flow so lists are always fresh

RegisterNetEvent('dynamic-raffle:server:requestStartDialog', function(raffleName)
    local src = source
    if not HasAdminPermission(src) then return end

    TriggerClientEvent('dynamic-raffle:client:openStartDialog', src, {
        raffleName   = raffleName or 'Mystery Raffle',
        vehicleList  = GetVehicleList(),
        itemList     = GetItemList(),
        presets      = GetPresets(),
    })
end)

-- ── Preset CRUD ───────────────────────────────────────────────────────────────

RegisterNetEvent('dynamic-raffle:server:editPreset', function(index, newValue)
    local src = source
    if not HasAdminPermission(src) then return end

    local presets = GetPresets()
    if not presets[index] then
        NotifyPlayer(src, '❌ Invalid preset index.', 'error')
        return
    end

    presets[index] = newValue
    TriggerClientEvent('dynamic-raffle:client:openManage', src, BuildManageData())
end)

RegisterNetEvent('dynamic-raffle:server:addPreset', function(value)
    local src = source
    if not HasAdminPermission(src) then return end

    local presets = GetPresets()
    if #presets >= 10 then
        NotifyPlayer(src, '⚠️ Maximum of 10 presets allowed.', 'error')
        return
    end

    table.insert(presets, value)
    TriggerClientEvent('dynamic-raffle:client:openManage', src, BuildManageData())
end)

RegisterNetEvent('dynamic-raffle:server:removePreset', function(index)
    local src = source
    if not HasAdminPermission(src) then return end

    local presets = GetPresets()
    if not presets[index] then
        NotifyPlayer(src, '❌ Invalid preset index.', 'error')
        return
    end

    table.remove(presets, index)
    TriggerClientEvent('dynamic-raffle:client:openManage', src, BuildManageData())
end)