Staging -> Main - #514
Merged
Merged
Conversation
GET legacy-auth/logout proxies gama-api's own GET /users/logout, relaying the caller's raw legacy JWT from the Authorization header. Pure passthrough like register/recovery - this backend never stored the token, so gama-api is the one actually invalidating the session, closing the gap where tokens/revoke couldn't touch a legacy-bridge session. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New POST downloads/tests resolves a gama-api legacy test-file download URL through a new IContentDeliveryProvider (ContentSource-keyed, mirroring the payment-gateway provider pattern), charges the downloader via the existing quota-then-points path only when gama-api hasn't already marked the download paid, and accrues a commission to the content's owner (resolved from gama-api's CoreId) only if that charge succeeds - a new ContentOwnerCommission ledger, deliberately kept separate from the points wallet and subscription quota. Commission percent and payout threshold are admin-configurable via ApplicationSettings; the points-to-USD rate is a fixed first-phase constant. Payout itself is out of scope for this phase. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…tPaper POST downloads (renamed from downloads/tests) now dispatches on ContentType to one of gama-api's three download endpoints: PastPaper/Test -> tests/download (unchanged), Multimedia -> files/download, Exam -> exams/download. Confirmed live that the latter two report neither a price nor an owner, so charging and commission accrual are skipped entirely for those two types - only PastPaper/Test involve SpendPointsAsync/ContentOwnerCommission. Also collapses GameService.SpendPointsAsync's PastPaper/Test branch: both are the same gama-api content (/tests/download), so both now charge FeatureCodes.PastpaperDownload/TransactionType.DownloadPastPaper. The old TestDownload/DownloadTest members stay defined for historical data but are no longer written by any code path. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…feature Reverts the earlier collapse of GameService.SpendPointsAsync's PastPaper/Test branch - that endpoint is unrelated to this feature and its separate FeatureCodes.TestDownload/TransactionType.DownloadTest entitlement (already live on a subscription plan) stays untouched. GamaApiContentDeliveryProvider now explicitly rejects any ContentType other than PastPaper/Multimedia/Exam (notably ContentType.Test) with a clear validation error before attempting a gama-api call. ContentType.Test and TransactionType.DownloadTest remain defined in their enums only because migration 20260621193350_TransactionType.cs compiles a reference to both in a historical data-backfill statement - migrations are immutable, so neither member can be removed even though this feature no longer accepts Test. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…reality The broader ContentType enum (shared with the unrelated games/spends endpoint) still has a Test member, so reusing it here meant Swagger kept advertising Test as a valid value for POST downloads even after runtime rejection was added - a client reading the schema had no way to know it would always fail. DownloadContentType is a new 3-member enum (PastPaper/Multimedia/Exam) used only by this feature's request/provider DTOs and ViewModel. A request naming Test now fails cleanly at model binding (Required on an unparseable enum) instead of via a bespoke validation message. ContentOwnerCommission and GameService.SpendPointsAsync are untouched - ContentDeliveryService maps the one case that ever reaches them (DownloadContentType.PastPaper, the only type gama-api reports a price for) to ContentType.PastPaper directly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A real gama-api download can report price.price: 0 with paid: false (e.g. some extra-file downloads) - the previous logic only skipped the charge for Paid == true or a missing Points field, so a zero-price item still went through SpendPointsAsync and wrote a pointless zero-amount Transaction row. Confirmed live (id 39204/extra/5222): before the fix a Transaction row with Points: 0 was written on every call; after, none is. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Add legacy-auth-bridge logout endpoint
…sions Add content delivery + owner commission accounting
…auth login/google/register/recovery The legacy-auth bridge proxies these calls straight through to gama-api, so gama-api's own rate-limiting/fraud checks only ever saw this server's IP, never the actual end user's. IdentityService now reads the caller's IP off the inbound request (X-Forwarded-For if present, else the raw connection IP) and CoreProvider sends it as a TRUSTED_FORWARDED_IP header on those four outgoing calls. logout is unaffected -- gama-api didn't ask for it there. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Forward real client IP to gama-api on legacy-auth login/google/register/recovery
gamatraindev
approved these changes
Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.