apply_over is never posted by this form; store() hardcodes 'ggr'.
The schema's other value, turnover, reaches an unimplemented branch in CommissionCashback::pay(), so it is deliberately not offered.
{start ? hccbDmyIso(start) : "dd/mm/yyyy"}{end ? hccbDmyIso(end) : "dd/mm/yyyy"}day values (backend.day_1…day_7). Which weekday day_1 maps to is not documented — Monday is assumed here.Delete {row.name} (ID {row.id})? The rule stops generating payments from the next cron run.
Payments already written to commission_cashback_payment for this rule are a separate table and are not
described as cascading — the reference documents no cascade either way, so what happens to historic payment rows here is UNCLEAR.
commission_cashbacks.id — not a contains search. },
{ key: "skins", label: "Skins", type: "multi", icon: "flag", placeholder: "- All -", grow: true,
options: HCCB_SKINS.map(s => ({ value: s.id, label: s.name })),
tip: <>Server-side this is a whereHas('skins', …) over the commission_cashback_skins pivot, matching any of the chosen ids. },
];
/* Faithful absence: the rows() scaffolding for date / active / auto_pay
filters is commented out (L73-96), so those are NOT offered here. */
const filtered = hccbUseMemo(() => {
const idq = String(applied.id || "").trim();
const sk = (applied.skins || []).map(Number);
return rows.filter(r => {
if (idq && String(r.id) !== idq) return false;
if (sk.length && !r.skins.some(s => sk.indexOf(Number(s)) !== -1)) return false;
return true;
});
}, [rows, applied]);
const sorted = hccbUseMemo(() => {
const dir = sort.dir === "asc" ? 1 : -1;
const val = (r) => {
switch (sort.key) {
case "name": return r.name.toLowerCase();
case "skins": return r.skins.map(hccbSkinName).join(", ").toLowerCase();
case "cats": return r.gameCats.map(hccbCatName).join(", ").toLowerCase();
case "start": return r.start;
case "end": return r.end;
case "periodicity": return hccbPeriodicityLabel(r.periodicity).toLowerCase();
case "days": return hccbDaysLabel(r).toLowerCase();
case "every": return r.every;
case "balanceType": return hccbBalanceLabel(r.balanceType).toLowerCase();
case "active": return r.active ? 1 : 0;
case "autoPay": return r.autoPay ? 1 : 0;
default: return r.id;
}
};
return filtered.slice().sort((a, b) => {
const va = val(a), vb = val(b);
if (va === vb) return (a.id - b.id) * dir;
return (va > vb ? 1 : -1) * dir;
});
}, [filtered, sort]);
const pageCount = Math.max(1, Math.ceil(sorted.length / pageSize));
const safePage = Math.min(page, pageCount - 1);
const paged = sorted.slice(safePage * pageSize, safePage * pageSize + pageSize);
const onSearch = (v) => { setApplied({ id: v.id || "", skins: v.skins || [] }); setPage(0); };
const onReset = () => { setDraft({ id: "", skins: [] }); setApplied({ id: "", skins: [] }); setPage(0); };
const onSave = (r) => {
if (r.id == null) {
const id = rows.reduce((m, x) => Math.max(m, x.id), 0) + 1;
setRows(rs => [{ ...r, id }, ...rs]);
hccbToast(`Commission cashback "${r.name}" created`, `${r.skins.length} skin(s) · ${r.gameCats.length} game category(ies) · ${hccbPeriodicityLabel(r.periodicity)} every ${r.every} · ${r.cashbackPercentage}% of GGR.`);
} else {
setRows(rs => rs.map(x => x.id === r.id ? { ...x, ...r } : x));
hccbToast(`Commission cashback "${r.name}" saved`, `Pivots synced: skins, game categories and ${r.days.length} period day(s).`);
}
};
const onDelete = (r) => {
setRows(rs => rs.filter(x => x.id !== r.id));
hccbToast(`Commission cashback "${r.name}" deleted`, "The rule will not be picked up by the next payCommissionCashbacks run.");
};
const acts = (r) => (
CommissionCashbackPolicy gates viewAny, view, create, update and delete on isadmin() alone — there is no Customer-Care permission, no skin scoping and no per-row condition anywhere on this screen. }
gateNote={<>Two honest caveats: store() authorizes the create ability even when it is updating an existing row, so an admin variant that could create but not edit would not exist today; and the preview endpoint the form calls, GET /commission_cashback/payment/info, has no authorize call at all. A dead non-admin branch in rows() filters the skins pivot without joining it and would raise a SQL error — unreachable, because the policy blocks non-admins first.}
explainer={
<>
SUM(players_report.profit) for that player over the period, floored by min base amount and capped by max base amount.,
<>This screen only defines the rules. Nothing is paid from here: the cron GET /cronjobs/payCommissionCashbacks queues PayCommissionCashbacks, which calls CommissionCashback::pay($date) and writes rows into commission_cashback_payment — the Payments tab above.,
<>The cron skips any period that already carries an admin-edited payment, and nets off amounts already paid, so re-running it does not double-pay. With Auto Pay on, generated payments are settled immediately instead of waiting for an operator.,
<>Payment credits land in the wallet named by Balance type — balance_withdrawable or balance — and are recorded in transaction history as type 121 (Commission Cashback).,
<>Scope is set by two pivots: Skins and Game categories (only Casino, Casino Live and Virtual are selectable). The schedule is Periodicity + Repeat it every + the selected Days.,
]} />
sidebar.blade.php L905-912, guarded @if( isadmin() )) sits inside a commented-out <?/* … */?> block spanning L890-913, so it renders for nobody — not even a super admin.,
<>The only way to reach the real screen is to type /commission_cashback. Its sibling screens in that same block (Lobbies, Acca bonus, Acca bonus payments) are orphaned the same way.,
<>The feature is otherwise fully live: the routes are registered, the policy passes for admins, and the payCommissionCashbacks cron keeps generating payments for whatever rules already exist — so a rule left behind here goes on paying out with no navigable place to review it.,
]} />
}
actions={
}>
sidebar.blade.php L890-913), so no role ever
sees the link. Only a typed /commission_cashback URL reaches it, while the cron keeps paying out
whatever rules exist.
{/* */}
rows() has its whole order-by mapping
commented out and always answers id DESC. This rebuild sorts for real (default id DESC)
rather than shipping headers that lie.
{/* */}
store() sets $rules['id'] = 'exists:mobile_validators' — a
copy-paste from another generic screen. Whether an edit saves depends on an unrelated table's ids. The
evident intent (the id must be an existing commission cashback) is what this rebuild enforces.
{/* */}
authorize('create', …), not update. Both resolve to
isadmin() today, so nothing breaks — but the two abilities can never diverge.
{/* */}
GET /commission_cashback/{"{id}"} is registered but CommissionCashbackController has
no show(); hitting it errors. The non-admin branch of the row JS links names straight there — dead
code, since viewAny already blocks non-admins.
{/* */}
days[] carries no rules at all: whatever the client posts is written to
commission_cashback_period_days. Weekday values outside 1-7 and month days outside 1-31 are
accepted and would silently never fire.
{/* */}
GET /commission_cashback/payment/info, the one route in
this group with no authorize() call — readable by any authenticated, 2FA'd back-office user.
{/* */}
store() hardcodes 'ggr' and never reads a posted value. The schema's
turnover alternative reaches an unimplemented TODO branch in CommissionCashback::pay(),
so it is correctly not offered in the form.
{/* */}
rows() filters commission_cashback_skins.skin_id for non-admins without joining that
pivot. The policy blocks every non-admin before that branch runs, so it never executes — but it is a trap for
anyone who later loosens the policy.
{/* */}