// NO PROD JSON API (bucket C) — mock until backend (see PROD_API_INVENTORY.md)
// Represents: GET /transfer/ · TransferController::index + dotransfer/processTransfer — see docs/ISYSTEM_REFERENCE.md §Batch 5 "Deposit"
/* Sidebar entry says "Deposit" (backend.deposit) but the page heading is "Transfer" (backend.transfer) —
the two labels genuinely differ in the real admin. Sibling routes simulated here: GET /searchusertransfer
(target select2 source, min 3 chars, username prefix match, user_path-subtree scope, 10/page username ASC,
READ UNCOMMITTED on UserReadonly), GET /searchskinaccess/{user_id} (CC-only payer load), POST /dotransfer,
POST /getBalance (the refresh icons). Wrapper pages /players/{id}/deposit and /users/{id}/deposit re-include
this exact panel with the payer side hidden (player_fields=true) — they are not separate screens.
processTransfer (TransferController.php L516-1062) is the platform-wide money-mutation engine: every
approve flow funnels through it — withdraw requests, deposits queue, commissions, vouchers, crypto/StarsPay
callbacks, cashback, promo triggers, legacy fapi, external API, and the cronjob GET /endpoint/payment/.
Backend-only known bugs — real and documented in-repo, NOT reproduced here because they live inside the
engine and are invisible to this screen's markup:
- the engine's catch block rolls back, swallows the exception, then still writes the transactions +
history rows and returns success (docs/api-authorization-audit-2026-07-14.md item 10);
- no idempotency key on the engine (docs/queue-redis-migration-audit.md:41);
- api_key is only checked to match *some* users row, not the payer/actor (L523-531);
- LogsController::saveLog after every operation is a no-op (its body is commented out).
Real-platform quirks intentionally not rebuilt (dead/debug-grade behavior, "no invented actions" both ways):
cash_block → raw die("cash block da fare"); the inversion die("gestire pagina permessi, errore") for
AFFILIATE/CC/ADMINISTRATION users holding support_transfer; hardcoded skin_codes casino24hs|playspin|
apuestavip|argenslots integer-only comma-formatted amount inputs; the empty #giro_transazioni container
(never populated — no transfer-history table exists on this screen); the stray ')' emitted by the
unbalanced Blade @if (panel.blade.php:183); typo "Operation not allaaowed" (TransferController.php:95);
third-party player deposits outside the actor's subtree (skin/user-keyed, labels resolve nowhere). */
const { useState: useStateHtf, useMemo: useMemoHtf, useEffect: useEffectHtf, useRef: useRefHtf } = React;
/* Deterministic PRNG (mulberry-style, same shape as the other Host pages) so the
directory + balances render identically on every load. */
const HTF_LEVEL_LABEL = { 0: "Super admin", 8: "Master", 10: "Agent", 15: "Promoter", 20: "Shop", 30: "Player" };
/* Payer persona: super admin — so the admin-only pieces (payer picker, Apply deposit
bonus, test-user targets) legitimately render. Non-admin gates are noted inline. */
/* ------------------------------------------------------------------ *
* Live accounts. What used to be here: a hardcoded super-admin payer holding
* 894,778,091,858.36, and a directory of eighteen invented agents, promoters,
* shops and players with invented balances. Every balance box on this screen
* read from that object, so the availability checks below were validating a
* transfer against numbers nobody owned.
*
* The payer is now sb.me(); the directory is `networkUsers` and `players`,
* both already scoped by row-level security to the caller's own subtree —
* which is the same scoping isystem does with `user_path LIKE`, done by the
* database rather than by this file.
* ------------------------------------------------------------------ */
const htfUserRow = (r) => {
const w = Array.isArray(r.wallet) ? (r.wallet[0] || {}) : (r.wallet || {});
return {
id: Number(r.id),
username: String(r.username || ""),
level: Number(r.user_level),
skin: r.skin ? r.skin.name : "",
currency: r.currency || (r.skin ? r.skin.currency : "") || "",
/* `bal` is the non-withdrawable half and `wd` the withdrawable one — the
two columns isystem's own export mixes up. The transfer engine moves the
withdrawable side, so keeping them apart here is not cosmetic. */
bal: Number(w.balance) || 0,
wd: Number(w.balance_withdrawable) || 0,
cr: Number(w.credits) || 0,
bonus: Number(w.bonus) || 0,
};
};
/* Operation matrix, exactly per dotransfer L411-413: agent → add|out|add_credits|out_credits;
player → add|out (the validator also lists add_bonus for players, but the panel never renders it
and the engine immediately returns "method not available" — bonus deposits from this screen are
impossible in the real platform, so it is honestly absent here too).
`mirror` = the counterpart row type written to `transactions` (each operation writes two mirrored rows). */
const HTF_OPS = [
{ id: "add", label: "Deposit", targets: ["agent", "player"], credit: false, mirror: "out", flow: "p2t", hist: { t: 1, name: "DEPOSIT" } },
{ id: "out", label: "Withdraw", targets: ["agent", "player"], credit: false, mirror: "add", flow: "t2p", hist: { t: 2, name: "WITHDRAW", neg: true } },
{ id: "add_credits", label: "Credit Deposit", targets: ["agent"], credit: true, mirror: "out_credits", flow: "p2t", hist: null },
{ id: "out_credits", label: "Credit Withdraw", targets: ["agent"], credit: true, mirror: "add_credits", flow: "t2p", hist: null },
];
/* Mirrors TransferController::isValidTransferAmountFormat + the client regex in
scripts.blade.php:232-243 — commas stripped, no whitespace, ^-?\d+(\.\d+)?$. */
const htfValidAmountFormat = (raw) => {
if (raw === null || raw === undefined) return false;
const s = String(raw).replace(/,/g, "");
if (s === "" || /\s/.test(s)) return false;
return /^-?\d+(\.\d+)?$/.test(s);
};
/* select2-equivalent: min 3 chars → username prefix match → 10 rows, username ASC. */
const HtfSearchSelect = ({ placeholder, pool, picked, onPick, note }) => {
const [q, setQ] = useStateHtf(picked ? picked.username : "");
const [open, setOpen] = useStateHtf(false);
const wrapRef = useRefHtf(null);
useEffectHtf(() => {
const onDoc = (e) => { if (wrapRef.current && !wrapRef.current.contains(e.target)) setOpen(false); };
document.addEventListener("mousedown", onDoc);
return () => document.removeEventListener("mousedown", onDoc);
}, []);
useEffectHtf(() => { setQ(picked ? picked.username : ""); }, [picked ? picked.id : -1]);
const term = q.trim().toLowerCase();
const results = term.length >= 3
? pool.filter(u => u.username.toLowerCase().startsWith(term)).sort((a, b) => a.username.localeCompare(b.username)).slice(0, 10)
: [];
return (
);
};
/* Confirm + receipt modal. `review` = pre-flight summary with the two mirrored rows that WILL be
written; `receipt` = the rows as written, with new balances. Full-screen on mobile (htf- CSS). */
const HtfConfirmModal = ({ review, receipt, onCancel, onConfirm, onClose }) => {
const done = !!receipt;
const data = receipt || review;
return (
e.stopPropagation()}>
{done
? <> Transfer applied
: <> Confirm transfer}
{done ? "Ledger rows written — two mirrored transactions rows per operation:" : "This will write two mirrored transactions rows:"}
Tx
Account
Side
transactions.type
Amount
{done ? "New value" : "Column"}
{data.rows.map((r, i) => (
{r.tx ? `#${r.tx}` : "—"}
{r.who}
{r.side}
{r.type}
{done ? <>{r.col} : {r.col}}
))}
{data.notes && data.notes.length > 0 && (
{data.notes.map((n, i) =>
{n}
)}
)}
{done ? (
) : (
)}
);
};
const HostDeposit = ({ brand }) => {
window.useLocale && window.useLocale();
/* Everyone this operator can pay or be paid by. Both reads are already
subtree-scoped by RLS, so the directory cannot offer an account the
transfer engine would then refuse. */
const opFeed = useHrsFetch(() => window.sb.list("networkUsers", { limit: 2000 }), []);
const plFeed = useHrsFetch(() => window.sb.list("players", { limit: 2000 }), []);
const save = useHrsSave([opFeed, plFeed]);
const [me, setMe] = useStateHtf(null);
useEffectHtf(() => {
let alive = true;
Promise.resolve(window.sb.me()).then(r => { if (alive && r && r.ok) setMe(r.data); });
return () => { alive = false; };
}, []);
const operators = useMemoHtf(() => (opFeed.data || []).map(htfUserRow), [opFeed.data]);
const playerRows = useMemoHtf(() => (plFeed.data || []).map(htfUserRow), [plFeed.data]);
/* The acting operator, from their own row in `users` — not a persona. */
const actor = useMemoHtf(() => {
if (!me) return null;
const hit = operators.find(u => u.id === Number(me.id));
return hit || { id: Number(me.id), username: me.username, level: Number(me.user_level),
skin: "", currency: me.currency || "", bal: 0, wd: 0, cr: 0, bonus: 0 };
}, [me, operators]);
/* Balances come from the rows, and the rows come from the server. There is
no local ledger to mutate: after a transfer the two feeds refetch and the
boxes show what the database committed. Simulating them here is how a
screen ends up showing a balance that moved when the money did not. */
const ledger = useMemoHtf(() => {
const m = {};
[...operators, ...playerRows].forEach(u => { m[u.id] = { bal: u.bal, wd: u.wd, cr: u.cr, bonus: u.bonus }; });
if (actor && !m[actor.id]) m[actor.id] = { bal: actor.bal, wd: actor.wd, cr: actor.cr, bonus: actor.bonus };
return m;
}, [operators, playerRows, actor]);
const [payer, setPayer] = useStateHtf(null); // from_user — defaults to the actor once it loads
useEffectHtf(() => { if (actor && !payer) setPayer(actor); }, [actor]);
const [usertype, setUsertype] = useStateHtf(""); // transfer_usertype — "Select" placeholder (as the placeholder-skins render); see bug note at validation
const [op, setOp] = useStateHtf("add"); // transfer_type — required, default `add` in the real panel
const [target, setTarget] = useStateHtf(null); // to_user
const [amount, setAmount] = useStateHtf("");
const [reason, setReason] = useStateHtf(""); // causale — optional
const [withdrawable, setWithdrawable] = useStateHtf(false);
const [applyBonus, setApplyBonus] = useStateHtf(false);
const [errors, setErrors] = useStateHtf([]);
const [modal, setModal] = useStateHtf(null); // { review } | { receipt }
const [balLoading, setBalLoading] = useStateHtf(false);
const [spin, setSpin] = useStateHtf(""); // "payer" | "target"
const EMPTY_LED = { bal: 0, wd: 0, cr: 0, bonus: 0 };
const payerLed = (payer && ledger[payer.id]) || EMPTY_LED;
const targetLed = target ? (ledger[target.id] || EMPTY_LED) : null;
// Payer pool (admin-only agent_suggest): self + every agent-side account.
const payerPool = useMemoHtf(
() => (actor ? [actor, ...operators.filter(u => u.id !== actor.id)] : operators),
[actor, operators]);
// Target pool per usertype: player → user_level 30; agent → below the actor.
const targetPool = useMemoHtf(() => {
if (usertype === "player") return playerRows;
if (usertype === "agent") return operators.filter(u => actor && u.level > actor.level);
return [];
}, [usertype, playerRows, operators, actor]);
// Ops filtered by the real matrix + "credit ops only when payer credits > 0" (panel.blade.php:149-155).
const visibleOps = HTF_OPS.filter(o => (!usertype || o.targets.includes(usertype)) && (!o.credit || payerLed.cr > 0));
const opDef = HTF_OPS.find(o => o.id === op);
// select2 "balance boxes load" moment: brief deterministic load flash on target pick.
useEffectHtf(() => {
if (!target) return;
setBalLoading(true);
const t = setTimeout(() => setBalLoading(false), 350);
return () => clearTimeout(t);
}, [target ? target.id : -1]);
const toast = (title, amt, who, body) => window.PAYBO?.emitToast && window.PAYBO.emitToast({
id: `htf-${Date.now()}`, tx_id: title, amount: amt || 0, currency: "EUR", player: who || "Transfer", reason: body,
});
const pickUsertype = (v) => {
setUsertype(v);
setTarget(null);
setWithdrawable(false); setApplyBonus(false);
const cur = HTF_OPS.find(o => o.id === op);
if (v && cur && !cur.targets.includes(v)) setOp("add");
};
const refresh = (side) => {
setSpin(side);
setTimeout(() => setSpin(""), 700);
toast("Balance refreshed", 0, side === "payer" ? (payer ? payer.username : "—") : (target ? target.username : "—"),
"POST /getBalance → UsersController@getBalance re-reads balance/credits and recomputes availability.");
};
const validate = () => {
const errs = [];
/* Until sb.me() resolves there is no paying account, so every check below
would be measuring against an empty one. */
if (!actor) return ["Still loading your account — try again in a moment."];
if (!payer) errs.push("Select the paying account"); // from_user required — always set (server-pinned), kept for parity
if (!op) errs.push("Select the operation"); // exact backend message
/* Real-platform bug (TransferController::dotransfer L225): the transfer_usertype required-check
re-tests $transfer_type, so an empty usertype slips through validation. Evident intent
implemented — User Type is genuinely required here. */
//
if (!usertype) errs.push("Select the user type"); // label inferred (the bugged branch never emits one)
if (!target) errs.push("Select the user"); // to_user required — label inferred
if (!htfValidAmountFormat(amount)) errs.push("Incorrect amount format"); // backend.incorrect_amount_format
else if (parseFloat(String(amount).replace(/,/g, "")) <= 0) errs.push("Amount must be greater than zero"); // (float) > 0 check — label inferred
// Matrix guard (dotransfer L411-413) — unreachable via this UI since options are filtered, kept honest:
if (usertype && opDef && !opDef.targets.includes(usertype)) {
errs.push(`Operation not allowed: "${op}" from "${HTF_LEVEL_LABEL[payer.level]}" to "${usertype}"`); // financial.op_not_allowed
}
// Availability checks (engine-side; failure labels inferred — the engine's own strings are generic):
if (errs.length === 0 && target) {
const amt = parseFloat(String(amount).replace(/,/g, ""));
const t = ledger[target.id] || EMPTY_LED, p = payerLed;
if (op === "add" && p.bal + p.cr < amt) errs.push("Insufficient availability on the paying account");
if (op === "out" && (target.level === 30 ? t.bal + t.wd : t.bal) < amt) errs.push("Insufficient availability on the selected user");
if (op === "add_credits" && p.cr + Math.min(0, p.bal) < amt) errs.push("Insufficient credits on the paying account"); // negative payer balance reduces spendable credits (L925-927)
if (op === "out_credits" && t.cr < amt) errs.push("Insufficient credits on the selected user");
}
return errs;
};
const submit = () => {
const errs = validate();
setErrors(errs);
if (errs.length) return;
const amt = parseFloat(String(amount).replace(/,/g, ""));
const col = opDef.credit ? "credits" : (withdrawable ? "balance_withdrawable" : "balance");
const rows = opDef.flow === "p2t"
? [
{ who: payer.username, side: "Payer", type: opDef.mirror, amt: -amt, col: opDef.credit ? "credits" : "balance" },
{ who: target.username, side: "Target", type: opDef.id, amt: amt, col },
]
: [
{ who: target.username, side: "Target", type: opDef.id, amt: -amt, col: opDef.credit ? "credits" : "balance" },
{ who: payer.username, side: "Payer", type: opDef.mirror, amt: amt, col: opDef.credit ? "credits" : "balance" },
];
setModal({
review: {
op: opDef.id, opLabel: opDef.label, amt, reason,
fromName: payer.username, fromLevel: HTF_LEVEL_LABEL[payer.level],
toName: target.username, toLevel: HTF_LEVEL_LABEL[target.level],
withdrawable: withdrawable && usertype === "player" && op === "add",
applyBonus: applyBonus && usertype === "player" && op === "add",
rows,
notes: target.level === 30 && opDef.hist
? [A player-side transactions_history row is also written: type {opDef.hist.t} · {opDef.hist.name} (res_type 1 TRANSACTION{opDef.hist.neg ? ", amount stored negative" : ""}).]
: [],
},
});
};
/* Simulated processTransfer: both parties mutated inside one "transaction"
(User::lockForUpdate + DB::beginTransaction in the real engine), availability
recomputed as credits+balance afterwards. */
const confirm = async () => {
const r = modal.review;
/* ONE RPC. post_transfer() does both balance updates and both mirrored
ledger rows inside a single transaction, locking the two rows in
ascending user id so opposing transfers queue rather than deadlock. Two
post_transaction() calls would be two transactions with a window between
them — an interruption there debits one account and credits none, which
is the flaw in isystem's processTransfer this schema exists to remove.
THE IDEMPOTENCY KEY describes WHAT is being transferred, never when. A
key with a timestamp in it makes a double-click indistinguishable from
two genuine transfers, which on this screen means paying an agent twice.
Amount is included because two identical transfers to the same account
are a real thing an operator may want — but only after the first has
landed and the form has been cleared, at which point the operator is
making a new decision rather than repeating a click. */
const key = `transfer:${payer.id}:${target.id}:${opDef.id}:${r.amt}`
+ (reason ? `:${reason.trim().slice(0, 40)}` : "");
/* Direction and wallets come from the operation, not from a sign. `add`
pays the target; `out` pulls back from them. Credit operations move the
credits wallet on both sides. */
const credits = opDef.credit;
const outbound = opDef.flow === "p2t";
const from = outbound ? payer : target;
const to = outbound ? target : payer;
const res = await save.run(() => window.sb.transfer({
fromUserId: from.id,
toUserId: to.id,
amount: r.amt,
key,
fromWallet: credits ? "credits" : "real",
toWallet: credits ? "credits" : "real",
/* ALWAYS 1, AND THE CONDITIONAL THIS REPLACES INVERTED EVERY WITHDRAW.
`p_type_id` types the RECEIVING row. post_transfer applies it to
p_to_user_id with +amount and writes the mirror — 1<->2 — on the
paying side with -amount (015:368). So the parameter answers "what is
this, for whoever the money arrives at", and in all four operations
here the receiver is being credited. Money arriving is a deposit from
its recipient's point of view, whichever direction the screen calls it.
DIRECTION IS EXPRESSED ENTIRELY BY WHICH ACCOUNT IS `from`, twenty
lines above: `out` sets flow t2p, which makes the target the payer.
Passing 2 as well applied the direction a SECOND time, and the two
flips did not cancel — they landed on different rows:
player type 1 DEPOSIT, amount NEGATIVE (should be 2 WITHDRAW)
operator type 2 WITHDRAW, amount POSITIVE (should be 1 DEPOSIT)
Balances were right, which is why nothing looked wrong. The reports
were not: report_player_daily sums type 1 into `deposits`, so a
withdrawal from a player REDUCED their deposits instead of raising
their withdrawals — a take-back against a column that is supposed to
be monotonic, in a figure an operator reads to decide whether an
account is profitable. */
typeId: 1,
description: reason ? reason.trim() : `${opDef.label} ${payer.username} -> ${target.username}`,
}), {
done: `${r.opLabel} applied — ${target.username}`,
fail: `${r.opLabel} did NOT go through`,
});
if (!res || !res.ok) { setModal(null); return; }
const entries = Array.isArray(res.data) ? res.data : [];
setModal({ receipt: { ...r,
/* The receipt shows what the DATABASE wrote: the two ledger ids and the
balance_after each row committed. Recomputing it here would show the
arithmetic this screen expected rather than the arithmetic that
happened, and those differ exactly when something went wrong. */
rows: entries.map(e => ({
tx: e.id,
who: Number(e.user_id) === payer.id ? payer.username : target.username,
side: Number(e.user_id) === payer.id ? "Payer" : "Target",
type: Number(e.amount) < 0 ? "out" : "add",
amt: Number(e.amount),
// EMBED-OK: ledger_entries.wallet is a plain text column (real/bonus/credits). `wallet` is an EMBED on networkUsers, which this file also reads.
col: e.wallet === "credits" ? "credits" : "balance_withdrawable",
newVal: Number(e.balance_after),
})),
notes: r.notes,
} });
setAmount(""); setReason(""); setWithdrawable(false); setApplyBonus(false);
};
const payerAvail = payerLed.bal + payerLed.cr;
const showPlayerChecks = usertype === "player" && op === "add";
return (
Transfer
Sidebar entry: “Deposit” · GET /transfer/ — the nav label and page heading differ in the real admin.
One engine moves all money. This form posts to dotransfer → TransferController::processTransfer — the same engine every approve flow funnels through: withdraw requests, the deposits queue, commissions, vouchers, crypto/StarsPay callbacks, cashback, promo triggers, the legacy fapi, the external API and the /endpoint/payment/ cronjob.,
Every operation writes two mirrored transactions rows (add↔out, add_credits↔out_credits) plus, for player targets, a transactions_history row (type 1 DEPOSIT / 2 WITHDRAW).,
Who sees this screen: the sidebar gate is support_transfer — auto-true for every role except Affiliate, Customer Care and Administration. CC additionally needs support_player_transactions_read_only or support_user_transactions_read_only, and is blocked by support_disable_transfers. Regulators get a 403.,
]}>
Move funds between the paying account on the left and any user in its hierarchy on the right: deposit, withdraw, or move credit lines. Balances are read from the database and refetched after every transfer, so what you see is what was committed.
{/* One directory, and the form below cannot render without it: every
balance box and both account pickers dereference the paying account.
So this RETURNS rather than rendering a notice above a form that
throws — the crash a non-returning guard produced is why. */}
{(opFeed.error || plFeed.error)
? { opFeed.retry(); plFeed.retry(); }} />
: (!actor || opFeed.loading || plFeed.loading)
?
: (<>
{/* ---------- Payer (left) — hidden for CC whose parent is ADMIN-level in the real panel ---------- */}
{/* ---------- Target + operation (right) ---------- */}