Transparency Report

/**
 * Selects winner(s) for all giveaways that have ended and are still pending.
 * Called by the cron scheduler every minute.
 */
public function pickWinners(): void
{
    // Fetch all giveaways that have ended but have no winner yet
    $giveaways = Giveaway::getEndedPending();

    foreach ($giveaways as $giveaway)
    {
        $this->processGiveaway($giveaway);
    }
}

private function processGiveaway(array $giveaway): void
{
    $id      = (int)$giveaway['id'];
    $copies  = (int)$giveaway['copies'];

    // Load all eligible entries — excludes currently banned users
    $entries = Entry::getEligibleForGiveaway($id);

    // Minimum entry guard — cancel and refund if under threshold
    if (count($entries) < self::MIN_ENTRIES)
    {
        $this->cancelAndRefund($giveaway);
        return;
    }

    $db = Database::getInstance();
    $db->beginTransaction();

    try
    {
        $winners  = [];
        $pool     = $entries; // mutable pool — winners are removed after each draw

        for ($i = 0; $i < $copies; $i++)
        {
            if (empty($pool)) break;

            // CSPRNG — cryptographically secure random integer
            // random_int() uses /dev/urandom on Linux (same source as OpenSSL)
            $index  = random_int(0, count($pool) - 1);
            $winner = $pool[$index];

            // Remove winner from pool to prevent duplicate wins
            array_splice($pool, $index, 1);

            // Record the win — links encrypted key to winner's Steam ID
            GiveawayKey::assignWinner($winner['user_id'], $id);
            $winners[] = $winner['user_id'];
        }

        Giveaway::markCompleted($id);
        $db->commit();

        // Dispatch notifications outside the transaction
        foreach ($winners as $winnerId)
        {
            Notification::create($winnerId, 'win', [
                'giveaway_id' => $id,
                'title'       => $giveaway['game_name'],
            ]);
        }
    }
    catch (\Throwable $e)
    {
        $db->rollback();
        throw $e;
    }
}

/**
 * Returns all entries for a giveaway, excluding banned users.
 * The result set is the exact pool fed into random_int().
 */
public static function getEligibleForGiveaway(int $giveawayId): array
{
    return self::getDb()->fetchAll(
        "SELECT e.user_id, e.created_at
         FROM entries e
         JOIN users u ON u.steam_id = e.user_id
         WHERE e.giveaway_id = ?
           AND (u.ban_expires_at IS NULL OR u.ban_expires_at < UNIX_TIMESTAMP())
           AND u.is_deleted = 0
         ORDER BY e.created_at ASC",
        [$giveawayId]
    );
}

class Encryption
{
    private const CIPHER = 'AES-256-CBC';

    /**
     * Encrypt a plaintext string.
     * A unique random IV is generated per encryption — the same key
     * will never produce the same ciphertext twice for the same input.
     */
    public static function encrypt(string $plaintext): string
    {
        $key = base64_decode(Config::get('APP_ENCRYPTION_KEY'));
        $iv  = random_bytes(openssl_cipher_iv_length(self::CIPHER)); // CSPRNG IV

        $ciphertext = openssl_encrypt($plaintext, self::CIPHER, $key, OPENSSL_RAW_DATA, $iv);

        // IV is prepended to ciphertext and base64-encoded for storage
        // Without the APP_ENCRYPTION_KEY env var, the IV is useless
        return base64_encode($iv . $ciphertext);
    }

    /**
     * Decrypt — only called at the moment a winner clicks "Reveal Key".
     * The decrypted key is returned to the winner's browser over TLS
     * and is never stored in plaintext anywhere.
     */
    public static function decrypt(string $encoded): string
    {
        $key    = base64_decode(Config::get('APP_ENCRYPTION_KEY'));
        $data   = base64_decode($encoded);
        $ivLen  = openssl_cipher_iv_length(self::CIPHER);
        $iv     = substr($data, 0, $ivLen);
        $cipher = substr($data, $ivLen);

        return openssl_decrypt($cipher, self::CIPHER, $key, OPENSSL_RAW_DATA, $iv);
    }
}