1
2// src/lib/services/WinnerSelection.ts
3import { randomInt } from 'crypto';
4import { GiveawayEntry } from '@/components/dashboard/giveaways/types';
5
6/**
7 * Select winners using weighted random selection.
8 * @param entries        All entries, each with a user_id and entries_count
9 * @param winnerCount    Number of winners to draw
10 * @param hasFraudDetection        Premium+ servers exclude fraud-flagged entries
11 * @param cooldownExcludedUserIds  Users on winner cooldown (recent wins)
12 * @returns Array of selected winner user IDs
13 */
14export function selectWinners(
15  entries: GiveawayEntry[],
16  winnerCount: number,
17  hasFraudDetection: boolean = true,
18  cooldownExcludedUserIds: string[] = []
19): string[] {
20  if (!entries || entries.length === 0) {
21    return [];
22  }
23
24  // 1. Exclude fraud-flagged entries (premium+) and users on winner cooldown.
25  //    Flags are set only by automated fraud detection; a server admin can never
26  //    manually flag, unflag, or hand-pick who gets excluded from the draw.
27  //    Free servers keep every entry; fraud flags are ignored.
28  const cooldownExcluded = new Set(cooldownExcludedUserIds);
29  const eligibleEntries = (hasFraudDetection
30    ? entries.filter(entry => entry.fraud_flag !== 'red')
31    : entries
32  ).filter(entry => !cooldownExcluded.has(entry.user_id));
33
34  if (eligibleEntries.length === 0) {
35    return [];
36  }
37
38  // 2. Build a weighted pool: one slot per entry earned.
39  //    5 entries = 5 slots = 5 chances to win.
40  const entryPool: string[] = [];
41  for (const entry of eligibleEntries) {
42    for (let i = 0; i < entry.entries_count; i++) {
43      entryPool.push(entry.user_id);
44    }
45  }
46
47  // 3. Draw winners with cryptographically secure randomness.
48  const winners: string[] = [];
49  const winnerSet = new Set<string>();
50
51  // A user can only win once, so never draw more winners than unique people.
52  const uniqueParticipants = new Set(eligibleEntries.map(entry => entry.user_id));
53  const availableWinnerCount = Math.min(winnerCount, uniqueParticipants.size);
54
55  if (availableWinnerCount === 0 || entryPool.length === 0) {
56    return [];
57  }
58
59  while (winners.length < availableWinnerCount && entryPool.length > 0) {
60    // crypto.randomInt is a CSPRNG: no seed, no bias, not manipulable.
61    const randomIndex = randomInt(entryPool.length);
62    const selectedUserId = entryPool[randomIndex];
63
64    // Only add first-time winners; duplicates are skipped.
65    if (!winnerSet.has(selectedUserId)) {
66      winners.push(selectedUserId);
67      winnerSet.add(selectedUserId);
68    }
69
70    // Remove the drawn slot via swap-and-pop (O(1)).
71    entryPool[randomIndex] = entryPool[entryPool.length - 1];
72    entryPool.pop();
73  }
74
75  return winners;
76}