Skip to content

Key Features

Audience: Sales, leadership, prospect's CTO/CEO. Read alongside ../architecture.md — the diagrams there name every module referenced below. Format: One row per shippable capability. Each row has a 1-line description, the owning code path (clickable in most viewers), key dependencies, and a documentation marker.

Doc-status legend — applied per row: - ✓ — covered by a published flow doc in ../flows/ or a runbook in ../runbooks/. - 🆗 — partially documented (architecture or API reference covers it; no dedicated flow doc). - ⚠ — {{TBD}} — not yet documented at flow-doc depth.

1. Identity & access

Feature Description Owns it Depends on Status
Email + password sign-up Username + email + password registration with email verification mail-out apps/api/src/auth/auth.controller.ts (sign-up), auth.service.ts SMTP via external-notification-sender/, captcha (GeeTest or reCAPTCHA), Postgres user table ✓ flows/dropbet-sign-up.md
Email + password sign-in Bcrypt verification, JWT access + refresh tokens, cookies set with secure flags apps/api/src/auth/auth.controller.ts, cookies.ts bcrypt, jsonwebtoken, Redis-backed session via BullMQ producer ✓ flows/dropbet-sign-in.md
2FA (TOTP) Per-user TOTP secret + OtpGuard for SuperAdmin endpoints; setup + verify + disable flow apps/api/src/auth/guards/, apps/api/src/auth/auth.service.ts otplib 🆗 runbooks/2fa-unknown-secret.md
Password reset Token-based reset via signed URL emailed to verified address apps/api/src/auth/auth.controller.ts SMTP ✓ flows/dropbet-password-reset.md
OAuth scaffolding (Google, Steam) GoogleStrategy + Steam strategy registered in auth.module.ts; setupUsernameAfterOAuthRegistration endpoint exists. Production-readiness: scaffolded; live-traffic enablement is operator config + integration testing apps/api/src/auth/strategies/google.strategy.ts, apps/api/src/auth/strategies/steam/ Google OAuth client, Steam OpenID ⚠
API key auth ApiKeyStrategy for service-to-service callers (e.g. external bots, sportsbook S2S) apps/api/src/auth/strategies/api-key.strategy.ts, apps/api/src/api-key/ — ⚠
Captcha (GeeTest primary) GeeTest v4 sliding-puzzle captcha on sign-up + sign-in; deduped via Redis cache key apps/api/src/captcha/geetest/geetest-captcha.service.ts Redis cache, GeeTest API 🆗
Captcha (reCAPTCHA fallback) Google reCAPTCHA gate; is-capture-on: off header + NODE_ENV=local bypasses it for E2E + dev apps/api/src/captcha/google/recaptcha.guard.ts Google reCAPTCHA 🆗 + runbooks/recaptcha-fails-locally.md
WebSocket auth Socket handshake via auth={socket_token}, validated against Redis session store; per-IP throttle apps/rt/src/gateway/, libs/ws-throttler/ Redis cache (MAX_CONNECTIONS_PER_IP=10 per IP, configurable in env) ✓ flows/rt-websocket.md

2. Wallet, payments, and accounting

Feature Description Owns it Depends on Status
Multi-currency balance ledger user_balance per (user, currency) with amount + vault_amount; transactional ledger writes with idempotency libs/_prisma/src/schema/api.prisma (UserBalance), apps/api/src/accounting/ Postgres 🆗
FX / USD valuation ExchangeRatesService.toUsd() for cross-currency display & wager normalisation apps/api/src/exchange-rates/ external rate feed ({{TBD: provider}}) ⚠
Crypto deposit (CCPayment) CCPayment provider integration: invoice creation, webhook handling, signature verification apps/api/src/payment/provider/integration/ccpayment/ CCPayment API 🆗 flows/dropbet-wallet.md
Crypto deposit (NowPayments) NowPayments invoice + IPN webhook + fee/fixed-rate flags apps/api/src/payment/provider/integration/nowpayments/ NowPayments API 🆗
Skin trading deposits SkinDeck integration for skin-to-balance flow apps/api/src/payment/provider/integration/skindeck/ SkinDeck API ⚠
Withdrawal pipeline withdraw controller + admin approval flow + withdraw-check.service.ts for compliance gates apps/api/src/payment/withdraw/ KYC status, ledger 🆗
Deposit pipeline deposit controller + admin review + Redis pub-sub gateway notifier apps/api/src/payment/deposit/ provider webhook → ledger 🆗
Payment provider abstraction PaymentProviderModule aggregates all integrations; PaymentProviderService is the single import surface apps/api/src/payment/provider/payment-provider.module.ts — 🆗
Network registry Catalogue of supported chains/networks per provider apps/api/src/payment/provider/network/ — ⚠
Wallet display Player-facing wallet UI: balances, deposit, withdraw, history ebit-fe/src/app/[locale]/... (wallet route) API client, socket events ✓ flows/dropbet-wallet.md

3. Compliance

Feature Description Owns it Depends on Status
KYC (Sumsub) Applicant lifecycle: create → upload → review → status webhook → state transition apps/api/src/kyc/sumsub/, apps/api/src/kyc/kyc.service.ts Sumsub API + webhooks 🆗
KYC repository Persistent applicant + document state model apps/api/src/kyc/kyc.repository.ts Postgres 🆗
User limits Self-exclusion, deposit limits, loss limits apps/api/src/users-limits/ (also apps/bo/src/user-limits/) accounting, admin ⚠
Geo / country gating IP → country resolver + restricted-country list apps/api/src/country/ external geo-IP lookup ({{TBD: provider}}) ⚠
Audit logging Admin notes, OTel spans across every state-changing endpoint, structured pino logs to Loki apps/api/src/user/admin/notes/, libs/shared/ (NestLoggerModule), docs/observability.md Loki, Jaeger 🆗

4. Casino — house games (in-house RNG)

All settle through the shared bet/ pipeline (apps/api/src/bet/) and produce a bet_settled BullMQ job that drives leaderboard / promo / rakeback.

Game Code path Status
Dice apps/api/src/casino/house/dice/ (dice.service.ts) ✓ flows/dropbet-house-game.md (covers all four house games)
Limbo apps/api/src/casino/house/limbo/ ✓
Mines apps/api/src/casino/house/mines/ (multi-step rounds, mid-round cashout) ✓
Plinko apps/api/src/casino/house/plinko/ ✓
Provably-fair seeding apps/api/src/provably-fair/ — server seed rotation, client seed support 🆗

5. Casino — live + game-server-driven

Game App Description Code Status
Blackjack (dropbet) apps/api (in-process) Player-facing blackjack UI + game logic served via REST + websocket apps/api/src/casino/games/... (blackjack ref) ✓ flows/dropbet-blackjack.md
Blackjack (orphan game-server) apps/bj (port 4002) Standalone blackjack server with EVO-Games external-wallet path. Currently not wired to dropbet traffic — see architecture §1 trust boundary note apps/bj/src/main.ts ⚠
Speed Roulette apps/speed-roulette EOS-blockchain-anchored roulette wheel; BullMQ state machine concurrency=1 per round apps/speed-roulette/, libs/_prisma/src/schema/speed_roulette.prisma ✓ flows/dropbet-speed-roulette.md

6. Casino — provider-game catalogues (slots + tables via partner)

Adapter pattern: each provider lives in apps/api/src/casino/slots/providers/<name>/, exposing a launch service and a wallet callback.

Provider Code path What it ships
Softswiss apps/api/src/casino/games/api/softswiss/ (CDN + sub-vendor catalogue) + apps/api/src/casino/games/service/hydrate-softswiss.service.ts Game catalogue hydration from Softswiss CDN
PM8 apps/api/src/casino/slots/providers/pm8/ Launch URL signing, wallet callbacks, controller
BGaming apps/api/src/casino/slots/providers/bgaming/ (api/bgaming-api.service.ts, wallet/) Launch + wallet callback + dev-proxy controller
ST8 apps/api/src/casino/slots/providers/st8/ Launch + wallet integration
EvoGames apps/api/src/casino/slots/providers/evogames/ Launch + wallet integration
Common provider scaffolding apps/api/src/casino/slots/providers/common/ Shared signature/HMAC helpers, error taxonomy

Status across the row: 🆗 — the adapters exist and are wired into slot-games.service.ts; per-provider integration depth varies, see integration-options.md §Game provider integration model.

7. Sportsbook

Feature Description Owns it Status
Sportsbook proxy Player-facing endpoints proxy to upstream odds engine apps/api/src/sportbook/sportbook.controller.ts, sportbook.service.ts ⚠
S2S auth Service-to-service auth for upstream odds engine callbacks apps/api/src/sportbook/s2s/ ⚠
Sportsbook actions / transactions Bet placement → settlement → ledger writeback apps/api/src/sportbook/actions/transactions/ ⚠
System endpoints Health / config / catalogue endpoints apps/api/src/sportbook/system/ ⚠

Note: sportsbook is a proxy. Evospin does not run an odds engine; the upstream provider is operator-configured.

8. Bet pipeline

Feature Description Owns it Status
Bet placement Single canonical endpoint per game; decoupled validation, balance hold, settlement apps/api/src/bet/ (BetController, BetCrudService, BetRepository) ✓ flows/dropbet-bet-place.md
Bet settlement queue BullMQ bet_settled_queue — every settled bet drives downstream processors (leaderboard, promo, rakeback, GGR) apps/api/src/bet/queue/ 🆗
Bet history Paginated player history; admin-side detailed view apps/api/src/bet/, apps/bo/src/bet/ ✓ flows/dropbet-bet-history.md, flows/admin-bets.md
GGR commission Provider-game GGR computed via ggr-commission.service.ts apps/api/src/casino/games/service/ggr-commission.service.ts ⚠

9. Promotions, loyalty, social

Feature Description Owns it Status
Promo / bonus PromoController + PromoEffectService apply bonuses on deposit / sign-up / events; lock.decorator.ts for race safety apps/api/src/promo/ 🆗
Challenges Award-only challenges driven by admin; wager / win triggers apps/api/src/challenge/ ✓ flows/dropbet-challenges.md
Leaderboard Periodic recompute (leaderboard.checker.ts), gateway pushes top-N to subscribed sockets apps/api/src/leaderboard/ ✓ flows/dropbet-leaderboard.md
Rakeback Computed on bet_settled events apps/api/src/rakeback/ 🆗
VIP program Tier progression based on wagered volume apps/api/src/vip-program/ ⚠
Tips (peer-to-peer) Player-to-player balance tips with admin reversal capability apps/api/src/tips/, apps/api/src/admin-tips/ ⚠
Affiliate Affiliate-link tracking + commissions apps/api/src/affiliate/ ⚠
Traffic arbitrage Arbitrage marketing campaign accounting apps/api/src/traffic-arbitrage/ ⚠
Telegram bot integration Bot endpoints for in-Telegram interactions apps/api/src/telegram/ ⚠
FastTrack bonus tracker RabbitMQ producer to FastTrack — stubbed (disabled = true at line 8 of apps/api/src/fast-track/rabbitmq/fast-track.rmq.module.ts) apps/api/src/fast-track/ ⚠

10. Real-time + chat

Feature Description Owns it Status
WebSocket fan-out socket.io v4, /events namespace, websocket-only transport, Redis pub/sub backplane apps/rt/src/gateway/ ✓ flows/rt-websocket.md
Online tracker Live online-user counter, broadcast to UI apps/rt/src/online-tracker/ 🆗
Event catalogue Typed event definitions consumed by FE socket-client apps/rt/src/gateway/events.ts ✓
RT notifications API-side publishers → gateway pub/sub → rt apps/api/src/rt-notification/ 🆗
Chat In-game chat channels + admin moderation apps/api/src/chat/ ⚠

11. Admin / backoffice

Feature Description Owns it Status
Admin sign-in (2FA-gated) Admin login with TOTP, role-based access, OtpGuard for SuperAdmin apps/api/src/auth/ (admin paths), ebit-admin-fe/src/app/(auth)/ ✓ flows/admin-sign-in.md
User management List, search, ban, KYC review, balance adjustment, notes apps/api/src/user/admin/, apps/bo/src/user/, ebit-admin-fe/.../user/ ✓ flows/admin-user-mgmt.md
Bet review Per-bet inspection with full audit trail + ledger correction apps/bo/src/bet/, ebit-admin-fe/.../bets/ ✓ flows/admin-bets.md
Promo / challenge / leaderboard CRUD Admin CRUD over promotional content apps/api/src/promo/controllers/, apps/api/src/challenge/controller/, apps/api/src/leaderboard/admin.leaderboard.controller.ts 🆗
Site config Feature flags + runtime toggles apps/api/src/site-config/, apps/bo/src/site-config/ ⚠
FAQ CMS FAQ content management apps/api/src/faq/, apps/bo/src/faq/ ⚠
Dashboards Operator KPI dashboards apps/api/src/dashboard-v2/, apps/api/src/dashboard/, ebit-admin-fe/.../dashboard/ (Ant Design charts) ⚠
Affiliate / API key admin Affiliate management, API key rotation apps/bo/src/affiliate/, apps/bo/src/api-key/ ⚠

12. Frontends

App Framework Role Code Status
ebit-fe (dropbet) Next.js (next-intl en/de, socket.io-client) Public player site ebit-fe/src/app/[locale]/ ✓ — covered by every flows/dropbet-*.md
ebit-admin-fe Vite + React (TanStack Router) Internal admin panel (single language) ebit-admin-fe/src/routes/ ✓ — covered by every flows/admin-*.md

Versions and full stack inventory: ../engineering/stack.md.

13. Async, observability, infrastructure (cross-cutting)

Capability Description Owns it Status
BullMQ async runtime All production queues: auth-session updates, bet settlement, bots, leaderboard, promo, user-stats migration, skindeck deposits, both speed-roulette queues apps/api/src/**/bull/, apps/api/src/**/queue/, @nestjs/bullmq 🆗 — see CLAUDE.md §"Async queues"
House-bot fleet Simulated-activity bots driven by BullMQ producers, isolated on Redis :6380 apps/api/src/bots/system/bull/, apps/api/src/bots/bot.service.ts ⚠
RabbitMQ broker In compose (vhost=ft), wired only to FastTrack stub — receives zero traffic until stub removed apps/api/src/fast-track/rabbitmq/ ⚠
OpenTelemetry pipeline Pre-main bootstrap, OTLP HTTP to collector, spanmetrics → Prometheus, traces → Jaeger, logs → Loki via pino libs/shared/ (OTel pre-main), observability/otel-collector.yml ✓ ../observability.md, ../e2e-trace-demo.md
Sentry Errors + source maps for all three apps sentry.*.config.ts per repo 🆗
Performance test harness k6 + Playwright canary, terraform modules for monitoring + app VMs tests-perf/ (root), terraform/perf/ ✓ ../performance-testing.md
Provably-fair fairness Server-seed rotation, HMAC-bound per-bet seeds apps/api/src/provably-fair/ 🆗
Multi-tier rate limiting Per-route sliding-window throttle (Lua on cache Redis), per-IP WS connection cap apps/api/src/captcha/ (HTTP), libs/ws-throttler/ (WS) 🆗
Doppler-managed secrets All env vars in dev pulled via run_local.sh from Doppler each repo's run_local.sh 🆗