fix(players, economy): grants are atomic and tell the player; create and edit players work

Grant and revoke (player page and economy module) used to read the balance,
add in PHP, write it back and insert the ledger row separately, racing any
game payout in between. They now call admin_adjust_currency() (one statement,
coins or gems, never below zero, booked as admin_grant / debit; see El3ab
migrations/2026-10-26-manager-columns.sql) and put a notice in the player's
bell (title_ar/body_ar, as the game's notifications.php reads them).
award_coins() was not used: coins only, no floor, and it books staff grants
as game income.

Edit no longer sends profiles.email (no such column; PGRST204 rejected the
whole update); the login email is shown read-only from the auth account.
Create now makes a real login account through GoTrue's admin API, whose
trigger creates the profile; the old insert had no id and always failed.
The match history query used a players column matches does not have, and
the transactions tab read a variable that was never set.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

core/EconomyService.php

+<?php
+
+/**
+ * Staff grants and revokes of coins and gems.
+ *
+ * Grants used to read the balance, add to it in PHP and write it back, then
+ * insert the ledger row separately: a game paying out between the read and the
+ * write lost one of the two changes, and a failed second write left a balance
+ * with no ledger entry. The change now happens in one database statement,
+ * admin_adjust_currency() (El3ab migrations/2026-10-26-manager-columns.sql),
+ * which also refuses to take a balance below zero and books the row as
+ * admin_grant / debit. award_coins() was not used: it only handles coins, never
+ * refuses a negative balance, and books everything as game income.
+ *
+ * The player is told in the in-game bell (notifications.title_ar/body_ar, as
+ * the game's api/notifications.php reads them). Their HUD balance itself only
+ * refreshes when the app next loads it.
+ */
+class EconomyService
+{
+    public const MAX_AMOUNT = 1000000;
+
+    /** "500 من العملات" reads correctly for any count, unlike a bare noun. */
+    private const CURRENCY_AR = ['coins' => 'من العملات', 'gems' => 'من الجواهر'];
+
+    /**
+     * @return array{ok:bool, balance:?int, message:string, error:?string}
+     */
+    public static function adjust(string $playerId, string $currency, int $amount, string $reason = '', bool $notify = true): array
+    {
+        if (!isset(self::CURRENCY_AR[$currency])) {
+            return ['ok' => false, 'balance' => null, 'message' => '', 'error' => 'عملة غير معروفة'];
+        }
+        if ($amount === 0) {
+            return ['ok' => false, 'balance' => null, 'message' => '', 'error' => 'يجب إدخال مبلغ صحيح'];
+        }
+        if (abs($amount) > self::MAX_AMOUNT) {
+            return ['ok' => false, 'balance' => null, 'message' => '', 'error' => 'مبلغ كبير جداً - الحد الأقصى 1,000,000'];
+        }
+
+        $db = Database::getInstance();
+        $admin = Auth::user()['username'] ?? 'staff';
+        $reason = $reason !== '' ? $reason : ($amount > 0 ? 'منح بواسطة الإدارة' : 'سحب بواسطة الإدارة');
+
+        $balance = $db->rpc('admin_adjust_currency', [
+            'p_player_id' => $playerId,
+            'p_currency' => $currency,
+            'p_amount' => $amount,
+            'p_reason' => $reason,
+            'p_admin' => 'admin:' . $admin,
+        ]);
+
+        if ($balance === null) {
+            $err = $db->lastError();
+            $db->clearWriteErrors();
+            $message = $err['message'] ?? '';
+            if (str_contains($message, 'insufficient balance')) return ['ok' => false, 'balance' => null, 'message' => '', 'error' => 'الرصيد غير كاف'];
+            if (str_contains($message, 'player not found')) return ['ok' => false, 'balance' => null, 'message' => '', 'error' => 'اللاعب غير موجود'];
+            return ['ok' => false, 'balance' => null, 'message' => '', 'error' => 'لم تتم العملية: ' . ($err ? Database::describe($err) : 'خطأ غير معروف')];
+        }
+
+        $unit = self::CURRENCY_AR[$currency];
+        $abs = number_format(abs($amount));
+        $message = ($amount > 0 ? "تم منح {$abs} {$unit}" : "تم سحب {$abs} {$unit}") . ' — الرصيد الآن ' . number_format((int)$balance);
+
+        if ($notify) {
+            $note = $db->soft(fn(Database $d) => $d->insert('notifications', [
+                'user_id' => $playerId,
+                'type' => 'reward',
+                'title' => $amount > 0 ? 'A gift from the EL3AB team' : 'Balance adjusted',
+                'title_ar' => $amount > 0 ? 'هدية من فريق الإدارة' : 'تعديل في رصيدك',
+                'body' => ($amount > 0 ? "{$abs} {$currency} were added to your balance." : "{$abs} {$currency} were deducted from your balance.") . ' ' . $reason,
+                'body_ar' => ($amount > 0 ? "أُضيف إلى رصيدك {$abs} {$unit}." : "خُصم من رصيدك {$abs} {$unit}.") . ' ' . $reason,
+                'data' => ['currency' => $currency, 'amount' => $amount, 'balance' => (int)$balance],
+            ]));
+            if ($note === null) $message .= ' (تعذر إرسال الإشعار للاعب)';
+        }
+
+        return ['ok' => true, 'balance' => (int)$balance, 'message' => $message, 'error' => null];
+    }
+}

index.php

@@ -16,6 +16,7 @@ require_once __DIR__ . '/core/Response.php';
 require_once __DIR__ . '/core/ThemeService.php';
 require_once __DIR__ . '/core/SupabaseStorage.php';
 require_once __DIR__ . '/core/OrgPermissions.php';
+require_once __DIR__ . '/core/EconomyService.php';
 
 $route = trim($_GET['route'] ?? '', '/');
 $method = $_SERVER['REQUEST_METHOD'];

modules/economy/controller.php

@@ -21,7 +21,7 @@ class EconomyController
         }
 
         $todayEarned = $this->db->count('economy_transactions', [
-            'type' => 'eq.credit',
+            'type' => 'in.(credit,admin_grant,game_reward,daily_reward,level_up_reward,refund)',
             'created_at' => 'gte.' . date('Y-m-d') . 'T00:00:00',
         ]);
 
@@ -71,80 +71,43 @@ class EconomyController
     public function grant(array $params, string $method): void
     {
         Auth::requireCsrf();
-        $userId = $_POST['user_id'] ?? '';
-        $currency = $_POST['currency'] ?? 'coins';
-        $amount = (int)($_POST['amount'] ?? 0);
-
-        if (empty($userId) || $amount <= 0) {
+        $userId = trim($_POST['user_id'] ?? '');
+        if ($userId === '') {
             Response::error('بيانات غير صحيحة', '/economy');
             return;
         }
-
-        if ($amount > 1000000) {
-            Response::error('مبلغ كبير جداً - الحد الأقصى 1,000,000', '/economy');
+        $amount = (int)($_POST['amount'] ?? 0);
+        if ($amount <= 0) {
+            Response::error('يجب إدخال مبلغ صحيح', '/economy');
             return;
         }
-
-        $player = $this->db->selectOne('profiles', ['id' => "eq.{$userId}"]);
-        if (!$player) {
-            Response::error('اللاعب غير موجود', '/economy');
+        $currency = (string)($_POST['currency'] ?? 'coins');
+        $res = EconomyService::adjust($userId, $currency, $amount, trim($_POST['reason'] ?? ''));
+        if (!$res['ok']) {
+            Response::error($res['error'], '/economy');
             return;
         }
-
-        $newBalance = ($player[$currency] ?? 0) + $amount;
-        $this->db->update('profiles', ['id' => "eq.{$userId}"], [$currency => $newBalance]);
-        $this->db->insert('economy_transactions', [
-            'player_id' => $userId,
-            'type' => 'credit',
-            'currency' => $currency,
-            'amount' => $amount,
-            'balance_after' => $newBalance,
-            'reason' => trim($_POST['reason'] ?? 'منح بواسطة الإدارة'),
-            'source_id' => 'admin:' . Auth::user()['username'],
-        ]);
-
-        AuditLog::log('grant', 'economy', $userId, null, ['currency' => $currency, 'amount' => $amount]);
-        Response::success("تم منح {$amount} {$currency} بنجاح", '/economy');
+        AuditLog::log('grant', 'economy', $userId, null, ['currency' => $currency, 'amount' => $amount, 'balance' => $res['balance']]);
+        Response::success($res['message'], '/economy');
     }
 
     public function revoke(array $params, string $method): void
     {
         Auth::requireCsrf();
-        $userId = $_POST['user_id'] ?? '';
-        $currency = $_POST['currency'] ?? 'coins';
+        $userId = trim($_POST['user_id'] ?? '');
         $amount = (int)($_POST['amount'] ?? 0);
-
-        if (empty($userId) || $amount <= 0) {
+        if ($userId === '' || $amount <= 0) {
             Response::error('بيانات غير صحيحة', '/economy');
             return;
         }
-
-        $player = $this->db->selectOne('profiles', ['id' => "eq.{$userId}"]);
-        if (!$player) {
-            Response::error('اللاعب غير موجود', '/economy');
+        $currency = (string)($_POST['currency'] ?? 'coins');
+        $res = EconomyService::adjust($userId, $currency, -$amount, trim($_POST['reason'] ?? ''));
+        if (!$res['ok']) {
+            Response::error($res['error'], '/economy');
             return;
         }
-
-        $currentBalance = $player[$currency] ?? 0;
-        if ($amount > $currentBalance) {
-            Response::error('الرصيد غير كاف', '/economy');
-            return;
-        }
-
-        $newBalance = $currentBalance - $amount;
-        $this->db->update('profiles', ['id' => "eq.{$userId}"], [$currency => $newBalance]);
-        $this->db->insert('economy_transactions', [
-            'player_id' => $userId,
-            'type' => 'debit',
-            'currency' => $currency,
-            'amount' => -$amount,
-            'balance_after' => $newBalance,
-            'reason' => trim($_POST['reason'] ?? 'سحب بواسطة الإدارة'),
-            'source_id' => 'admin:' . Auth::user()['username'],
-        ]);
-
-        AuditLog::log('revoke', 'economy', $userId, null, ['currency' => $currency, 'amount' => $amount]);
-        Response::success("تم سحب {$amount} {$currency}", '/economy');
+        AuditLog::log('revoke', 'economy', $userId, null, ['currency' => $currency, 'amount' => -$amount, 'balance' => $res['balance']]);
+        Response::success($res['message'], '/economy');
     }
 
     public function bulkGrant(array $params, string $method): void
@@ -152,8 +115,8 @@ class EconomyController
         Auth::requireCsrf();
         Auth::requireRole('admin');
 
-        $userIds = array_filter(explode(',', $_POST['user_ids'] ?? ''));
-        $currency = $_POST['currency'] ?? 'coins';
+        $userIds = array_values(array_unique(array_filter(array_map('trim', explode(',', $_POST['user_ids'] ?? '')))));
+        $currency = (string)($_POST['currency'] ?? 'coins');
         $amount = (int)($_POST['amount'] ?? 0);
 
         if (empty($userIds) || $amount <= 0) {
@@ -162,25 +125,19 @@ class EconomyController
         }
 
         $count = 0;
+        $failed = [];
         foreach ($userIds as $userId) {
-            $player = $this->db->selectOne('profiles', ['id' => "eq.{$userId}"]);
-            if (!$player) continue;
-
-            $newBalance = ($player[$currency] ?? 0) + $amount;
-            $this->db->update('profiles', ['id' => "eq.{$userId}"], [$currency => $newBalance]);
-            $this->db->insert('economy_transactions', [
-                'player_id' => $userId,
-                'type' => 'credit',
-                'currency' => $currency,
-                'amount' => $amount,
-                'balance_after' => $newBalance,
-                'reason' => 'منح جماعي',
-                'source_id' => 'admin:' . Auth::user()['username'],
-            ]);
-            $count++;
+            $res = EconomyService::adjust($userId, $currency, $amount, 'منح جماعي');
+            if ($res['ok']) { $count++; } else { $failed[] = $userId; }
         }
 
-        AuditLog::log('bulk_grant', 'economy', null, null, ['count' => $count, 'amount' => $amount, 'currency' => $currency]);
-        Response::success("تم منح {$amount} {$currency} لـ {$count} لاعب", '/economy');
+        AuditLog::log('bulk_grant', 'economy', null, null, ['count' => $count, 'failed' => count($failed), 'amount' => $amount, 'currency' => $currency]);
+        if ($count === 0) {
+            Response::error('لم يُمنح أي لاعب', '/economy');
+            return;
+        }
+        $msg = "تم منح {$amount} لـ {$count} لاعب";
+        if ($failed) $msg .= ' — تعذر ' . count($failed);
+        Response::success($msg, '/economy');
     }
 }

modules/economy/views/index.php

@@ -70,12 +70,12 @@
             <tbody>
                 <?php foreach ($recentTransactions as $tx): ?>
                 <tr>
-                    <td class="text-xs"><?= View::e(substr($tx['user_id'], 0, 8)) ?>...</td>
+                    <td class="text-xs"><?= View::e(substr((string)($tx['player_id'] ?? ''), 0, 8)) ?>...</td>
                     <td><span class="badge badge-<?= in_array($tx['type'], ['earn', 'admin_grant', 'tournament_prize']) ? 'success' : 'danger' ?>"><?= View::e($tx['type']) ?></span></td>
                     <td><?= $tx['currency'] === 'coins' ? 'عملات' : 'جواهر' ?></td>
                     <td class="tabular-nums <?= $tx['amount'] > 0 ? 'text-success' : 'text-danger' ?>"><?= $tx['amount'] > 0 ? '+' : '' ?><?= number_format($tx['amount']) ?></td>
                     <td class="tabular-nums"><?= number_format($tx['balance_after']) ?></td>
-                    <td class="text-xs text-muted truncate" style="max-width: 150px;"><?= View::e($tx['description'] ?? '-') ?></td>
+                    <td class="text-xs text-muted truncate" style="max-width: 150px;"><?= View::e($tx['reason'] ?? '-') ?></td>
                     <td class="text-xs tabular-nums"><?= date('m/d H:i', strtotime($tx['created_at'])) ?></td>
                 </tr>
                 <?php endforeach; ?>

modules/economy/views/transactions.php

@@ -32,12 +32,12 @@
             <tbody>
                 <?php foreach ($transactions as $tx): ?>
                 <tr>
-                    <td><a href="/players/<?= $tx['user_id'] ?>" class="text-blue text-xs"><?= substr($tx['user_id'], 0, 8) ?>...</a></td>
+                    <td><a href="/players/<?= View::e($tx['player_id'] ?? '') ?>" class="text-blue text-xs"><?= View::e(substr((string)($tx['player_id'] ?? ''), 0, 8)) ?>...</a></td>
                     <td><span class="badge badge-<?= in_array($tx['type'], ['earn', 'admin_grant', 'tournament_prize']) ? 'success' : 'danger' ?>"><?= View::e($tx['type']) ?></span></td>
                     <td><?= $tx['currency'] === 'coins' ? 'عملات' : 'جواهر' ?></td>
                     <td class="tabular-nums <?= $tx['amount'] > 0 ? 'text-success' : 'text-danger' ?>"><?= $tx['amount'] > 0 ? '+' : '' ?><?= number_format($tx['amount']) ?></td>
                     <td class="tabular-nums"><?= number_format($tx['balance_after']) ?></td>
-                    <td class="text-xs text-muted truncate" style="max-width: 150px;"><?= View::e($tx['description'] ?? '-') ?></td>
+                    <td class="text-xs text-muted truncate" style="max-width: 150px;"><?= View::e($tx['reason'] ?? '-') ?></td>
                     <td class="text-xs tabular-nums"><?= date('m/d H:i', strtotime($tx['created_at'])) ?></td>
                 </tr>
                 <?php endforeach; ?>

modules/players/controller.php

@@ -56,9 +56,10 @@ class PlayersController
             return;
         }
 
+        // matches has no players list: a player is one of the two seats.
         $matches = $this->db->select('matches', [
             'select' => '*',
-            'or' => "(players->cs.[{\"id\":\"{$id}\"}])",
+            'or' => "(white_player_id.eq.{$id},black_player_id.eq.{$id})",
             'order' => 'created_at.desc',
             'limit' => 20,
         ]);
@@ -80,7 +81,7 @@ class PlayersController
         $moduleCSS = 'players';
         $moduleJS = 'players';
 
-        View::render('players/show', compact('player', 'matches', 'economy_transactions', 'reports', 'pageTitle', 'moduleCSS', 'moduleJS'));
+        View::render('players/show', compact('player', 'matches', 'transactions', 'reports', 'pageTitle', 'moduleCSS', 'moduleJS'));
     }
 
     public function create(array $params, string $method): void
@@ -91,6 +92,15 @@ class PlayersController
         View::render('players/form', compact('player', 'pageTitle', 'moduleCSS'));
     }
 
+    /**
+     * Create a player account.
+     *
+     * A profile row cannot exist on its own: profiles.id references the login
+     * account (auth.users), so the old direct insert failed on its null id. The
+     * account is created through GoTrue's admin API; its trigger creates the
+     * profile (and makes the username unique), and the rest of the form is then
+     * written onto that profile.
+     */
     public function store(array $params, string $method): void
     {
         Auth::requireCsrf();
@@ -98,25 +108,83 @@ class PlayersController
         $validator = Validator::make($_POST)
             ->required('username', 'اسم المستخدم')
             ->minLength('username', 3, 'اسم المستخدم')
-            ->maxLength('username', 30, 'اسم المستخدم');
+            ->maxLength('username', 20, 'اسم المستخدم')
+            ->required('email', 'البريد الإلكتروني')
+            ->email('email', 'البريد الإلكتروني');
 
         if ($validator->fails()) {
             Response::error($validator->firstError(), '/players/create');
             return;
         }
 
+        $username = trim($_POST['username']);
+        if (!preg_match('/^[A-Za-z0-9_]{3,20}$/', $username)) {
+            Response::error('اسم المستخدم: حروف إنجليزية وأرقام وشرطة سفلية فقط (3 إلى 20)', '/players/create');
+            return;
+        }
+        if ($this->db->selectOne('profiles', ['username' => 'eq.' . $username, 'select' => 'id'])) {
+            Response::error('اسم المستخدم مستخدم بالفعل', '/players/create');
+            return;
+        }
+
+        $password = (string)($_POST['password'] ?? '');
+        $generated = $password === '';
+        if ($generated) $password = bin2hex(random_bytes(5));
+        if (strlen($password) < 8 && !$generated) {
+            Response::error('كلمة المرور 8 أحرف على الأقل', '/players/create');
+            return;
+        }
+
+        $account = $this->authAdmin('POST', '/admin/users', [
+            'email' => trim($_POST['email']),
+            'password' => $password,
+            'email_confirm' => true,
+            'user_metadata' => [
+                'username' => $username,
+                'display_name' => trim($_POST['display_name'] ?? '') ?: $username,
+            ],
+        ]);
+        $userId = $account['body']['id'] ?? null;
+        if (!$account['ok'] || !$userId) {
+            $why = $account['body']['msg'] ?? $account['body']['error_description'] ?? $account['body']['message'] ?? ('HTTP ' . $account['status']);
+            Response::error('لم يُنشأ الحساب: ' . $why, '/players/create');
+            return;
+        }
+
         $data = [
-            'username' => trim($_POST['username']),
-            'display_name' => trim($_POST['display_name'] ?? ''),
-            'display_name_ar' => trim($_POST['display_name_ar'] ?? ''),
-            'country_code' => trim($_POST['country_code'] ?? ''),
-            'city' => trim($_POST['city'] ?? ''),
-            'bio' => trim($_POST['bio'] ?? ''),
+            'display_name' => trim($_POST['display_name'] ?? '') ?: $username,
+            'display_name_ar' => trim($_POST['display_name_ar'] ?? '') ?: null,
+            'country_code' => strtoupper(trim($_POST['country_code'] ?? '')) ?: null,
+            'city' => trim($_POST['city'] ?? '') ?: null,
+            'bio' => trim($_POST['bio'] ?? '') ?: null,
+            'updated_at' => date('c'),
         ];
+        $this->db->update('profiles', ['id' => "eq.{$userId}"], $data);
 
-        $result = $this->db->insert('profiles', $data);
-        AuditLog::log('create', 'player', $result['id'] ?? null, null, $data);
-        Response::success('تم إنشاء اللاعب بنجاح', '/players');
+        AuditLog::log('create', 'player', $userId, null, ['username' => $username] + $data);
+        $note = $generated ? " كلمة المرور المؤقتة: {$password}" : '';
+        Response::success('تم إنشاء حساب اللاعب.' . $note, "/players/{$userId}");
+    }
+
+    /** GoTrue admin API with the service key. */
+    private function authAdmin(string $method, string $path, ?array $body = null): array
+    {
+        $ch = curl_init(SUPABASE_URL . '/auth/v1' . $path);
+        curl_setopt_array($ch, [
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_TIMEOUT => 20,
+            CURLOPT_CUSTOMREQUEST => $method,
+            CURLOPT_HTTPHEADER => [
+                'apikey: ' . SUPABASE_SERVICE_KEY,
+                'Authorization: Bearer ' . SUPABASE_SERVICE_KEY,
+                'Content-Type: application/json',
+            ],
+        ]);
+        if ($body !== null) curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body, JSON_UNESCAPED_UNICODE));
+        $raw = curl_exec($ch);
+        $status = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+        $decoded = json_decode((string)$raw, true);
+        return ['ok' => $status >= 200 && $status < 300, 'status' => $status, 'body' => is_array($decoded) ? $decoded : []];
     }
 
     public function edit(array $params, string $method): void
@@ -130,6 +198,10 @@ class PlayersController
             return;
         }
 
+        // The login email lives on the auth account, not on the profile.
+        $account = $this->authAdmin('GET', '/admin/users/' . rawurlencode($id));
+        $player['email'] = $account['body']['email'] ?? null;
+
         $pageTitle = 'تعديل اللاعب';
         $moduleCSS = 'players';
         View::render('players/form', compact('player', 'pageTitle', 'moduleCSS'));
@@ -146,10 +218,11 @@ class PlayersController
             return;
         }
 
+        // profiles has no email column (it is on the login account), so sending
+        // one made PostgREST reject the whole update.
         $data = [
             'display_name' => trim($_POST['display_name'] ?? ''),
             'display_name_ar' => trim($_POST['display_name_ar'] ?? ''),
-            'email' => trim($_POST['email'] ?? ''),
             'country_code' => trim($_POST['country_code'] ?? ''),
             'city' => trim($_POST['city'] ?? ''),
             'bio' => trim($_POST['bio'] ?? ''),
@@ -160,7 +233,10 @@ class PlayersController
         if (!empty($_POST['elo_rapid'])) $data['elo_rapid'] = (int)$_POST['elo_rapid'];
         if (!empty($_POST['elo_classical'])) $data['elo_classical'] = (int)$_POST['elo_classical'];
 
-        $this->db->update('profiles', ['id' => "eq.{$id}"], $data);
+        if ($this->db->update('profiles', ['id' => "eq.{$id}"], $data) === null) {
+            Response::error('لم تُحفظ بيانات اللاعب: ' . $this->db->lastErrorMessage(), "/players/{$id}/edit");
+            return;
+        }
         AuditLog::log('update', 'player', $id, $old, $data);
         Response::success('تم تحديث بيانات اللاعب', "/players/{$id}");
     }
@@ -217,66 +293,26 @@ class PlayersController
     {
         Auth::requireCsrf();
         $id = $params['id'];
-        $currency = $_POST['currency'] ?? 'coins';
-        $amount = (int)($_POST['amount'] ?? 0);
-
-        if ($amount <= 0) {
-            Response::error('يجب إدخال مبلغ صحيح', "/players/{$id}");
-            return;
-        }
-
-        $player = $this->db->selectOne('profiles', ['id' => "eq.{$id}"]);
-        $newBalance = ($player[$currency] ?? 0) + $amount;
-
-        $this->db->update('profiles', ['id' => "eq.{$id}"], [$currency => $newBalance]);
-        $this->db->insert('economy_transactions', [
-            'player_id' => $id,
-            'type' => 'credit',
-            'currency' => $currency,
-            'amount' => $amount,
-            'balance_after' => $newBalance,
-            'reason' => trim($_POST['reason'] ?? 'منح بواسطة الإدارة'),
-            'source_id' => 'admin:' . Auth::user()['username'],
-        ]);
-
-        AuditLog::log('grant', 'player', $id, null, ['currency' => $currency, 'amount' => $amount]);
-        Response::success("تم منح {$amount} {$currency}", "/players/{$id}");
+        $this->adjust($id, (string)($_POST['currency'] ?? 'coins'), (int)($_POST['amount'] ?? 0), trim($_POST['reason'] ?? ''), "/players/{$id}");
     }
 
     public function revoke(array $params, string $method): void
     {
         Auth::requireCsrf();
         $id = $params['id'];
-        $currency = $_POST['currency'] ?? 'coins';
-        $amount = (int)($_POST['amount'] ?? 0);
-
-        if ($amount <= 0) {
-            Response::error('يجب إدخال مبلغ صحيح', "/players/{$id}");
-            return;
-        }
-
-        $player = $this->db->selectOne('profiles', ['id' => "eq.{$id}"]);
-        $currentBalance = $player[$currency] ?? 0;
+        $this->adjust($id, (string)($_POST['currency'] ?? 'coins'), -(int)($_POST['amount'] ?? 0), trim($_POST['reason'] ?? ''), "/players/{$id}");
+    }
 
-        if ($amount > $currentBalance) {
-            Response::error('الرصيد غير كاف', "/players/{$id}");
+    /** Grant (positive) or revoke (negative) coins or gems, atomically, and tell the player. */
+    private function adjust(string $id, string $currency, int $amount, string $reason, string $back): void
+    {
+        $result = EconomyService::adjust($id, $currency, $amount, $reason);
+        if (!$result['ok']) {
+            Response::error($result['error'], $back);
             return;
         }
-
-        $newBalance = $currentBalance - $amount;
-        $this->db->update('profiles', ['id' => "eq.{$id}"], [$currency => $newBalance]);
-        $this->db->insert('economy_transactions', [
-            'player_id' => $id,
-            'type' => 'debit',
-            'currency' => $currency,
-            'amount' => -$amount,
-            'balance_after' => $newBalance,
-            'reason' => trim($_POST['reason'] ?? 'سحب بواسطة الإدارة'),
-            'source_id' => 'admin:' . Auth::user()['username'],
-        ]);
-
-        AuditLog::log('revoke', 'player', $id, null, ['currency' => $currency, 'amount' => $amount]);
-        Response::success("تم سحب {$amount} {$currency}", "/players/{$id}");
+        AuditLog::log($amount > 0 ? 'grant' : 'revoke', 'player', $id, null, ['currency' => $currency, 'amount' => $amount, 'balance' => $result['balance']]);
+        Response::success($result['message'], $back);
     }
 
     public function uploadAvatar(array $params, string $method): void

modules/players/views/form.php

@@ -32,11 +32,27 @@
             </div>
         </div>
 
+        <?php if (empty($player['id'])): ?>
+        <div class="grid grid-2 gap-4">
+            <div class="form-group">
+                <label class="form-label">البريد الإلكتروني *</label>
+                <input type="email" name="email" class="form-input" required dir="ltr">
+                <span class="form-hint">يُنشأ به حساب دخول للاعب</span>
+                <span class="form-error"></span>
+            </div>
+            <div class="form-group">
+                <label class="form-label">كلمة المرور</label>
+                <input type="text" name="password" class="form-input" minlength="8" dir="ltr" autocomplete="new-password">
+                <span class="form-hint">اتركها فارغة لتوليد كلمة مؤقتة تظهر بعد الحفظ</span>
+            </div>
+        </div>
+        <?php else: ?>
         <div class="form-group">
             <label class="form-label">البريد الإلكتروني</label>
-            <input type="email" name="email" class="form-input" value="<?= View::e($player['email'] ?? '') ?>" dir="ltr">
-            <span class="form-error"></span>
+            <input type="email" class="form-input" value="<?= View::e($player['email'] ?? '') ?>" dir="ltr" disabled>
+            <span class="form-hint">بريد الدخول جزء من حساب اللاعب ولا يُعدّل من هنا</span>
         </div>
+        <?php endif; ?>
 
         <div class="grid grid-2 gap-4">
             <div class="form-group">