Merge pull request 'Promotion preprod → prod : contrats/kills, factions, tech-tree, assurance payout, Fortuna Pass' (#1) from preprod into main

- CompleteInventoryUpdate: insured items lost in a raid (present in
  ItemsToRemove) are recovered back to the stash and the insurance is
  consumed. This is the payout counterpart to the premium already
  debited on deploy (EnterMatchmakingStation). Gated on the policy
  declaring a positive Payout; never fails the inventory commit.
- RequestClaimFortunaPassRewards: log the client-sent reward IDs so a
  real FortunaPass{2,3}_Rewards catalog can be built to match, and stop
  recording a reward as claimed when there is no catalog entry to grant
  (previously it was burned permanently and became unclaimable).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -0,0 +1,33 @@
+name: Build & Deploy
+
+on:
+  push:
+    branches: [main, preprod]
+  workflow_dispatch: {}
+
+env:
+  IMAGE: git.nfteam.ovh/neckfire/the-cycle
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Build & push image
+        run: |
+          set -e
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.nfteam.ovh -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+          SHA="${GITHUB_SHA::12}"
+          BRANCH="${GITHUB_REF_NAME}"
+          if [ "$BRANCH" = "main" ]; then TAGS="-t ${IMAGE}:latest -t ${IMAGE}:${SHA}"; else TAGS="-t ${IMAGE}:${BRANCH} -t ${IMAGE}:${BRANCH}-${SHA}"; fi
+          docker build $TAGS -f Dockerfile .
+          docker push --all-tags "${IMAGE}"
+      - name: Notify ntfy
+        if: always()
+        run: |
+          if [ "${{ job.status }}" = "success" ]; then EMOJI="white_check_mark"; PRIO="default"; else EMOJI="rotating_light"; PRIO="high"; fi
+          curl -s -H "Authorization: Bearer ${{ secrets.NTFY_TOKEN }}" -H "Title: ${GITHUB_REPOSITORY} — ${{ job.status }}" \
+            -H "Priority: ${PRIO}" -H "Tags: ${EMOJI}" -H "Click: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions" \
+            -d "${GITHUB_WORKFLOW} (${GITHUB_REF_NAME} #${GITHUB_RUN_NUMBER}) : ${{ job.status }}" \
+            "${{ secrets.NTFY_URL }}/${{ secrets.NTFY_TOPIC }}" || true

.gitignore

@@ -0,0 +1 @@
+_out/

Dockerfile

@@ -0,0 +1,15 @@
+# The Cycle: Frontier — serveur API (émulateur Prospect), build depuis les sources.
+# Multi-stage : SDK .NET 8 pour publier le projet API → runtime aspnet 8.
+FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+WORKDIR /src
+COPY src/ ./src/
+# Configuration "Season 2 Release" = build qui correspond au client S2 déployé
+# (le code sélectionne la saison via des #if SEASON_2_RELEASE / SEASON_3_RELEASE).
+RUN dotnet publish src/Prospect.Server.Api/Prospect.Server.Api.csproj \
+      -c "Season 2 Release" -o /app
+
+FROM mcr.microsoft.com/dotnet/aspnet:8.0
+WORKDIR /app
+COPY --from=build /app ./
+EXPOSE 8443 8000
+ENTRYPOINT ["dotnet", "Prospect.Server.Api.dll"]

src/Prospect.Server.Api/Services/CloudScript/Functions/ClaimActiveContract.cs

@@ -131,6 +131,12 @@ public class ClaimActiveContract : ICloudScriptFunction<FYClaimCompletedActiveCo
                         break;
                     }
                 }
+            } else if (objective.Type == EYContractObjectiveType.Kills) {
+                // Kill objectives can't be tracked in a client-hosted raid (no dedicated
+                // game server reports kills). They are auto-credited on deploy
+                // (EnterMatchmakingMatch); accept them here even if a contract was
+                // activated before that so kill contracts remain completable.
+                remaining = 0;
             } else {
                 // NOTE: A game server must write the correct progress
                 // for other types of objectives.

src/Prospect.Server.Api/Services/CloudScript/Functions/CompleteInventoryUpdate.cs

@@ -2,6 +2,7 @@ using System.Text.Json;
 using System.Text.Json.Serialization;
 using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.CloudScript;
+using Prospect.Server.Api.Services.CloudScript.Functions;
 using Prospect.Server.Api.Services.CloudScript.Models;
 using Prospect.Server.Api.Services.UserData;
 
@@ -45,12 +46,14 @@ public class CompleteInventoryUpdateFunction : ICloudScriptFunction<CompleteInve
     private readonly ILogger<CompleteInventoryUpdateFunction> _logger;
     private readonly IHttpContextAccessor _httpContextAccessor;
     private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
 
-    public CompleteInventoryUpdateFunction(ILogger<CompleteInventoryUpdateFunction> logger, IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
+    public CompleteInventoryUpdateFunction(ILogger<CompleteInventoryUpdateFunction> logger, IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService)
     {
         _logger = logger;
         _httpContextAccessor = httpContextAccessor;
         _userDataService = userDataService;
+        _titleDataService = titleDataService;
     }
 
     public async Task<CompleteInventoryUpdateResponse> ExecuteAsync(CompleteInventoryUpdateRequest request)
@@ -64,6 +67,42 @@ public class CompleteInventoryUpdateFunction : ICloudScriptFunction<CompleteInve
         var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"Inventory"});
         var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value);
 
+        // Insurance payout: this request also reports the end-of-match inventory, so items
+        // the player lost (death / left behind) arrive in ItemsToRemove. Any of those that
+        // were insured on deploy (EnterMatchmakingStation) are recovered back to the stash —
+        // the premium was already paid up-front — and the insurance is consumed (one raid).
+        // Recovery is only performed if the item's policy declares a positive Payout.
+        var recoveredInsured = new HashSet<string>();
+        if (request.ItemsToRemove is { Count: > 0 })
+        {
+            try
+            {
+                var td = _titleDataService.Find(new List<string> { "InventoryInsurance" });
+                if (td.TryGetValue("InventoryInsurance", out var rawPolicies) && !string.IsNullOrEmpty(rawPolicies))
+                {
+                    var policies = JsonSerializer.Deserialize<Dictionary<string, InventoryInsurancePolicy>>(rawPolicies);
+                    foreach (var item in inventory)
+                    {
+                        if (!request.ItemsToRemove.Contains(item.ItemId)) continue;
+                        if (string.IsNullOrEmpty(item.Insurance) || item.InsuranceOwnerPlayfabId != userId) continue;
+                        if (policies == null || !policies.TryGetValue(item.Insurance, out var policy) || policy.Payout <= 0) continue;
+                        recoveredInsured.Add(item.ItemId);
+                        item.Insurance = "";              // consumed for this raid
+                        item.InsuranceOwnerPlayfabId = "";
+                    }
+                    if (recoveredInsured.Count > 0)
+                    {
+                        _logger.LogInformation("Recovered {Count} insured item(s) for user {User}", recoveredInsured.Count, userId);
+                    }
+                }
+            }
+            catch (Exception e)
+            {
+                // Never fail the inventory commit because of insurance handling.
+                _logger.LogWarning(e, "Failed to process insurance payout");
+            }
+        }
+
         // TODO: Optimize
         // TODO: Check deleted items to see if other stacks/mods were updated correctly
         // Process inventory update. The player may:
@@ -74,7 +113,8 @@ public class CompleteInventoryUpdateFunction : ICloudScriptFunction<CompleteInve
         // IMPORTANT: The same request is currently used to report the updated inventory in the end of match.
         var newInventory = new List<FYCustomItemInfo>(inventory.Count);
         foreach (var item in inventory) {
-            if (!request.ItemsToRemove.Contains(item.ItemId)) {
+            // Keep items that weren't removed, plus insured items recovered above.
+            if (!request.ItemsToRemove.Contains(item.ItemId) || recoveredInsured.Contains(item.ItemId)) {
                 newInventory.Add(item);
             }
         }

src/Prospect.Server.Api/Services/CloudScript/Functions/EnterMatchmakingMatch.cs

@@ -61,6 +61,14 @@ public class EnterMatchmakingMatchFunction : ICloudScriptFunction<FYEnterMatchAz
             }
             for (var i = 0; i < contract.Objectives.Length; i++) {
                 var objective = contract.Objectives[i];
+                // Kill objectives: the client-hosted raid has no dedicated game server
+                // to report per-kill progress to the backend, so kills would never be
+                // saved. Auto-credit them on deploy so the objective can be completed
+                // (mirrors the player-kill auto-credit done in ActivateContract).
+                if (objective.Type == EYContractObjectiveType.Kills) {
+                    contractActive.Progress[i] = objective.MaxProgress;
+                    continue;
+                }
                 if (objective.Type != EYContractObjectiveType.OwnNumOfItem) {
                     continue;
                 }

src/Prospect.Server.Api/Services/CloudScript/Functions/EnterMatchmakingStation.cs

@@ -1,18 +1,107 @@
-using Prospect.Server.Api.Services.CloudScript.Models;
+using System.Text.Json;
+using Prospect.Server.Api.Models.Data;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.CloudScript.Models.Data;
+using Prospect.Server.Api.Services.UserData;
 
 namespace Prospect.Server.Api.Services.CloudScript.Functions;
 
+// Config d'une police d'assurance (TitleData "InventoryInsurance").
+public class InventoryInsurancePolicy
+{
+    public string InsuranceId { get; set; }
+    public double Cost { get; set; }
+    public double Payout { get; set; }
+}
+
 [CloudScriptFunction("EnterMatchmakingStation")]
 public class EnterMatchmakingStationFunction : ICloudScriptFunction<FYEnterMatchAzureFunction, FYEnterMatchmakingResult>
 {
-    public Task<FYEnterMatchmakingResult> ExecuteAsync(FYEnterMatchAzureFunction request)
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+    private readonly ILogger<EnterMatchmakingStationFunction> _logger;
+
+    public EnterMatchmakingStationFunction(
+        IHttpContextAccessor httpContextAccessor,
+        UserDataService userDataService,
+        TitleDataService titleDataService,
+        ILogger<EnterMatchmakingStationFunction> logger)
     {
-        return Task.FromResult(new FYEnterMatchmakingResult
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+        _logger = logger;
+    }
+
+    public async Task<FYEnterMatchmakingResult> ExecuteAsync(FYEnterMatchAzureFunction request)
+    {
+        // Au déploiement, le client peut demander d'assurer une partie de l'inventaire.
+        var insurance = request.PurchaseInventoryInsurances;
+        var context = _httpContextAccessor.HttpContext;
+        if (context != null && insurance?.ItemIds is { Count: > 0 })
+        {
+            try
+            {
+                await ApplyInsuranceAsync(context.User.FindAuthUserId(), insurance);
+            }
+            catch (Exception e)
+            {
+                // Ne jamais bloquer le déploiement à cause de l'assurance.
+                _logger.LogWarning(e, "Failed to apply inventory insurance on deploy");
+            }
+        }
+
+        return new FYEnterMatchmakingResult
         {
             Success = true,
             ErrorMessage = "",
             SingleplayerStation = true, // NOTE: This will always travel to single player station
             IsMatchTravel = false,
+        };
+    }
+
+    // Marque les items choisis comme assurés (Insurance + propriétaire) et débite la
+    // prime en InsuranceCurrency selon le coût de la police (TitleData InventoryInsurance).
+    private async Task ApplyInsuranceAsync(string userId, FYPurchaseInventoryInsuranceRequest req)
+    {
+        var titleData = _titleDataService.Find(new List<string> { "InventoryInsurance" });
+        var policies = JsonSerializer.Deserialize<Dictionary<string, InventoryInsurancePolicy>>(titleData["InventoryInsurance"]);
+        var insuranceId = string.IsNullOrEmpty(req.InsuranceId) ? "Default" : req.InsuranceId;
+        if (policies == null || !policies.TryGetValue(insuranceId, out var policy))
+        {
+            _logger.LogWarning("Unknown insurance policy {InsuranceId}", insuranceId);
+            return;
+        }
+
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string> { "Inventory", "Balance" });
+        var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value);
+        var balance = JsonSerializer.Deserialize<PlayerBalance>(userData["Balance"].Value);
+
+        var toInsure = new HashSet<string>(req.ItemIds);
+        var insuredCount = 0;
+        foreach (var item in inventory)
+        {
+            if (!toInsure.Contains(item.ItemId)) continue;
+            item.Insurance = insuranceId;
+            item.InsuranceOwnerPlayfabId = userId;
+            insuredCount++;
+        }
+        if (insuredCount == 0) return;
+
+        // Prime = coût de la police × nombre d'items assurés (arrondi au supérieur),
+        // plafonnée au solde disponible pour ne jamais passer en négatif.
+        var premium = (int)Math.Ceiling(policy.Cost * insuredCount);
+        premium = Math.Min(premium, balance.InsuranceCurrency);
+        balance.InsuranceCurrency -= premium;
+
+        await _userDataService.UpdateAsync(userId, userId, new Dictionary<string, string>
+        {
+            ["Inventory"] = JsonSerializer.Serialize(inventory),
+            ["Balance"] = JsonSerializer.Serialize(balance),
         });
+        _logger.LogInformation("Insured {Count} item(s) under policy {Policy} for user {User} (premium {Premium})",
+            insuredCount, insuranceId, userId, premium);
     }
 }

src/Prospect.Server.Api/Services/CloudScript/Functions/PurchaseWeaponShopItem.cs

@@ -3,6 +3,7 @@ using System.Text.Json.Serialization;
 using Prospect.Server.Api.Models.Data;
 using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.CloudScript;
+using Prospect.Server.Api.Services.CloudScript.Functions;
 using Prospect.Server.Api.Services.UserData;
 
 public class PurchaseWeaponShopItemRequest
@@ -137,7 +138,7 @@ public class PurchaseWeaponShopItemFunction : ICloudScriptFunction<PurchaseWeapo
                 Error = "Invalid purchase amount",
             };
         }
-        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"Inventory", "Balance"});
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"Inventory", "Balance", "ContractsOneTimeCompleted"});
         var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value);
         var balance = JsonSerializer.Deserialize<PlayerBalance>(userData["Balance"].Value);
         var blueprintsData = _titleDataService.Find(new List<string>{"Blueprints"});
@@ -153,7 +154,21 @@ public class PurchaseWeaponShopItemFunction : ICloudScriptFunction<PurchaseWeapo
 
         var blueprintData = blueprints[request.BaseItemID];
 
-        // TODO: Contract unlock criteria
+        // Contract unlock criteria: some items can only be purchased after completing a
+        // specific contract. Only gate when the item explicitly declares such a lock, so
+        // items with no lock keep working as before.
+        if (!string.IsNullOrEmpty(blueprintData.UnlockData?.ContractLockPurchase))
+        {
+            var completed = JsonSerializer.Deserialize<FYGetCompletedContractsResult>(userData["ContractsOneTimeCompleted"].Value);
+            if (completed?.ContractsIDs == null || !completed.ContractsIDs.Contains(blueprintData.UnlockData.ContractLockPurchase))
+            {
+                return new PurchaseWeaponShopItemResponse
+                {
+                    UserID = userId,
+                    Error = "Item is locked: complete the required contract first",
+                };
+            }
+        }
 
         // Validate price
         var shopCraftingData = blueprintData.ItemShopsCraftingData[request.ShopItemBelongsTo];

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestClaimFortunaPassRewards.cs

@@ -1,5 +1,6 @@
 using System.Text.Json;
 using System.Text.Json.Serialization;
+using Prospect.Server.Api.Models.Data;
 using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.CloudScript;
 using Prospect.Server.Api.Services.UserData;
@@ -9,6 +10,15 @@ public class FYFortunaPassClaimedRewards {
 	public List<string> RewardsIDs { get; set; }
 };
 
+// Récompense d'un palier de la passe (catalogue optionnel TitleData "FortunaPass2_Rewards").
+// itemId "SoftCurrency"/"Aurum"/"InsuranceCurrency" = monnaie, sinon item d'inventaire.
+public class FortunaPassRewardDef {
+    [JsonPropertyName("itemId")]
+    public string ItemId { get; set; }
+    [JsonPropertyName("amount")]
+    public int Amount { get; set; }
+}
+
 public class RequestClaimFortunaPassRewardsRequest
 {
     [JsonPropertyName("rewardsIds")]
@@ -34,11 +44,15 @@ public class RequestClaimFortunaPassRewardsFunction : ICloudScriptFunction<Reque
 {
     private readonly IHttpContextAccessor _httpContextAccessor;
     private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+    private readonly ILogger<RequestClaimFortunaPassRewardsFunction> _logger;
 
-    public RequestClaimFortunaPassRewardsFunction(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
+    public RequestClaimFortunaPassRewardsFunction(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService, ILogger<RequestClaimFortunaPassRewardsFunction> logger)
     {
         _httpContextAccessor = httpContextAccessor;
         _userDataService = userDataService;
+        _titleDataService = titleDataService;
+        _logger = logger;
     }
 
     public async Task<RequestClaimFortunaPassRewardsResponse> ExecuteAsync(RequestClaimFortunaPassRewardsRequest request)
@@ -49,28 +63,103 @@ public class RequestClaimFortunaPassRewardsFunction : ICloudScriptFunction<Reque
             throw new CloudScriptException("CloudScript was not called within a http request");
         }
         var userId = context.User.FindAuthUserId();
-        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"FortunaPass2_ClaimedRewards"});
+
-        var claimedRewards = JsonSerializer.Deserialize<FYFortunaPassClaimedRewards>(userData["FortunaPass2_ClaimedRewards"].Value);
+        // Clé de la saison courante (déterminée par la config de build) — évite d'écraser
-        foreach (var rewardId in request.RewardsIDs) {
+        // la progression de l'autre saison (l'ancien code écrasait S2 ET S3).
+#if SEASON_3_RELEASE || SEASON_3_DEBUG
+        const string claimedKey = "FortunaPass3_ClaimedRewards";
+        const string rewardsCatalogKey = "FortunaPass3_Rewards";
+#else
+        const string claimedKey = "FortunaPass2_ClaimedRewards";
+        const string rewardsCatalogKey = "FortunaPass2_Rewards";
+#endif
+
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{ claimedKey, "Inventory", "Balance" });
+        var claimedRewards = JsonSerializer.Deserialize<FYFortunaPassClaimedRewards>(userData[claimedKey].Value)
+            ?? new FYFortunaPassClaimedRewards { RewardsIDs = new List<string>() };
+        claimedRewards.RewardsIDs ??= new List<string>();
+
+        // Catalogue des récompenses (optionnel) : rewardId -> {itemId, amount}.
+        Dictionary<string, FortunaPassRewardDef> catalog = null;
+        try
+        {
+            var td = _titleDataService.Find(new List<string> { rewardsCatalogKey });
+            if (td.TryGetValue(rewardsCatalogKey, out var raw) && !string.IsNullOrWhiteSpace(raw))
+                catalog = JsonSerializer.Deserialize<Dictionary<string, FortunaPassRewardDef>>(raw);
+        }
+        catch { /* pas de catalogue → on enregistre seulement la réclamation */ }
+
+        var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value) ?? new List<FYCustomItemInfo>();
+        var balance = JsonSerializer.Deserialize<PlayerBalance>(userData["Balance"].Value);
+        var grantedItems = new List<FYCustomItemInfo>();
+        var changedCurrencies = new List<FYCurrencyItem>();
+
+        foreach (var rewardId in request.RewardsIDs)
+        {
+            // Ne pas re-créditer un palier déjà réclamé.
+            if (claimedRewards.RewardsIDs.Contains(rewardId)) continue;
+
+            if (catalog == null || !catalog.TryGetValue(rewardId, out var def) || def == null)
+            {
+                // Le catalogue des paliers est défini côté client (DataTable). On journalise
+                // les IDs inconnus pour pouvoir construire un vrai catalogue FortunaPass{2,3}_Rewards
+                // qui matche. IMPORTANT : ne PAS marquer le palier comme réclamé si on ne peut rien
+                // accorder — sinon il serait brûlé définitivement et inclaimable une fois le
+                // catalogue ajouté.
+                _logger.LogInformation("FortunaPass claim: aucun catalogue pour le reward '{RewardId}' (catalogue {State}) — non accordé", rewardId, catalog == null ? "absent" : "présent");
+                continue;
+            }
+
             claimedRewards.RewardsIDs.Add(rewardId);
+            _logger.LogInformation("FortunaPass claim: octroi reward '{RewardId}' -> {ItemId} x{Amount}", rewardId, def.ItemId, def.Amount);
+
+            switch (def.ItemId)
+            {
+                case "SoftCurrency":
+                    balance.SoftCurrency += def.Amount;
+                    changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "SoftCurrency", Amount = balance.SoftCurrency });
+                    break;
+                case "Aurum":
+                    balance.HardCurrency += def.Amount;
+                    changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "Aurum", Amount = balance.HardCurrency });
+                    break;
+                case "InsuranceCurrency":
+                    balance.InsuranceCurrency += def.Amount;
+                    changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "InsuranceCurrency", Amount = balance.InsuranceCurrency });
+                    break;
+                default:
+                    var item = new FYCustomItemInfo {
+                        ItemId = Guid.NewGuid().ToString(),
+                        Amount = def.Amount <= 0 ? 1 : def.Amount,
+                        BaseItemId = def.ItemId,
+                        Durability = 0,
+                        Insurance = "",
+                        InsuranceOwnerPlayfabId = "",
+                        ModData = new FYModItems { M = [] },
+                        Origin = new FYItemOriginBackend { G = "", P = "", T = "" },
+                        InsuredAttachmentId = "",
+                        PrimaryVanityId = 0,
+                        SecondaryVanityId = 0,
+                        RolledPerks = [],
+                    };
+                    inventory.Add(item);
+                    grantedItems.Add(item);
+                    break;
+            }
         }
 
-        var output = JsonSerializer.Serialize(claimedRewards);
+        var changes = new Dictionary<string, string> { [claimedKey] = JsonSerializer.Serialize(claimedRewards) };
-        await _userDataService.UpdateAsync(
+        if (grantedItems.Count > 0) changes["Inventory"] = JsonSerializer.Serialize(inventory);
-            userId, userId,
+        if (changedCurrencies.Count > 0) changes["Balance"] = JsonSerializer.Serialize(balance);
-            new Dictionary<string, string>{
+        await _userDataService.UpdateAsync(userId, userId, changes);
-                ["FortunaPass2_ClaimedRewards"] = output,
-                ["FortunaPass3_ClaimedRewards"] = output, // TODO: Separate logic for S2 and S3
-            }
-        );
 
         return new RequestClaimFortunaPassRewardsResponse
         {
             UserId = userId,
             ErrorType = 3, // EYFortunaPassToastReponseType::Ok
             Error = "",
-            GrantedItems = [],
+            GrantedItems = grantedItems.ToArray(),
-            ChangedCurrencies = [],
+            ChangedCurrencies = changedCurrencies.ToArray(),
         };
     }
 }

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestFactionProgression.cs

@@ -1,5 +1,7 @@
-using Prospect.Server.Api.Services.Auth.Extensions;
+using System.Text.Json;
+using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.UserData;
 
 namespace Prospect.Server.Api.Services.CloudScript.Functions;
 
@@ -7,42 +9,43 @@ namespace Prospect.Server.Api.Services.CloudScript.Functions;
 public class RequestFactionProgression : ICloudScriptFunction<FYQueryFactionProgressionRequest, object?>
 {
     private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
 
-    public RequestFactionProgression(IHttpContextAccessor httpContextAccessor)
+    public RequestFactionProgression(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
     {
         _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
     }
 
-    public Task<object?> ExecuteAsync(FYQueryFactionProgressionRequest request)
+    public async Task<object?> ExecuteAsync(FYQueryFactionProgressionRequest request)
     {
         var context = _httpContextAccessor.HttpContext;
         if (context == null)
         {
-            return Task.FromResult<object?>(null);
+            return null;
         }
+        var userId = context.User.FindAuthUserId();
 
-        return Task.FromResult<object?>(new
+        var userData = await _userDataService.FindAsync(
+            userId, userId,
+            new List<string> { "FactionProgressionICA", "FactionProgressionKorolev", "FactionProgressionOsiris" }
+        );
+
+        int Progression(string faction) =>
+            userData.TryGetValue("FactionProgression" + faction, out var v) && v.Value != null
+                ? JsonSerializer.Deserialize<int>(v.Value)
+                : 0;
+
+        return new
         {
-            factions = new []
+            factions = new[]
             {
-                new
+                new { factionId = "ICA", currentProgression = Progression("ICA") },
-                {
+                new { factionId = "Korolev", currentProgression = Progression("Korolev") },
-                    factionId = "ICA",
+                new { factionId = "Osiris", currentProgression = Progression("Osiris") },
-                    currentProgression = 0
-                },
-                new
-                {
-                    factionId = "Korolev",
-                    currentProgression = 0
-                },
-                new
-                {
-                    factionId = "Osiris",
-                    currentProgression = 0
-                },
             },
-            userId = context.User.FindAuthUserId(),
+            userId,
             error = ""
-        });
+        };
     }
 }

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestPlayerContracts.cs

@@ -1,100 +1,119 @@
-using Prospect.Server.Api.Services.Auth.Extensions;
+using System.Text.Json;
+using Prospect.Server.Api.Models.Data;
+using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.CloudScript.Models;
 using Prospect.Server.Api.Services.CloudScript.Models.Data;
+using Prospect.Server.Api.Services.UserData;
 
 namespace Prospect.Server.Api.Services.CloudScript.Functions;
 
 [CloudScriptFunction("RequestPlayerContracts")]
 public class RequestPlayerContracts : ICloudScriptFunction<FYGetPlayerContractsRequest, FYGetPlayerContractsResult>
 {
-    private readonly IHttpContextAccessor _httpContextAccessor;
+    // Board slots are ordered Easy / Medium / Hard (same convention as ClaimActiveContract).
+    private static readonly string[] Difficulties = ["Easy", "Medium", "Hard"];
+    private const int RefreshHours = 12;
 
-    public RequestPlayerContracts(IHttpContextAccessor httpContextAccessor)
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+    private readonly Random _rnd = new();
+
+    public RequestPlayerContracts(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService)
     {
         _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
     }
 
-    public Task<FYGetPlayerContractsResult> ExecuteAsync(FYGetPlayerContractsRequest request)
+    public async Task<FYGetPlayerContractsResult> ExecuteAsync(FYGetPlayerContractsRequest request)
     {
         var context = _httpContextAccessor.HttpContext;
         if (context == null)
         {
             throw new CloudScriptException("CloudScript was not called within a http request");
         }
+        var userId = context.User.FindAuthUserId();
 
-        return Task.FromResult(new FYGetPlayerContractsResult
+        var userData = await _userDataService.FindAsync(
+            userId, userId,
+            new List<string>
+            {
+                "ContractsActive", "JobBoardsData",
+                "FactionProgressionKorolev", "FactionProgressionICA", "FactionProgressionOsiris",
+            }
+        );
+
+        var contractsActive = JsonSerializer.Deserialize<FYGetActiveContractsResult>(userData["ContractsActive"].Value)!;
+        var jobBoardsData = JsonSerializer.Deserialize<JobBoardsData>(userData["JobBoardsData"].Value)!;
+
+        var titleData = _titleDataService.Find(new List<string> { "Contracts", "Jobs", "LevelData" });
+        var contracts = JsonSerializer.Deserialize<Dictionary<string, TitleDataContractInfo>>(titleData["Contracts"])!;
+        var jobs = JsonSerializer.Deserialize<Dictionary<string, Dictionary<string, string[]>>>(titleData["Jobs"])!;
+        var levelsData = JsonSerializer.Deserialize<Dictionary<string, int[]>>(titleData["LevelData"])!;
+
+        var now = (int)DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+        var lastRefresh = jobBoardsData.LastBoardRefreshTimeUtc?.Seconds ?? 0;
+
+        // Initial fill only: populate boards that were seeded empty / never refreshed.
+        // The periodic rotation is owned by RequestActiveObjectivesAndBoardsData, so we
+        // don't refresh on a timer here to avoid two competing refresh policies.
+        var boardsEmpty = jobBoardsData.Boards == null
+            || jobBoardsData.Boards.Any(b => b.Contracts == null
+                || b.Contracts.Any(c => string.IsNullOrEmpty(c.ContractId)));
+
+        if (jobBoardsData.Boards != null && (lastRefresh == 0 || boardsEmpty))
         {
-            UserId = context.User.FindAuthUserId(),
+            foreach (var board in jobBoardsData.Boards)
+            {
+                if (board.Contracts == null || !jobs.TryGetValue(board.FactionId, out var factionJobs))
+                {
+                    continue;
+                }
+
+                var factionKey = "FactionProgression" + board.FactionId;
+                var factionProgression = userData.TryGetValue(factionKey, out var fp)
+                    ? JsonSerializer.Deserialize<int>(fp.Value)
+                    : 0;
+
+                var level = levelsData.TryGetValue(board.FactionId, out var levels)
+                    ? levels.Length - Array.FindIndex(levels, xp => factionProgression >= xp)
+                    : 0;
+
+                for (var idx = 0; idx < board.Contracts.Count && idx < Difficulties.Length; idx++)
+                {
+                    if (!factionJobs.TryGetValue(Difficulties[idx], out var difficultyJobs))
+                    {
+                        continue;
+                    }
+                    var available = Array.FindAll(difficultyJobs,
+                        jobId => contracts.TryGetValue(jobId, out var c) && level >= c.UnlockData.Level);
+                    if (available.Length > 0)
+                    {
+                        board.Contracts[idx].ContractId = available[_rnd.Next(available.Length)];
+                    }
+                }
+            }
+
+            jobBoardsData.LastBoardRefreshTimeUtc = new FYTimestamp { Seconds = now };
+
+            await _userDataService.UpdateAsync(
+                userId, userId,
+                new Dictionary<string, string> { ["JobBoardsData"] = JsonSerializer.Serialize(jobBoardsData) }
+            );
+        }
+
+        return new FYGetPlayerContractsResult
+        {
+            UserId = userId,
             Error = null,
-            ActiveContracts = new List<FYActiveContractPlayerData>(),
+            ActiveContracts = contractsActive.Contracts,
             FactionsContracts = new FYFactionsContractsData
             {
-                Boards = new List<FYFactionContractsData>
+                Boards = jobBoardsData.Boards,
-                {
+                LastBoardRefreshTimeUtc = jobBoardsData.LastBoardRefreshTimeUtc ?? new FYTimestamp { Seconds = now },
-                    new FYFactionContractsData
-                    {
-                        FactionId = "ICA",
-                        Contracts = new List<FYFactionContractData>
-                        {
-                            new FYFactionContractData
-                            {
-                                ContractId = "NEW-Easy-ICA-Gather-1",
-                            },
-                            new FYFactionContractData
-                            {
-                                ContractId = "NEW-Medium-ICA-Uplink-1",
-                            },
-                            new FYFactionContractData
-                            {
-                                ContractId = "NEW-Hard-ICA-Uplink-1",
-                            }
-                        }
-                    },
-                    new FYFactionContractsData
-                    {
-                        FactionId = "Korolev",
-                        Contracts = new List<FYFactionContractData>
-                        {
-                            new FYFactionContractData
-                            {
-                                ContractId = "NEW-Easy-KOR-Mine-4",
-                            },
-                            new FYFactionContractData
-                            {
-                                ContractId = "NEW-Medium-KOR-Mine-1",
-                            },
-                            new FYFactionContractData
-                            {
-                                ContractId = "NEW-Hard-KOR-PvP-6",
-                            }
-                        }
-                    },
-                    new FYFactionContractsData
-                    {
-                        FactionId = "Osiris",
-                        Contracts = new List<FYFactionContractData>
-                        {
-                            new FYFactionContractData
-                            {
-                                ContractId = "NEW-Easy-Osiris-Brightcaps-1",
-                            },
-                            new FYFactionContractData
-                            {
-                                ContractId = "NEW-Medium-Osiris-Gather-1",
-                            },
-                            new FYFactionContractData
-                            {
-                                ContractId = "NEW-Hard-Osiris-Gather-7",
-                            }
-                        }
-                    }
-                },
-                LastBoardRefreshTimeUtc = new FYTimestamp
-                {
-                    Seconds = (int)DateTimeOffset.UtcNow.ToUnixTimeSeconds()
-                }
             },
-            RefreshHours24UtcFromBackend = 12
+            RefreshHours24UtcFromBackend = RefreshHours,
-        });
+        };
     }
 }

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestStoreRotationData.cs

@@ -35,6 +35,11 @@ public class RequestStoreRotationDataFunction : ICloudScriptFunction<RequestStor
         _httpContextAccessor = httpContextAccessor;
     }
 
+    // Nombre de variantes de rotation (les storeId "DailyShop_N" / "WeeklyShop_N"
+    // permettent au client de distinguer chaque rotation et de rafraîchir son cache).
+    private const int DailyVariants = 8;
+    private const int WeeklyVariants = 4;
+
     public async Task<RequestStoreRotationDataResponse> ExecuteAsync(RequestStoreRotationDataRequest request)
     {
         var context = _httpContextAccessor.HttpContext;
@@ -43,18 +48,33 @@ public class RequestStoreRotationDataFunction : ICloudScriptFunction<RequestStor
             throw new CloudScriptException("CloudScript was not called within a http request");
         }
 
-        // TODO: Get and save store rotation data
+        var now = DateTime.UtcNow;
+
+        // Rotation quotidienne : expire au prochain minuit UTC ; l'index de rotation
+        // est le nombre de jours écoulés depuis l'epoch (déterministe, stable).
+        var todayUtc = now.Date;
+        var dailyExpiration = todayUtc.AddDays(1);
+        var dayIndex = (int)(todayUtc - DateTime.UnixEpoch.Date).TotalDays;
+        var dailyStoreId = $"DailyShop_{dayIndex % DailyVariants}";
+
+        // Rotation hebdomadaire : expire au prochain lundi 00:00 UTC.
+        // DayOfWeek : dimanche=0 ; on ramène lundi=0.
+        var daysSinceMonday = ((int)todayUtc.DayOfWeek + 6) % 7;
+        var weekStart = todayUtc.AddDays(-daysSinceMonday);
+        var weeklyExpiration = weekStart.AddDays(7);
+        var weekIndex = (int)Math.Floor((weekStart - DateTime.UnixEpoch.Date).TotalDays / 7);
+        var weeklyStoreId = $"WeeklyShop_{weekIndex % WeeklyVariants}";
 
         return new RequestStoreRotationDataResponse
         {
             Error = "",
             DailyStoreData = new StoreRotationData {
-                StoreID = "DailyShop",
+                StoreID = dailyStoreId,
-                ExpirationData = DateTime.UtcNow.AddDays(1)
+                ExpirationData = dailyExpiration
             },
             WeeklyStoreData = new StoreRotationData {
-                StoreID = "WeeklyShop",
+                StoreID = weeklyStoreId,
-                ExpirationData = DateTime.UtcNow.AddDays(1)
+                ExpirationData = weeklyExpiration
             }
         };
     }

src/Prospect.Server.Api/Services/CloudScript/Functions/StartTechTreeNodeUpgradeClient.cs

@@ -54,7 +54,7 @@ public class StartTechTreeNodeUpgradeClient : ICloudScriptFunction<FYStartTechTr
 
         var userData = await _userDataService.FindAsync(
             userId, userId,
-            new List<string>{"TechTreeNodeData", "Balance", "Inventory"}
+            new List<string>{"TechTreeNodeData", "Balance", "Inventory", "PlayerQuartersLevel"}
         );
 
         var userTechTree = JsonSerializer.Deserialize<UserTechTreeNodeData>(userData["TechTreeNodeData"].Value);
@@ -79,7 +79,15 @@ public class StartTechTreeNodeUpgradeClient : ICloudScriptFunction<FYStartTechTr
         var techTreeNodeData = techTreeNodes[request.NodeID];
         var nextTreeNodeLevel = techTreeNodeData.PerkLevels[currentLevel]; // Tech tree node levels start from 0
 
-        // TODO: Dependency check
+        // Dependency check: the player's quarters must be high enough to unlock this node.
+        var playerQuarters = JsonSerializer.Deserialize<FYPlayerQuarterStatus>(userData["PlayerQuartersLevel"].Value);
+        if (playerQuarters != null && playerQuarters.Level < techTreeNodeData.PlayerQuarterLevelRequired) {
+            return new FYStartTechTreeNodeUpgradeClientResult
+            {
+                UserID = userId,
+                Error = $"Requires player quarters level {techTreeNodeData.PlayerQuarterLevelRequired}",
+            };
+        }
 
         // Validate price
         // TODO: Refactor

src/Prospect.Server.Api/Services/CloudScript/Models/Data/FYPurchaseInventoryInsuranceRequest.cs

@@ -1,7 +1,14 @@
-namespace Prospect.Server.Api.Services.CloudScript.Models.Data;
+using System.Text.Json.Serialization;
 
+namespace Prospect.Server.Api.Services.CloudScript.Models.Data;
+
+// Envoyé par le client au déploiement (dans FYEnterMatchAzureFunction) : quels items
+// de l'inventaire assurer, avec quelle police (voir TitleData "InventoryInsurance").
 public class FYPurchaseInventoryInsuranceRequest
 {
-    // m_insuranceId
+    [JsonPropertyName("insuranceId")]
-    // m_itemIds
+    public string InsuranceId { get; set; }
+
+    [JsonPropertyName("itemIds")]
+    public List<string> ItemIds { get; set; }
 }