game-server: catch-all request capture for squad-invite RE

Log every unrouted POST at Warning [CAPTURE UNROUTED] (reveals native PlayFab endpoints the emulator doesn't implement, e.g. /Group/CreateGroup, /Lobby/*) and every social/squad/invite/friend/matchmaking call (path or body) at Information [CAPTURE SOCIAL]. Lets us pin the exact invite mechanism when reproduced in game. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
friends: richer GetFriendList payload (field aliases) + log returned JSON
2026-07-16 11:45:24 +02:00 · 2026-07-16 09:06:17 +02:00 · 2026-07-15 22:17:34 +02:00 · 2026-07-15 13:54:36 +02:00 · 2026-07-15 11:51:58 +02:00 · 2026-07-15 11:30:22 +02:00
24 changed files with 1045 additions and 250 deletions
@@ -1,222 +1,249 @@
-# Prospect <!-- omit in toc -->
-
-Also known as "The Cycle: Frontier".
-
-## Table of Contents <!-- omit in toc -->
-
- [Features](#features)
- [Running locally](#running-locally)
-  - [1. Prerequisites](#1-prerequisites)
-    - [1.1 How to download Season 2 client from SteamDB using Steam console](#11-how-to-download-season-2-client-from-steamdb-using-steam-console)
-  - [2. Unpack `Prospect.Server.Api`](#2-unpack-prospectserverapi)
-  - [3. Generate and import SSL certificate](#3-generate-and-import-ssl-certificate)
-  - [4. Extract `LoaderPack` to the game](#4-extract-loaderpack-to-the-game)
-  - [5. Run the server](#5-run-the-server)
-  - [6. Run the game](#6-run-the-game)
- [Troubleshooting and FAQ](#troubleshooting-and-faq)
-  - [How to remove the certificate?](#how-to-remove-the-certificate)
-  - [`generate_ssl.exe` is flagged as a virus](#generate_sslexe-is-flagged-as-a-virus)
-  - [Body parts are missing with Season 3 client](#body-parts-are-missing-with-season-3-client)
-  - [Prospect.Server.Api does not start](#prospectserverapi-does-not-start)
-  - [Login Failed. Error code: 3](#login-failed-error-code-3)
-  - [Login Failed. Error code: 5](#login-failed-error-code-5)
- [Development](#development)
+# The Cycle: Frontier — serveur privé (émulateur Prospect)
+
+Émulateur des services en ligne de **The Cycle: Frontier** (jeu retiré de Steam en
+septembre 2022), permettant de rejouer en solo sur un serveur auto-hébergé.
+Fork de [`deiteris/Prospect`](https://github.com/deiteris/Prospect), figé sur le
+**Build 8 / client Saison 2**, buildé depuis les sources et déployé en conteneur via
+une CI Gitea.
+
+> **Ce n'est pas du multijoueur.** Le raid tourne **côté client** (station solo) : chacun
+> joue sa propre instance. Le serveur partage la progression, les comptes et les boutiques,
+> pas la partie. Le vrai multi (squad en raid, voix de proximité) suppose un serveur de jeu
+> Unreal dédié — voir [Hors-périmètre & R&D](#hors-périmètre--rd).
+
+---
+
+## Sommaire
+
+- [Comment ça marche](#comment-ça-marche)
+- [Structure du dépôt](#structure-du-dépôt)
+- [Build & lancement du serveur](#build--lancement-du-serveur)
+- [Certificat TLS](#certificat-tls)
+- [CI/CD](#cicd)
+- [Config du client (switch de serveur + certificat)](#config-du-client-switch-de-serveur--certificat)
+- [État des fonctionnalités](#état-des-fonctionnalités)
+- [Hors-périmètre & R&D](#hors-périmètre--rd)
+- [Crédits & licence](#crédits--licence)
+
+---
+
+## Comment ça marche
+
+Le client officiel parle à PlayFab. On l'intercepte côté client et on le redirige vers
+notre serveur, qui réimplémente juste ce qu'il faut de PlayFab (auth Steam, CloudScript,
+UserData/TitleData, matchmaking solo).
+
+```mermaid
+flowchart LR
+  subgraph client [Poste de jeu]
+    L[Prospect.Client.Loader<br/>injecte l'agent] --> A[Prospect.Agent<br/>hooke l'URL PlayFab]
+    A -- lit --> B[backend.txt]
+    A --> G[Jeu &#40;TCF&#41;]
+  end
+  G -- HTTPS / SignalR --> API[Prospect.Server.Api<br/>émulateur PlayFab]
+  API --> M[(MongoDB)]
+```
+
+- **`Prospect.Client.Loader`** lance le jeu en injectant l'agent.
+- **`Prospect.Agent`** hooke l'URL de l'API PlayFab et la remplace par le contenu de
+  **`backend.txt`** (placé dans `Prospect/Binaries/Win64`). Absent → fallback
+  `https://127.0.0.1:8443`.
+- **`Prospect.Server.Api`** émule PlayFab (auth Steam → JWT, CloudScript, données joueur)
+  et pousse le temps-réel via **SignalR**. Les données vivent dans **MongoDB**.
+
+Toute la redirection du client tient donc dans **une seule valeur** (`backend.txt`) — gérée
+par l'outil [`Prospect.Client.Config`](#config-du-client-switch-de-serveur--certificat).
+
+---
+
+## Structure du dépôt
+
+| Projet | Rôle |
+|---|---|
+| **`Prospect.Server.Api`** | Cœur : émulateur PlayFab (ASP.NET 8). Controllers Client/CloudScript/Multiplayer, services Auth/UserData/TitleData/Database(Mongo)/Qos, hub SignalR. |
+| **`Prospect.Steam`** | Validation du ticket Steam (auth). |
+| **`Prospect.Client.Loader`** | Loader C++ : lance le jeu et injecte l'agent. |
+| **`Prospect.Agent`** | Agent C++ injecté : hooke l'URL PlayFab → `backend.txt`. |
+| **`Prospect.Client.Config`** | Utilitaire multi-OS : écrit `backend.txt`, importe le certificat, lance le jeu. Voir son [README](src/Prospect.Client.Config/README.md). |
+| **`Prospect.Server.Game`** | Serveur de jeu dédié (squelette, **R&D**). |
+| **`Prospect.Unreal[.Generator/.Tests]`** | Réimplémentation C# du netcode Unreal (**R&D** serveur dédié). |
+| `utils/` | `generate_ssl.py` — génération du certificat auto-signé. |

-## Features
+Build config **`Season 2 Release`** obligatoire pour l'API (le code sélectionne la saison
+via `#if SEASON_2_RELEASE` / `SEASON_3_RELEASE` → sinon `#error Unsupported build type`).

-* [x] Basic login with Steam
-* [x] EULA acceptance
-* [x] Tutorial
-* [x] Single-player station (Season 2 and Season 3):
-  * [x] Onboarding
-  * [ ] Matchmaking and deployment
-    * [x] Solo
-    * [ ] Squad
-    * [ ] Items insurance
-    * [ ] Free loadouts (Season 3)
-  * [x] Inventory and loadout
-    * [ ] Loadout presets (Season 3)
-  * [x] Quests
-  * [x] Faction progression
-  * [ ] Season pass
-  * [ ] Aurum Shops
-    * [ ] Daily shop
-    * [ ] Weekly shop
-    * [ ] Shop rotation
-  * [x] Daily login
-  * [x] Character appearance and emotes
-  * [x] Item Shops
-  * [x] Crafting station
-  * [x] Quarters
-  * [x] Player balance
-  * [ ] Social features
-  * [ ] Proximity voice
-    * [x] Vivox login
-    * [x] Vivox create and join channel
-    * [ ] Proximity voice works
-* [x] Game mechanics
-  * [x] Can deploy through terminal
-  * [x] Can deploy with loadout
-  * [x] Can evac
-  * [x] Can do quests (except PvP)
-  * [x] Can gain/lose loot
-  * [x] Can use Alien Forge
-* [x] Map content
-  * [x] Bright Sands
-  * [x] Crescent Falls
-  * [x] Tharis Island
+---

-## Running locally
+## Build & lancement du serveur

-> [!NOTE]
-> If you've already done all steps previously, you can skip to Step 7.
+Le serveur tourne en conteneur. L'image est buildée depuis les sources par le
+[`Dockerfile`](Dockerfile) (multi-stage SDK .NET 8 → runtime aspnet 8, publish en
+`Season 2 Release`).

-### 1. Prerequisites
+### Build de l'image
+
+```bash
+docker build -t the-cycle .
+```
+
+### Lancement
+
+Il faut une **instance MongoDB** joignable et un **certificat TLS** monté (voir section
+suivante). Variables d'environnement :
+
+| Variable | Rôle |
+|---|---|
+| `DatabaseSettings__ConnectionString` | URI de connexion MongoDB. |
+| `DatabaseSettings__DatabaseName` | Base à utiliser (ex. `ProspectDb`). |
+| `AuthTokenSettings__Secret` | Secret de signature des JWT émis par le serveur. |
+| `PlayFabSettings__SignalRURL` | URL SignalR **telle que le client doit l'atteindre** (voir gotcha ci-dessous). |
+| `Kestrel__Certificates__Default__Path` | Chemin du `.pfx` dans le conteneur. |
+| `Kestrel__Endpoints__Https__Url` | ex. `https://0.0.0.0:8443`. |
+| `SteamWebApiKey` | *(optionnel)* clé Steam Web API pour récupérer les pseudos ; inerte si absente. |

-> [!WARNING]
-> The latest Steam version of The Cycle: Frontier currently does not work with Windows 11 24H2!
+```bash
+docker run -d --name the-cycle-api \
+  -e DatabaseSettings__ConnectionString="mongodb://user:pass@HOST:27017/?authSource=ProspectDb" \
+  -e DatabaseSettings__DatabaseName="ProspectDb" \
+  -e AuthTokenSettings__Secret="<secret>" \
+  -e PlayFabSettings__SignalRURL="https://<host-public>:8443/signalr/?hub=pubsub" \
+  -e Kestrel__Endpoints__Https__Url="https://0.0.0.0:8443" \
+  -e Kestrel__Certificates__Default__Path="/certs/certificate.pfx" \
+  -v "$PWD/certs:/certs:ro" \
+  -p 8443:8443 \
+  the-cycle
+```
+
+> ⚠️ **`PlayFabSettings__SignalRURL` = l'URL que le CLIENT doit joindre**, pas `127.0.0.1`.
+> Le serveur y renvoie le client pour l'event de matchmaking ; s'il pointe sur `127.0.0.1`,
+> le déploiement en raid **timeout**. Mets le hostname/IP public du serveur.
+
+### Dev local (.NET)
+
+```bash
+dotnet build src/Prospect.Server.Api/Prospect.Server.Api.csproj -c "Season 2 Release"
+dotnet run  --project src/Prospect.Server.Api -c "Season 2 Release"
+```
+
+---
+
+## Certificat TLS
+
+La connexion est en HTTPS et le client valide le certificat → il doit être **auto-signé et
+fait confiance** côté client. Générer le `.pfx` avec `utils/generate_ssl.py`.
+
+> ⚠️ **Le SAN doit contenir `DNS:<ip>` ET `IP:<ip>`**, en plus des hostnames.
+> Le HTTP du jeu (libcurl) accepte l'IP en SAN IP, mais le WebSocket (libwebsockets) valide
+> l'IP contre les SAN **DNS** → sans `DNS:<ip>`, la connexion SignalR échoue
+> (`Hostname mismatch err=62`). Inclure aussi `2EA46.playfabapi.com`, `localhost`,
+> `127.0.0.1` et tous les hostnames publics utilisés dans `backend.txt`.
+
+Côté client, l'import du certificat est automatisé par
+[`Prospect.Client.Config`](#config-du-client-switch-de-serveur--certificat).

-> [!IMPORTANT]
-> You must have The Cycle: Frontier from Steam in your Steam library to be able to download it.
-> Otherwise, the download will fail with an error message about missing license.
+---

-Before you start, you'll need the following software downloaded and installed:
+## CI/CD

-1. [MongoDB Community Edition](https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-8.0.4-signed.msi).
+[`.gitea/workflows/build.yml`](.gitea/workflows/build.yml) — sur push `main` / `preprod`
+(ou `workflow_dispatch`) :

-1. [`Prospect.Server.Api` and `LoaderPack`](https://github.com/deiteris/Prospect/releases) from the Releases section:
+1. build de l'image depuis le `Dockerfile` ;
+2. push sur le registry `git.nfteam.ovh/neckfire/the-cycle` ;
+3. notification du résultat (ntfy).

-   - For Season 3 (the latest Steam game client), use Build 6.
+**Modèle de branches :**

-   - For Season 2 game client, use the latest version.
+| Branche | Tag image | Usage |
+|---|---|---|
+| `preprod` | `:preprod` (+ `:preprod-<sha>`) | banc de test — valider un build avant de merger |
+| `main` | `:latest` (+ `:<sha>`) | production |

-1. The Cycle: Frontier game client:
+Workflow type : coder → push `preprod` → tester sur le serveur preprod → **PR `preprod → main`**
+→ la CI republie `:latest`. Le déploiement applique la nouvelle image
+(`docker compose pull && docker compose up -d`).

-   - The latest version from [Steam](https://steamcommunity.com/app/868270).
+> `Prospect.Client.Config` (outil client, cross-OS) n'est **pas** buildé par cette CI —
+> voir sa section publication.

-   - Season 2 client version `4623363103423775682` from SteamDB. See [download instructions below](#11-how-to-download-season-2-client-from-steamdb-using-steam-console).
+---

-#### 1.1 How to download Season 2 client from SteamDB using Steam console
+## Config du client (switch de serveur + certificat)

-> [!WARNING]
-> This will overwrite the existing client if you try to download a different manifest!
+L'outil **`Prospect.Client.Config`** (binaire `ProspectServerSwitcher`, multi-OS
+Linux/Proton + Windows) fait tout le boulot côté client :

-1. With Steam running, press `Win+R` and enter `steam://nav/console`. A Steam console will open.
+- écrit `backend.txt` (presets **prod** / **preprod** ou URL libre) ;
+- récupère le certificat **en direct depuis le serveur ciblé** (TLS) et le rend fiable :
+  - **Windows** : import dans *Autorités de certification racines de confiance* (utilisateur) ;
+  - **Linux/Proton** : import direct dans le préfixe Wine du jeu via `wine reg import`
+    (car `wine certutil` est cassé sous Proton) ;
+- lance le jeu.

-1. Open [The Cycle: Frontier SteamDB manifests](https://steamdb.info/depot/868271/manifests/).
+```bash
+# menu interactif
+ProspectServerSwitcher

-1. Make sure you have **Copy format** set to **Steam console**.
+# scriptable
+ProspectServerSwitcher --folder "<...>/Prospect/Binaries/Win64" --set preprod
+ProspectServerSwitcher --set https://mon-serveur:8443
+```

-1. Press `CTRL+F` and enter `4623363103423775682` to find the manifest for Season 2 version 2.7.2 client.
+Détails complets, gotchas Proton (préfixe non-Steam) et commandes de publication des
+binaires autonomes : **[src/Prospect.Client.Config/README.md](src/Prospect.Client.Config/README.md)**.
+
+> Installation complète pas-à-pas pour un nouveau joueur (télécharger le client S2, le
+> LoaderPack, importer le certificat) : **[FRIENDS-INSTALL.md](FRIENDS-INSTALL.md)**.

-1. Click the ![Copy](./_assets/steamdb_copy.PNG) icon to copy the download command.
+---

-1. Paste the command in the Steam console and press `Enter`.
+## État des fonctionnalités

-1. The depot will begin downloading. You should receive a notification and the destination folder when the download is complete.
+**Fonctionne :**

-### 2. Unpack `Prospect.Server.Api`
+- [x] Login Steam, EULA, tutoriel
+- [x] Station solo (S2/S3) : onboarding, matchmaking & déploiement **solo**
+- [x] Inventaire & loadout, stash, vente, réparation
+- [x] Contrats / quêtes — y compris les objectifs **kills** et **de zone** (auto-crédités :
+      pas de serveur dédié pour remonter les events runtime du raid client-hosted)
+- [x] Progression des factions
+- [x] Season pass : claim + gain d'XP de saison (niveau Fortuna)
+- [x] Boutiques d'items (Korolev / ICA / Osiris / QuickShop / CraftingStation)
+- [x] Aurum Shop (cosmétiques) + rotation daily/weekly
+- [x] Craft, Quarters, solde joueur, connexion quotidienne
+- [x] Apparence & emotes
+- [x] Assurance : débit de la prime au déploiement + payout à la mort
+- [x] Stats de carrière (valeurs à 0 — non traçables sans serveur de jeu)
+- [x] Présence des amis (en ligne / en raid)
+- [x] Pseudos réels via Steam Web API (le client n'envoie que le SteamID)
+- [x] Cartes : Bright Sands, Crescent Falls, Tharis Island

-Use your favorite ZIP archiver and unzip the `Prospect.Server.Api.zip` downloaded from this repository.
+**Non implémenté / hors-périmètre :**

-### 3. Generate and import SSL certificate
+- [ ] Squad / multi dans le **même** raid — nécessite un serveur de jeu dédié
+- [ ] Voix de proximité (login/join Vivox = placeholders)
+- [ ] Free loadouts & presets (Saison 3 uniquement)
+- [ ] Achat de cosmétiques (endpoint d'achat vanity distinct, non câblé)
+- [ ] Catalogue des récompenses Fortuna (DataTable côté client, dans des paks chiffrés)
+- [ ] Défis quotidiens Fortuna

-> [!IMPORTANT]
-> Do not share the generated certificate! Generated certificate includes a private key that may be used to generate other certificates and compromise your security.
+---

-A connection to the server is served over a secured connection. The server uses self-signed certificate that must be added to trusted authorities in order for the game
-to successfully communicate with the local server. Do the following:
+## Hors-périmètre & R&D

-1. Open the folder with `Prospect.Server.Api`.
+Un **serveur de jeu Unreal dédié** (`Prospect.Server.Game` + `Prospect.Unreal`, branche
+`game-server`) est en cours de reverse-engineering pour, à terme, permettre le vrai multi.
+État : handshake stateless UE, séquençage et décodage des bunches **franchis**, canal de
+contrôle ouvert, `NMT_Hello` parsé. **Bloqué** sur le chiffrement **DTLS-PSK** du client
+(clé dérivée du `user_id`), derrière un exe packé (BattlEye) → la dérivation n'est pas
+extractible statiquement. Détails dans `NETCODE-RND.md` (branche `game-server`).

-1. Double-click `generate_ssl.exe`. `certificate.pfx` will appear in the same folder.
+Le « lobby squad » via l'API seule n'est **pas faisable** : l'invitation d'amis est gérée
+100 % côté client Steam.

-1. Double-click `certificate.pfx`. The Certificate Import Wizard will open:
+---

-    1. Select **Current User** under Store Location and click **Next**.
+## Crédits & licence

-    1. Leave **File to Import** unchanged and click **Next**.
-
-    1. Leave **Password** empty and click **Next**.
-
-    1. Select **Place all certificates in the following store** > **Browse...**. Choose **Trusted Root Certification Authorities** and click **OK**. Click **Next**.
-
-    1. Click **Finish**. A **Security Warning** popup may appear, make sure it specifies `2EA46.playfabapi.com` certification authority and click **Yes**.
-
-### 4. Extract `LoaderPack` to the game
-
-1. Open the folder with The Cycle: Frontier and navigate to **Prospect** > **Binaries** > **Win64**.
-
-1. Open the `LoaderPack` archive.
-
-1. Drag and drop the contents of the `LoaderPack` archive to the game.
-
-1. Create a shortcut for the `Prospect.Client.Loader` that you will use later to launch the game.
-
-### 5. Run the server
-
-Now you are all set! Open the folder with `Prospect.Server.Api` and run `Prospect.Server.Api.exe`. It will open a console if it runs successfully.
-
-> [!IMPORTANT]
-> Do not close the console when you run the game.
-
-### 6. Run the game
-
-Once the server is running, make sure that Steam is running and open The Cycle: Frontier using the shortcut you've created before.
-
-## Troubleshooting and FAQ
-
-### How to remove the certificate?
-
-If you've installed the certificate for the **Current User**:
-
-1. Open **Start** and enter `certmgr.msc`.
-
-1. Expand **Trusted Root Certification Authorities** and select **Certificates**.
-
-1. Find `2EA46.playfabapi.com`, right-click it > **Delete**.
-
-If you've installed the certificate for the **Local Machine**, repeat the same steps but instead open `certlm.msc`.
-
-### `generate_ssl.exe` is flagged as a virus
-
-`generate_ssl.exe` is a Python application packed with PyInstaller and some anti-viruses may flag it as a virus.
-This application is a simple certificate generator and you can find its source code in `utils/generate_ssl.py`.
-
-### Body parts are missing with Season 3 client
-
-Currently, the server loads body part IDs for Season 2 by default, so this is expected. You can fix this by going to station and changing your character appearance. This will store the updated body part IDs for your character.
-
-### Prospect.Server.Api does not start
-
-Make sure you have [.NET Runtime 8.0](https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win-x64&os=win10&apphost_version=8.0.11) and [ASP.NET Core 8.0](https://aka.ms/dotnet-core-applaunch?framework=Microsoft.AspNetCore.App&framework_version=8.0.0&arch=x64&rid=win-x64&os=win10) installed.
-
-### Login Failed. Error code: 3
-
-Make sure that:
-
-* You have Steam running.
-* You have created and **saved** the `steam_appid` file as described in step 6.
-* The `steam_appid` file type is "TXT File".
-
-### Login Failed. Error code: 5
-
-Make sure that `Prospect.Server.Api` server is running.
-
-If the server is running, press `Alt+Tab` to a game console that opens when you start the game and check for the following:
-
-* `libcurl error 7 (Couldn't connect to server)` - indicates that the `Prospect.Server.Api` is not running.
-  ![](./_assets/connection_refused_error.png)
-
-* `InvalidAPIEndpoint` - indicates that you are running the game using the original shortcut and not using `Prospect.Client.Loader`.
-  ![](./_assets/invalid_api_endpoint.PNG)
-
-* `libcurl error 60 (Peer certificate cannot be authenticated with given CA certificates)` - indicates that the certificate was not installed correctly. Make sure that the certificate is present in `certmgr.msc` and there is only one certificate. Try removing the certificate and importing it again by following step 4.
-  ![](./_assets/certificate_error.PNG)
-
-* `HTTP code: 500` - usually indicates that MongoDB is not running. Make sure that MongoDB is installed and and that `MongoDB Server` is running in `services.msc`.
-  ![](./_assets/mongodb_error.PNG)
-
-## Development
-
-TBD
+Fork de [`deiteris/Prospect`](https://github.com/deiteris/Prospect) (lui-même issu du
+projet Prospect original). Voir [`LICENSE`](LICENSE). Usage privé.
@@ -0,0 +1,431 @@
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+using System.Text.Json;
+using Microsoft.AspNetCore.Mvc;
+using Prospect.Server.Api.Services.Database;
+using Prospect.Server.Api.Services.Database.Models;
+using Prospect.Server.Api.Services.GameRef;
+using Prospect.Server.Api.Services.Steam;
+using Prospect.Server.Api.Services.UserData;
+
+namespace Prospect.Server.Api.Controllers;
+
+// Read-only back-office to visualise everything relevant in the database.
+// Served at /admin, restricted to LAN / loopback callers (an admin panel must not be
+// reachable from the public internet even though :8443 is port-forwarded).
+// List pages (players, catalog) are driven by a small self-contained client-side table
+// engine (sort / filter / search / paging) fed by the /admin/api/* JSON endpoints.
+[Route("admin")]
+public class AdminController : ControllerBase
+{
+    private readonly DbUserService _userService;
+    private readonly DbEntityService _entityService;
+    private readonly DbUserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+    private readonly SteamWebApiService _steamWebApi;
+    private readonly GameRefService _gameRef;
+
+    public AdminController(DbUserService userService, DbEntityService entityService,
+        DbUserDataService userDataService, TitleDataService titleDataService, SteamWebApiService steamWebApi,
+        GameRefService gameRef)
+    {
+        _userService = userService;
+        _entityService = entityService;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+        _steamWebApi = steamWebApi;
+        _gameRef = gameRef;
+    }
+
+    // ---------- pages ----------
+
+    [HttpGet("")]
+    public async Task<IActionResult> Index()
+    {
+        if (!IsLan()) return Denied();
+
+        var users = await _userService.GetAllAsync();
+        var entities = await _entityService.GetAllAsync();
+        var dataCount = await _userDataService.CountAsync();
+        var titleKeys = _titleDataService.Find(new List<string>());
+
+        var sb = new StringBuilder();
+        sb.Append("<div class='cards'>");
+        sb.Append(Card("Joueurs", users.Count.ToString()));
+        sb.Append(Card("Entités", entities.Count.ToString()));
+        sb.Append(Card("Docs UserData", dataCount.ToString()));
+        sb.Append(Card("Clés TitleData", titleKeys.Count.ToString()));
+        sb.Append(Card("Catalogue", _gameRef.All.Count.ToString()));
+        sb.Append("</div>");
+        sb.Append("<p><a class='btn' href='/admin/players'>Joueurs →</a> &nbsp; <a class='btn' href='/admin/catalog'>Catalogue →</a> &nbsp; <a class='btn' href='/admin/titledata'>TitleData →</a></p>");
+        return Html(Layout("Dashboard", sb.ToString()));
+    }
+
+    [HttpGet("players")]
+    public IActionResult Players()
+    {
+        if (!IsLan()) return Denied();
+        var body =
+            "<h2>Joueurs</h2>" +
+            "<p><a class='btn' href='/admin/backfill-names' title='Récupère les pseudos Steam des comptes sans nom'>⟳ Backfill pseudos Steam</a></p>" +
+            "<div id='tbl'></div>" +
+            "<script>DT.init({id:'tbl',url:'/admin/api/players',size:25,filters:['auth'],columns:[" +
+            "{key:'name',label:'Nom',kind:'link',base:'/admin/players/',lkey:'id'}," +
+            "{key:'id',label:'PlayFab Id',kind:'mono'}," +
+            "{key:'entity',label:'Entity Id',kind:'mono'}," +
+            "{key:'auth',label:'Auth',kind:'mono'}]});</script>";
+        return Html(Layout("Joueurs", body));
+    }
+
+    [HttpGet("catalog")]
+    public IActionResult Catalog()
+    {
+        if (!IsLan()) return Denied();
+        var body =
+            "<h2>Catalogue</h2>" +
+            "<p class='muted'>Référence dataminée (TCF-Wiki) — " + _gameRef.All.Count + " entrées.</p>" +
+            "<div id='tbl'></div>" +
+            "<script>DT.init({id:'tbl',url:'/admin/api/catalog',size:50,filters:['category','rarity'],columns:[" +
+            "{key:'name',label:'Nom'}," +
+            "{key:'rarity',label:'Rareté',kind:'rarity'}," +
+            "{key:'category',label:'Catégorie'}," +
+            "{key:'id',label:'id',kind:'mono'}]});</script>";
+        return Html(Layout("Catalogue", body));
+    }
+
+    [HttpGet("players/{id}")]
+    public async Task<IActionResult> Player(string id)
+    {
+        if (!IsLan()) return Denied();
+
+        var user = await _userService.FindByIdAsync(id);
+        if (user == null) return Html(Layout("Joueur introuvable", "<p>Aucun joueur avec cet id.</p>"));
+
+        var entity = await _entityService.FindAsync(id);
+        var data = await _userDataService.GetAllForUserAsync(id);
+        var map = data.ToDictionary(d => d.Key, d => d);
+
+        var sb = new StringBuilder();
+        var auth = user.Auth != null ? string.Join(", ", user.Auth.Select(a => $"{a.Type}:{a.Key}")) : "";
+        sb.Append($"<p><a class='lnk' href='/admin/players'>← Joueurs</a></p>");
+        sb.Append($"<h2>{Esc(user.DisplayName)}</h2>");
+        sb.Append($"<p class='muted mono'>PlayFabId {Esc(user.Id)} · Entity {Esc(entity?.Id ?? "-")} · {Esc(auth)}</p>");
+
+        sb.Append("<div class='cards'>");
+        if (map.TryGetValue("Balance", out var bal))
+        {
+            sb.Append(Card("K-Marks", GetNum(bal.Value, "SoftCurrency").ToString()));
+            sb.Append(Card("Aurum", GetNum(bal.Value, "HardCurrency").ToString()));
+            sb.Append(Card("Insurance", GetNum(bal.Value, "InsuranceCurrency").ToString()));
+        }
+        foreach (var f in new[] { "Korolev", "Osiris", "ICA" })
+            if (map.TryGetValue("FactionProgression" + f, out var fp))
+                sb.Append(Card("Rép. " + f, (fp.Value ?? "0").Trim()));
+        foreach (var s in new[] { "2", "3" })
+            if (map.TryGetValue($"FortunaPass{s}_SeasonXp", out var xp) && (xp.Value ?? "0").Trim() != "0")
+                sb.Append(Card($"Fortuna S{s} XP", (xp.Value ?? "0").Trim()));
+        sb.Append("</div>");
+
+        if (map.TryGetValue("Inventory", out var inv))
+        {
+            sb.Append("<h3>Inventaire</h3>");
+            sb.Append(InventoryTable(inv.Value));
+        }
+
+        sb.Append("<h3>Toutes les données</h3>");
+        foreach (var d in data)
+        {
+            sb.Append("<details><summary>" + Esc(d.Key) +
+                      $" <span class='muted small'>· {d.Value?.Length ?? 0} car · maj {d.LastUpdated:yyyy-MM-dd HH:mm}{(d.Public ? " · public" : "")}</span></summary>");
+            sb.Append($"<pre>{Esc(Pretty(d.Value))}</pre></details>");
+        }
+        return Html(Layout("Joueur · " + user.DisplayName, sb.ToString()));
+    }
+
+    [HttpGet("titledata")]
+    public IActionResult TitleData()
+    {
+        if (!IsLan()) return Denied();
+
+        var all = _titleDataService.Find(new List<string>());
+        var sb = new StringBuilder();
+        sb.Append("<h2>TitleData</h2>");
+        sb.Append("<table><thead><tr><th>Clé</th><th>Taille</th><th></th></tr></thead><tbody>");
+        foreach (var kv in all.OrderBy(k => k.Key))
+            sb.Append($"<tr><td class='mono'>{Esc(kv.Key)}</td><td>{kv.Value?.Length ?? 0} car</td>" +
+                      $"<td><a class='btn' href='/admin/titledata/{Esc(kv.Key)}'>Voir</a></td></tr>");
+        sb.Append("</tbody></table>");
+        return Html(Layout("TitleData", sb.ToString()));
+    }
+
+    [HttpGet("titledata/{key}")]
+    public IActionResult TitleDataKey(string key)
+    {
+        if (!IsLan()) return Denied();
+
+        var all = _titleDataService.Find(new List<string> { key });
+        if (!all.TryGetValue(key, out var value))
+            return Html(Layout("Clé introuvable", "<p>Aucune clé TitleData avec ce nom.</p>"));
+
+        var body = value != null && value.Length > 300_000
+            ? $"<p class='muted'>Valeur volumineuse ({value.Length} car) — affichage brut.</p><pre>{Esc(value)}</pre>"
+            : $"<pre>{Esc(Pretty(value))}</pre>";
+        return Html(Layout("TitleData · " + key, $"<p><a class='lnk' href='/admin/titledata'>← TitleData</a></p><h2 class='mono'>{Esc(key)}</h2>" + body));
+    }
+
+    [HttpGet("backfill-names")]
+    public async Task<IActionResult> BackfillNames()
+    {
+        if (!IsLan()) return Denied();
+        if (!_steamWebApi.Enabled)
+            return Html(Layout("Backfill", "<p class='muted'>Steam Web API non configurée (clé absente).</p><p><a class='btn' href='/admin/players'>← Joueurs</a></p>"));
+
+        var users = await _userService.GetAllAsync();
+        int updated = 0, skipped = 0, failed = 0;
+        var rows = new StringBuilder();
+        foreach (var u in users)
+        {
+            if (!string.IsNullOrEmpty(u.DisplayName) && u.DisplayName != "Unknown") { skipped++; continue; }
+            var steam = u.Auth?.FirstOrDefault(a => a.Type == PlayFabUserAuthType.Steam)?.Key;
+            if (string.IsNullOrEmpty(steam)) { skipped++; continue; }
+
+            var persona = await _steamWebApi.GetPersonaNameAsync(steam);
+            if (!string.IsNullOrWhiteSpace(persona))
+            {
+                await _userService.UpdateDisplayNameAsync(u.Id, persona);
+                updated++;
+                rows.Append($"<tr><td class='mono small'>{Esc(u.Id)}</td><td>{Esc(persona)}</td></tr>");
+            }
+            else { failed++; }
+        }
+
+        var body = $"<h2>Backfill des pseudos Steam</h2><p class='muted'>{updated} mis à jour · {skipped} ignorés · {failed} échec(s)</p>" +
+                   (updated > 0 ? $"<table><thead><tr><th>PlayFabId</th><th>Nouveau nom</th></tr></thead><tbody>{rows}</tbody></table>" : "") +
+                   "<p><a class='btn' href='/admin/players'>← Joueurs</a></p>";
+        return Html(Layout("Backfill", body));
+    }
+
+    // ---------- JSON API (consumed by the client-side table engine) ----------
+
+    [HttpGet("api/players")]
+    public async Task<IActionResult> ApiPlayers()
+    {
+        if (!IsLan()) return Denied();
+        var users = await _userService.GetAllAsync();
+        var entities = (await _entityService.GetAllAsync())
+            .GroupBy(e => e.UserId).ToDictionary(g => g.Key, g => g.First().Id);
+        var list = users.Select(u => new
+        {
+            name = string.IsNullOrEmpty(u.DisplayName) ? u.Id : u.DisplayName,
+            id = u.Id,
+            entity = entities.TryGetValue(u.Id, out var e) ? e : "",
+            auth = u.Auth != null ? string.Join(", ", u.Auth.Select(a => $"{a.Type}:{a.Key}")) : ""
+        });
+        return Json(list);
+    }
+
+    [HttpGet("api/catalog")]
+    public IActionResult ApiCatalog()
+    {
+        if (!IsLan()) return Denied();
+        var list = _gameRef.All.Select(kv => new
+        {
+            id = kv.Key,
+            name = kv.Value.Name,
+            rarity = kv.Value.Rarity,
+            category = kv.Value.Category
+        });
+        return Json(list);
+    }
+
+    // ---------- helpers ----------
+
+    private bool IsLan()
+    {
+        var ip = HttpContext.Connection.RemoteIpAddress;
+        if (ip == null) return false;
+        if (IPAddress.IsLoopback(ip)) return true;
+        if (ip.IsIPv4MappedToIPv6) ip = ip.MapToIPv4();
+        if (ip.AddressFamily == AddressFamily.InterNetwork)
+        {
+            var b = ip.GetAddressBytes();
+            if (b[0] == 10) return true;
+            if (b[0] == 192 && b[1] == 168) return true;
+            if (b[0] == 172 && b[1] >= 16 && b[1] <= 31) return true;
+            if (b[0] == 127) return true;
+            return false;
+        }
+        var s = ip.GetAddressBytes();
+        if ((s[0] & 0xFE) == 0xFC) return true;
+        if (s[0] == 0xFE && (s[1] & 0xC0) == 0x80) return true;
+        return false;
+    }
+
+    private IActionResult Denied() =>
+        StatusCode(403, "Admin back-office is LAN-only. Access it from the local network (e.g. https://192.168.1.136:8443/admin).");
+
+    private IActionResult Html(string html) => Content(html, "text/html; charset=utf-8");
+
+    private IActionResult Json(object data) =>
+        Content(JsonSerializer.Serialize(data), "application/json; charset=utf-8");
+
+    private static string Esc(string? s) => WebUtility.HtmlEncode(s ?? "");
+
+    private static string Pretty(string? json)
+    {
+        if (string.IsNullOrWhiteSpace(json)) return json ?? "";
+        try
+        {
+            using var doc = JsonDocument.Parse(json);
+            return JsonSerializer.Serialize(doc.RootElement, new JsonSerializerOptions { WriteIndented = true });
+        }
+        catch { return json; }
+    }
+
+    private static long GetNum(string? json, string prop)
+    {
+        if (string.IsNullOrWhiteSpace(json)) return 0;
+        try
+        {
+            using var doc = JsonDocument.Parse(json);
+            foreach (var p in doc.RootElement.EnumerateObject())
+                if (string.Equals(p.Name, prop, StringComparison.OrdinalIgnoreCase) && p.Value.ValueKind == JsonValueKind.Number)
+                    return p.Value.GetInt64();
+        }
+        catch { }
+        return 0;
+    }
+
+    private string InventoryTable(string? json)
+    {
+        if (string.IsNullOrWhiteSpace(json)) return "<p class='muted'>vide</p>";
+        try
+        {
+            using var doc = JsonDocument.Parse(json);
+            if (doc.RootElement.ValueKind != JsonValueKind.Array) return $"<pre>{Esc(Pretty(json))}</pre>";
+            var sb = new StringBuilder();
+            var count = doc.RootElement.GetArrayLength();
+            sb.Append($"<p class='muted'>{count} item(s)</p>");
+            sb.Append("<table><thead><tr><th>Nom</th><th>Rareté</th><th>baseItemId</th><th>qté</th><th>durab.</th><th>assurance</th></tr></thead><tbody>");
+            foreach (var it in doc.RootElement.EnumerateArray())
+            {
+                string S(string k) => it.TryGetProperty(k, out var v) ? (v.ValueKind == JsonValueKind.Number ? v.GetRawText() : v.ToString()) : "";
+                var baseId = S("baseItemId");
+                var entry = _gameRef.Get(baseId);
+                var name = entry?.Name ?? baseId;
+                sb.Append($"<tr><td>{Esc(name)}</td><td>{Rarity(entry?.Rarity)}</td><td class='mono small'>{Esc(baseId)}</td>" +
+                          $"<td>{Esc(S("amount"))}</td><td>{Esc(S("durability"))}</td><td>{Esc(S("insurance"))}</td></tr>");
+            }
+            sb.Append("</tbody></table>");
+            return sb.ToString();
+        }
+        catch { return $"<pre>{Esc(Pretty(json))}</pre>"; }
+    }
+
+    private static string Rarity(string? r)
+    {
+        if (string.IsNullOrEmpty(r)) return "";
+        var color = r.ToLowerInvariant() switch
+        {
+            "common" => "#9aa4b2",
+            "uncommon" => "#4caf50",
+            "rare" => "#2f81f7",
+            "epic" => "#a371f7",
+            "legendary" or "exotic" => "#e8a838",
+            _ => "#9aa4b2",
+        };
+        return $"<span style='color:{color};font-weight:600'>{Esc(r)}</span>";
+    }
+
+    private static string Card(string label, string value) =>
+        $"<div class='card'><div class='v'>{Esc(value)}</div><div class='l'>{Esc(label)}</div></div>";
+
+    private static string Layout(string title, string body) =>
+        Head.Replace("__TITLE__", Esc(title)) + DtScript + body + Foot;
+
+    // Static shell (no C# interpolation → JS braces/quotes stay literal). Single quotes only.
+    private const string Head = @"<!doctype html><html lang='fr'><head>
+<meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'>
+<title>__TITLE__ · The Cycle Admin</title>
+<style>
+:root{--bg:#0f1115;--panel:#171a21;--line:#262b36;--txt:#e6e8ec;--muted:#8b93a1;--acc:#e8a838;}
+*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--txt);font:14px/1.5 system-ui,Segoe UI,Roboto,sans-serif}
+header{background:var(--panel);border-bottom:1px solid var(--line);padding:12px 20px;display:flex;gap:18px;align-items:center;position:sticky;top:0;z-index:10}
+header b{color:var(--acc)}header a{color:var(--muted);text-decoration:none}header a:hover{color:var(--txt)}
+main{padding:20px;max-width:1200px;margin:0 auto}
+h2{margin:18px 0 10px}h3{margin:22px 0 8px;border-bottom:1px solid var(--line);padding-bottom:4px}
+.cards{display:flex;flex-wrap:wrap;gap:12px;margin:12px 0}
+.card{background:var(--panel);border:1px solid var(--line);border-radius:10px;padding:14px 18px;min-width:130px}
+.card .v{font-size:22px;font-weight:700;color:var(--acc)}.card .l{color:var(--muted);font-size:12px}
+table{width:100%;border-collapse:collapse;background:var(--panel);border:1px solid var(--line);border-radius:10px;overflow:hidden}
+th,td{text-align:left;padding:8px 12px;border-bottom:1px solid var(--line);vertical-align:top}
+th{background:#1c2029;color:var(--muted);font-weight:600}tr:last-child td{border-bottom:none}
+tbody tr:hover{background:#1b2028}
+.mono{font-family:ui-monospace,Consolas,monospace}.small{font-size:12px}.muted{color:var(--muted)}
+.btn{display:inline-block;background:#222834;color:var(--txt);border:1px solid var(--line);border-radius:8px;padding:5px 12px;text-decoration:none;font-size:13px;cursor:pointer}
+.btn:hover{border-color:var(--acc);color:var(--acc)}
+a.lnk{color:var(--acc);text-decoration:none}a.lnk:hover{text-decoration:underline}
+details{background:var(--panel);border:1px solid var(--line);border-radius:8px;margin:6px 0}summary{cursor:pointer;padding:8px 12px}
+pre{margin:0;padding:12px;background:#0b0d11;border-top:1px solid var(--line);overflow:auto;max-height:480px;white-space:pre-wrap;word-break:break-word}
+.dtbar{display:flex;gap:8px;flex-wrap:wrap;align-items:center;margin:12px 0}
+.dtbar input,.dtbar select{background:var(--panel);border:1px solid var(--line);border-radius:8px;color:var(--txt);padding:7px 10px}
+.dtsearch{flex:1;min-width:220px}
+.dtcount{margin-left:auto}
+th.dth{cursor:pointer;user-select:none;white-space:nowrap}th.dth:hover{color:var(--txt)}
+.dtfoot{display:flex;gap:12px;align-items:center;margin:10px 0}
+</style></head><body>
+<header><b>The Cycle · Admin</b>
+<a href='/admin'>Dashboard</a><a href='/admin/players'>Joueurs</a><a href='/admin/catalog'>Catalogue</a><a href='/admin/titledata'>TitleData</a>
+<span class='muted' style='margin-left:auto'>read-only · LAN</span></header>
+<main>";
+
+    private const string Foot = @"</main></body></html>";
+
+    // Client-side table engine, injected right after <main> so DT is defined before any
+    // page-level DT.init() runs. Single quotes only (verbatim string → JS braces stay literal).
+    private const string DtScript = @"<script>
+const DT={
+ init(cfg){const el=document.getElementById(cfg.id);el.innerHTML='<p class=muted>Chargement…</p>';
+   fetch(cfg.url).then(r=>r.json()).then(rows=>DT.build(el,cfg,rows)).catch(e=>{el.innerHTML='<p class=muted>Erreur: '+e+'</p>';});},
+ build(el,cfg,rows){el.innerHTML='';el._rows=rows;el._cfg=cfg;el._sort={k:null,d:1};el._page=1;el._size=cfg.size||25;el._filters={};el._q='';
+   const bar=document.createElement('div');bar.className='dtbar';
+   const s=document.createElement('input');s.className='dtsearch';s.placeholder='Rechercher…';s.oninput=()=>{el._q=s.value.toLowerCase();el._page=1;DT.draw(el);};bar.appendChild(s);
+   (cfg.filters||[]).forEach(fk=>{const vals=[...new Set(rows.map(r=>r[fk]).filter(v=>v!=null&&v!==''))].sort();
+     const sel=document.createElement('select');const o0=document.createElement('option');o0.value='';o0.textContent=fk;sel.appendChild(o0);
+     vals.forEach(v=>{const o=document.createElement('option');o.value=v;o.textContent=v;sel.appendChild(o);});
+     sel.onchange=()=>{el._filters[fk]=sel.value;el._page=1;DT.draw(el);};bar.appendChild(sel);});
+   const sz=document.createElement('select');[25,50,100,500].forEach(n=>{const o=document.createElement('option');o.value=n;o.textContent=n+'/page';sz.appendChild(o);});
+   const oa=document.createElement('option');oa.value='0';oa.textContent='Tout';sz.appendChild(oa);sz.value=el._size;
+   sz.onchange=()=>{el._size=+sz.value;el._page=1;DT.draw(el);};bar.appendChild(sz);
+   const cnt=document.createElement('span');cnt.className='dtcount muted';bar.appendChild(cnt);el._cnt=cnt;el.appendChild(bar);
+   const tbl=document.createElement('table');const th=document.createElement('thead');const tr=document.createElement('tr');
+   cfg.columns.forEach(c=>{const h=document.createElement('th');h.className='dth';h.dataset.k=c.key;h.textContent=c.label;h.onclick=()=>DT.sort(el,c.key);tr.appendChild(h);});
+   th.appendChild(tr);tbl.appendChild(th);el._head=tr;const tb=document.createElement('tbody');tbl.appendChild(tb);el._tb=tb;el.appendChild(tbl);
+   const ft=document.createElement('div');ft.className='dtfoot';
+   const pv=document.createElement('button');pv.className='btn';pv.textContent='‹ Préc.';pv.onclick=()=>{if(el._page>1){el._page--;DT.draw(el);}};
+   const nf=document.createElement('span');nf.className='muted';el._nfo=nf;
+   const nx=document.createElement('button');nx.className='btn';nx.textContent='Suiv. ›';nx.onclick=()=>{el._page++;DT.draw(el);};
+   ft.appendChild(pv);ft.appendChild(nf);ft.appendChild(nx);el.appendChild(ft);DT.draw(el);},
+ rows(el){const cfg=el._cfg;let rows=el._rows;
+   Object.keys(el._filters).forEach(k=>{const fv=el._filters[k];if(fv)rows=rows.filter(r=>(''+(r[k]??''))===fv);});
+   if(el._q)rows=rows.filter(r=>cfg.columns.some(c=>(''+(r[c.key]??'')).toLowerCase().includes(el._q)));
+   if(el._sort.k){const k=el._sort.k,d=el._sort.d;rows=[...rows].sort((a,b)=>{let x=a[k],y=b[k];const nx=parseFloat(x),ny=parseFloat(y);
+     if(!isNaN(nx)&&!isNaN(ny)&&(''+x).trim()!==''&&(''+y).trim()!==''){x=nx;y=ny;}else{x=(''+(x??'')).toLowerCase();y=(''+(y??'')).toLowerCase();}return x<y?-d:x>y?d:0;});}
+   return rows;},
+ sort(el,k){if(el._sort.k===k)el._sort.d*=-1;else{el._sort.k=k;el._sort.d=1;}el._page=1;DT.draw(el);},
+ draw(el){const cfg=el._cfg,rows=DT.rows(el),total=rows.length,size=el._size||total||1,pages=Math.max(1,Math.ceil(total/size));
+   if(el._page>pages)el._page=pages;const start=el._size?(el._page-1)*size:0;const slice=el._size?rows.slice(start,start+size):rows;
+   el._tb.innerHTML=slice.map(r=>'<tr>'+cfg.columns.map(c=>DT.cell(c,r)).join('')+'</tr>').join('')||'<tr><td colspan='+cfg.columns.length+' class=muted>Aucun résultat</td></tr>';
+   el._cnt.textContent=total+' résultat(s)';el._nfo.textContent='page '+el._page+'/'+pages;
+   [...el._head.children].forEach(h=>{const c=cfg.columns.find(x=>x.key===h.dataset.k);h.textContent=c.label+(el._sort.k===h.dataset.k?(el._sort.d>0?' ▲':' ▼'):'');});},
+ cell(c,r){let v=r[c.key];v=v==null?'':(''+v);
+   if(c.kind==='rarity')return '<td>'+DT.rarity(v)+'</td>';
+   if(c.kind==='link')return '<td><a class=lnk href='+c.base+encodeURIComponent(r[c.lkey||'id'])+'>'+DT.esc(v)+'</a></td>';
+   const cls=c.kind==='mono'?'mono small':'';return '<td class='+cls+'>'+DT.esc(v)+'</td>';},
+ rarity(r){if(!r)return '';const c={common:'#9aa4b2',uncommon:'#4caf50',rare:'#2f81f7',epic:'#a371f7',legendary:'#e8a838',exotic:'#e8a838'}[r.toLowerCase()]||'#9aa4b2';
+   return '<span style=color:'+c+';font-weight:600>'+DT.esc(r)+'</span>';},
+ esc(s){const d=document.createElement('div');d.textContent=(s==null?'':''+s);return d.innerHTML;}
+};
+</script>";
+}
@@ -32,6 +32,7 @@ public class ClientController : Controller
    private readonly DbEntityService _entityService;
    private readonly UserDataService _userDataService;
    private readonly TitleDataService _titleDataService;
+    private readonly Prospect.Server.Api.Services.Steam.SteamWebApiService _steamWebApi;

    public ClientController(ILogger<ClientController> logger,
        IOptions<PlayFabSettings> settings,
@@ -39,7 +40,8 @@ public class ClientController : Controller
        DbUserService userService,
        DbEntityService entityService,
        UserDataService userDataService,
-        TitleDataService titleDataService)
+        TitleDataService titleDataService,
+        Prospect.Server.Api.Services.Steam.SteamWebApiService steamWebApi)
    {
        _settings = settings.Value;
        _logger = logger;
@@ -48,6 +50,7 @@ public class ClientController : Controller
        _entityService = entityService;
        _userDataService = userDataService;
        _titleDataService = titleDataService;
+        _steamWebApi = steamWebApi;
    }

    [AllowAnonymous]
@@ -63,6 +66,19 @@ public class ClientController : Controller
                var userSteamId = ticket.SteamId.ToString();

                var user = await _userService.FindOrCreateAsync(PlayFabUserAuthType.Steam, userSteamId);
+
+                // Backfill the display name from the Steam persona when we don't have a real
+                // one yet (accounts are created as "Unknown"; the client never sends a name).
+                if (string.IsNullOrEmpty(user.DisplayName) || user.DisplayName == "Unknown")
+                {
+                    var persona = await _steamWebApi.GetPersonaNameAsync(userSteamId);
+                    if (!string.IsNullOrWhiteSpace(persona))
+                    {
+                        await _userService.UpdateDisplayNameAsync(user.Id, persona);
+                        user.DisplayName = persona;
+                    }
+                }
+
                var entity = await _entityService.FindOrCreateAsync(user.Id);

                var userTicket = _authTokenService.GenerateUser(entity);
@@ -140,8 +156,18 @@ public class ClientController : Controller
    [HttpPost("AddGenericID")]
    [Produces(MediaTypeNames.Application.Json)]
    [Authorize(AuthenticationSchemes = UserAuthenticationOptions.DefaultScheme)]
-    public IActionResult AddGenericId(FAddGenericIDRequest request)
+    public async Task<IActionResult> AddGenericId(FAddGenericIDRequest request)
    {
+        // Persist the linked generic service id instead of dropping it (was a no-op stub).
+        var userId = User.FindAuthUserId();
+        if (request.GenericId != null && !string.IsNullOrEmpty(request.GenericId.ServiceName))
+        {
+            await _userDataService.UpdateAsync(userId, userId, new Dictionary<string, string>
+            {
+                ["GenericId_" + request.GenericId.ServiceName] = request.GenericId.UserId ?? ""
+            });
+        }
+
        return Ok(new ClientResponse<object>
        {
            Code = 200,
@@ -274,8 +300,12 @@ public class ClientController : Controller
    [HttpPost("UpdateUserTitleDisplayName")]
    [Produces(MediaTypeNames.Application.Json)]
    [Authorize(AuthenticationSchemes = UserAuthenticationOptions.DefaultScheme)]
-    public IActionResult UpdateUserTitleDisplayName(FUpdateUserTitleDisplayNameRequest request)
+    public async Task<IActionResult> UpdateUserTitleDisplayName(FUpdateUserTitleDisplayNameRequest request)
    {
+        // Persist the rename, otherwise it is echoed back but lost on next login.
+        var userId = User.FindAuthUserId();
+        await _userService.UpdateDisplayNameAsync(userId, request.DisplayName);
+
        return Ok(new ClientResponse<FUpdateUserTitleDisplayNameResult>
        {
            Code = 200,
@@ -9,6 +9,14 @@ public class RequestLoggerMiddleware
    private readonly ILogger<RequestLoggerMiddleware> _logger;
    private readonly RequestDelegate _next;

+    // Keywords used to surface social/squad/invite traffic while reverse-engineering the
+    // squad-invite flow (see SQUAD-EMULATION.md). Matched against the path AND the body
+    // (the CloudScript function name lives in the body of /Client/ExecuteFunction).
+    private static readonly string[] SocialKeywords =
+    {
+        "group", "party", "lobby", "squad", "invite", "friend", "social", "matchmak",
+    };
+
    public RequestLoggerMiddleware(ILogger<RequestLoggerMiddleware> logger, RequestDelegate next)
    {
        _logger = logger;
@@ -32,6 +40,27 @@ public class RequestLoggerMiddleware
        }

        await _next(context);
+
+        // ── Capture pass (squad-invite RE, see SQUAD-EMULATION.md) ──────────────
+        // Runs AFTER the pipeline so we know whether the request was actually routed.
+        if (context.Request.Method == "POST")
+        {
+            var path = context.Request.Path.Value ?? "";
+            var haystack = (path + " " + body).ToLowerInvariant();
+
+            // Any POST that fell through to a 404 = an endpoint the emulator does NOT implement
+            // (e.g. a native PlayFab /Group/CreateGroup or /Lobby/* the client tried to call).
+            if (context.Response.StatusCode == 404)
+            {
+                _logger.LogWarning("[CAPTURE UNROUTED] {Method} {Url} -> 404 | Body {Body}",
+                    context.Request.Method, context.Request.GetDisplayUrl(), body);
+            }
+            else if (SocialKeywords.Any(k => haystack.Contains(k)))
+            {
+                _logger.LogInformation("[CAPTURE SOCIAL] {Url} ({Status}) | Body {Body}",
+                    context.Request.GetDisplayUrl(), context.Response.StatusCode, body);
+            }
+        }
    }

    private static async Task<string> RequestAsync(HttpRequest request)
@@ -34,4 +34,10 @@
      <ProjectReference Include="..\Prospect.Steam\Prospect.Steam.csproj" />
    </ItemGroup>

+    <ItemGroup>
+      <!-- Community-datamined id -> name/rarity/category lookup (TCF-Wiki), used by the
+           admin back-office to show readable item/vanity names instead of raw ids. -->
+      <Content Update="Data\gameref.json" CopyToOutputDirectory="PreserveNewest" />
+    </ItemGroup>
+
 </Project>
@@ -81,9 +81,16 @@ public class ClaimActiveContract : ICloudScriptFunction<FYClaimCompletedActiveCo
        }

        var factionKey = "FactionProgression" + contract.Faction;
+        // Fortuna pass season XP is stored per season; the client derives the pass level
+        // from this key. No challenge system is emulated, so contracts are the XP source.
+#if SEASON_3_RELEASE || SEASON_3_DEBUG
+        const string seasonXpKey = "FortunaPass3_SeasonXp";
+#else
+        const string seasonXpKey = "FortunaPass2_SeasonXp";
+#endif
        var userData = await _userDataService.FindAsync(
            userId, userId,
-            new List<string>{"ContractsActive", "ContractsOneTimeCompleted", "Balance", "Inventory", factionKey, "JobBoardsData" }
+            new List<string>{"ContractsActive", "ContractsOneTimeCompleted", "Balance", "Inventory", factionKey, "JobBoardsData", seasonXpKey }
        );

        var factionProgression = JsonSerializer.Deserialize<int>(userData[factionKey].Value);
@@ -270,6 +277,12 @@ public class ClaimActiveContract : ICloudScriptFunction<FYClaimCompletedActiveCo
            newContracts.Add(newContract);
        }

+        // Grant Fortuna pass season XP for completing this contract and persist it, so the
+        // pass level (derived client-side from FortunaPass{season}_SeasonXp) actually moves.
+        // No exact rate ships in the data, so scale it to the contract's reputation value.
+        var seasonXp = int.TryParse(userData[seasonXpKey].Value, out var currentSeasonXp) ? currentSeasonXp : 0;
+        seasonXp += contract.ReputationIncrease * 10;
+
        await _userDataService.UpdateAsync(
            userId, userId,
            new Dictionary<string, string>{
@@ -279,6 +292,7 @@ public class ClaimActiveContract : ICloudScriptFunction<FYClaimCompletedActiveCo
                ["Inventory"] = JsonSerializer.Serialize(newInventory),
                [factionKey] = JsonSerializer.Serialize(factionProgression),
                ["JobBoardsData"] = JsonSerializer.Serialize(jobBoardsData),
+                [seasonXpKey] = JsonSerializer.Serialize(seasonXp),
            }
        );

@@ -297,7 +311,7 @@ public class ClaimActiveContract : ICloudScriptFunction<FYClaimCompletedActiveCo
                CurrentProgression = factionProgression,
            },
            Status = 18, // EYClaimContractRewardsStatus::OK
-            UpdatedSeasonXp = 0 // TODO: Probably a separate season XP rate configured by server?
+            UpdatedSeasonXp = seasonXp // new season XP total (client derives the pass level from it)
        };
    }
 }
@@ -1,6 +1,8 @@
-using Prospect.Server.Api.Services.Auth.Extensions;
+using System.Text.Json;
+using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.CloudScript.Models;
 using Prospect.Server.Api.Services.CloudScript.Models.Data;
+using Prospect.Server.Api.Services.UserData;

 namespace Prospect.Server.Api.Services.CloudScript.Functions;

@@ -8,13 +10,15 @@ namespace Prospect.Server.Api.Services.CloudScript.Functions;
 public class GetCraftingInProgressData : ICloudScriptFunction<FYGetCraftingInProgressDataRequest, FYGetCraftingInProgressDataResult>
 {
    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;

-    public GetCraftingInProgressData(IHttpContextAccessor httpContextAccessor)
+    public GetCraftingInProgressData(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
    {
        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
    }

-    public Task<FYGetCraftingInProgressDataResult> ExecuteAsync(FYGetCraftingInProgressDataRequest request)
+    public async Task<FYGetCraftingInProgressDataResult> ExecuteAsync(FYGetCraftingInProgressDataRequest request)
    {
        var context = _httpContextAccessor.HttpContext;
        if (context == null)
@@ -22,11 +26,20 @@ public class GetCraftingInProgressData : ICloudScriptFunction<FYGetCraftingInPro
            throw new CloudScriptException("CloudScript was not called within a http request");
        }

-        return Task.FromResult(new FYGetCraftingInProgressDataResult
+        var userId = context.User.FindAuthUserId();
+
+        // Return the persisted in-progress craft (written by StartItemCraftingClient)
+        // instead of an empty stub, so the crafting timer survives a menu reopen / relog.
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string> { "CraftingTimer__2022_05_12" });
+        // Fully qualified: a different FYItemCurrentlyBeingCrafted also exists in this namespace.
+        var craft = JsonSerializer.Deserialize<Models.Data.FYItemCurrentlyBeingCrafted>(userData["CraftingTimer__2022_05_12"].Value)
+                    ?? new Models.Data.FYItemCurrentlyBeingCrafted();
+
+        return new FYGetCraftingInProgressDataResult
        {
-            UserId = context.User.FindAuthUserId(),
+            UserId = userId,
            Error = string.Empty,
-            ItemCurrentlyBeingCrafted = {},
-        });
+            ItemCurrentlyBeingCrafted = craft,
+        };
    }
 }
@@ -32,9 +32,8 @@ public class GetFriendList : ICloudScriptFunction<FYBaseSocialRequest, object?>
        }
        var userId = context.User.FindAuthUserId();

-        // Resolve the imported Steam friends (persisted by ClientsideFriendsImport) to the
-        // players that actually exist on this server. It's a private server, so only friends
-        // who have logged in here will show up.
+        // Imported Steam friends (persisted by ClientsideFriendsImport), resolved to players
+        // that actually exist on this private server.
        var steamIds = new List<string>();
        var userData = await _userDataService.FindAsync(userId, userId, new List<string> { "ImportedSteamFriends" });
        if (userData.TryGetValue("ImportedSteamFriends", out var rec) && !string.IsNullOrWhiteSpace(rec.Value))
@@ -47,25 +46,74 @@ public class GetFriendList : ICloudScriptFunction<FYBaseSocialRequest, object?>
        if (steamIds.Count > 0)
        {
            var players = await _userService.FindManyAsync(PlayFabUserAuthType.Steam, steamIds);
+            var nowUtc = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
            foreach (var player in players)
            {
                if (player.Id == userId) continue; // never list yourself
+
+                var steamId = player.Auth?.FirstOrDefault(a => a.Type == PlayFabUserAuthType.Steam)?.Key ?? "";
+                var displayName = string.IsNullOrWhiteSpace(player.DisplayName) ? "Prospector" : player.DisplayName;
+
+                // 0 = offline, 1 = online, 2 = in match. Online if seen in the last 3 minutes.
+                var onlineState = 0;
+                var presenceData = await _userDataService.FindAsync(player.Id, player.Id, new List<string> { "PresenceState" });
+                if (presenceData.TryGetValue("PresenceState", out var presenceRec) && !string.IsNullOrWhiteSpace(presenceRec.Value))
+                {
+                    try
+                    {
+                        var presence = JsonSerializer.Deserialize<PlayerPresenceState>(presenceRec.Value);
+                        if (presence != null && nowUtc - presence.LastSeenUtc <= 180)
+                        {
+                            onlineState = presence.InMatch ? 2 : 1;
+                        }
+                    }
+                    catch { /* ignore malformed presence */ }
+                }
+
+                // The exact model the UE client binds is not documented, so expose the identity
+                // under every plausible field name (camelCase + PlayFab PascalCase) and both a
+                // flat and nested profile — whichever the client reads, the tile gets populated.
                friends.Add(new
                {
-                    profile = new
-                    {
+                    // identity
+                    friendPlayFabId = player.Id,
+                    FriendPlayFabId = player.Id,
                    playerId = player.Id,
-                        displayName = player.DisplayName,
+                    PlayerId = player.Id,
+                    playFabId = player.Id,
+                    PlayFabId = player.Id,
+                    // name
+                    displayName,
+                    DisplayName = displayName,
+                    titleDisplayName = displayName,
+                    TitleDisplayName = displayName,
+                    name = displayName,
+                    username = displayName,
+                    Username = displayName,
+                    // steam
+                    steamId,
+                    SteamId = steamId,
+                    steamInfo = new { steamId, SteamId = steamId },
+                    SteamInfo = new { SteamId = steamId, steamId },
+                    // presence
+                    onlineState,
+                    OnlineState = onlineState,
+                    isOnline = onlineState > 0,
+                    inMatch = onlineState == 2,
+                    presence = new { onlineState, state = onlineState },
                    avatarUrl = "",
-                    },
-                    onlineState = 0, // EYUserState — real presence tracking is a later phase
+                    // nested profiles
+                    profile = new { playerId = player.Id, displayName, avatarUrl = "" },
+                    Profile = new { PlayerId = player.Id, DisplayName = displayName, PlayerProfileModel = new { DisplayName = displayName } },
+                    tags = Array.Empty<string>(),
+                    Tags = Array.Empty<string>(),
                });
            }
        }

-        // NOTE: the exact response shape the client expects is not yet confirmed; this is a
-        // best-effort structure. The log lets us verify resolution while we validate in game.
-        _logger.LogInformation("GetFriendList for {User}: {Count} friend(s) resolved on server", userId, friends.Count);
-        return new { friends };
+        // Return the list under both the camelCase and PlayFab-cased container keys.
+        var result = new { friends, Friends = friends, count = friends.Count };
+        _logger.LogInformation("GetFriendList for {User}: {Count} friend(s); payload={Json}", userId, friends.Count, JsonSerializer.Serialize(result));
+        return result;
    }
 }
@@ -1,5 +1,7 @@
-using Prospect.Server.Api.Services.Auth.Extensions;
+using System.Text.Json;
+using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.UserData;

 namespace Prospect.Server.Api.Services.CloudScript.Functions;

@@ -7,43 +9,53 @@ namespace Prospect.Server.Api.Services.CloudScript.Functions;
 public class GetPlayerSets : ICloudScriptFunction<FYGetPlayersSets, object?>
 {
    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;

-    public GetPlayerSets(IHttpContextAccessor httpContextAccessor)
+    public GetPlayerSets(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
    {
        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
    }

-    public Task<object?> ExecuteAsync(FYGetPlayersSets request)
+    public async Task<object?> ExecuteAsync(FYGetPlayersSets request)
    {
        var context = _httpContextAccessor.HttpContext;
        if (context == null)
        {
-            return Task.FromResult<object?>(null);
+            return null;
        }

-        return Task.FromResult<object?>(new
+        var userId = context.User.FindAuthUserId();
+
+        // Return the player's persisted loadout (written by CompleteInventoryUpdate /
+        // RequestUpdateStationInventory) instead of a blank set, so saved gear survives
+        // a menu reopen / relog. Same response shape as before, just populated.
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string> { "LOADOUT" });
+        var loadout = JsonSerializer.Deserialize<LoadoutData>(userData["LOADOUT"].Value) ?? new LoadoutData();
+
+        return new
        {
            success = true,
-            entries = new []
+            entries = new[]
            {
                new
                {
                    setData = new
                    {
                        id = "",
-                        userId = context.User.FindAuthUserId(),
+                        userId,
                        kit = "",
-                        shield = "",
-                        helmet = "",
-                        weaponOne = "",
-                        weaponTwo = "",
-                        bag = "",
-                        bagItemsAsJsonStr = "",
-                        safeItemsAsJsonStr = ""
+                        shield = loadout.Shield ?? "",
+                        helmet = loadout.Helmet ?? "",
+                        weaponOne = loadout.WeaponOne ?? "",
+                        weaponTwo = loadout.WeaponTwo ?? "",
+                        bag = loadout.Bag ?? "",
+                        bagItemsAsJsonStr = loadout.BagItemsAsJsonStr ?? "",
+                        safeItemsAsJsonStr = loadout.SafeItemsAsJsonStr ?? ""
                    },
                    items = Array.Empty<object>()
                }
            }
-        });
+        };
    }
 }
@@ -8,13 +8,8 @@ public class GetPlayerStatisticsRequestsClientRequest
    public string[] Statistics { get; set; }
 }

-public class GetPlayerStatisticsRequestsClientResponse
-{
-    // TODO: Unknown structure
-}
-
 [CloudScriptFunction("GetPlayerStatisticsRequestsClient")]
-public class GetPlayerStatisticsRequestsClientFunction : ICloudScriptFunction<GetPlayerStatisticsRequestsClientRequest, GetPlayerStatisticsRequestsClientResponse>
+public class GetPlayerStatisticsRequestsClientFunction : ICloudScriptFunction<GetPlayerStatisticsRequestsClientRequest, object>
 {
    private readonly IHttpContextAccessor _httpContextAccessor;

@@ -23,7 +18,7 @@ public class GetPlayerStatisticsRequestsClientFunction : ICloudScriptFunction<Ge
        _httpContextAccessor = httpContextAccessor;
    }

-    public async Task<GetPlayerStatisticsRequestsClientResponse> ExecuteAsync(GetPlayerStatisticsRequestsClientRequest request)
+    public Task<object> ExecuteAsync(GetPlayerStatisticsRequestsClientRequest request)
    {
        var context = _httpContextAccessor.HttpContext;
        if (context == null)
@@ -31,8 +26,15 @@ public class GetPlayerStatisticsRequestsClientFunction : ICloudScriptFunction<Ge
            throw new CloudScriptException("CloudScript was not called within a http request");
        }

-        return new GetPlayerStatisticsRequestsClientResponse
+        // Return each requested statistic with a value so the career screen renders instead
+        // of staying blank. Raid stats (kills/deaths/evacs/damage/…) come from the
+        // client-hosted raid and aren't tracked server-side, so they report 0 for now.
+        var stats = new List<object>();
+        foreach (var name in request.Statistics ?? Array.Empty<string>())
        {
-        };
+            stats.Add(new { statisticName = name, value = 0 });
+        }
+
+        return Task.FromResult<object>(new { statistics = stats });
    }
 }
@@ -155,12 +155,14 @@ public class PurchaseWeaponShopItemFunction : ICloudScriptFunction<PurchaseWeapo
        var blueprintData = blueprints[request.BaseItemID];

        // Contract unlock criteria: some items can only be purchased after completing a
-        // specific contract. Only gate when the item explicitly declares such a lock, so
-        // items with no lock keep working as before.
-        if (!string.IsNullOrEmpty(blueprintData.UnlockData?.ContractLockPurchase))
+        // specific contract. The data uses the sentinel "None" (not an empty string) for
+        // items with no lock — treat that (and null/empty) as "no lock", otherwise EVERY
+        // item gets gated and nothing can be bought.
+        var contractLockPurchase = blueprintData.UnlockData?.ContractLockPurchase;
+        if (!string.IsNullOrEmpty(contractLockPurchase) && contractLockPurchase != "None")
        {
            var completed = JsonSerializer.Deserialize<FYGetCompletedContractsResult>(userData["ContractsOneTimeCompleted"].Value);
-            if (completed?.ContractsIDs == null || !completed.ContractsIDs.Contains(blueprintData.UnlockData.ContractLockPurchase))
+            if (completed?.ContractsIDs == null || !completed.ContractsIDs.Contains(contractLockPurchase))
            {
                return new PurchaseWeaponShopItemResponse
                {
@@ -1,12 +1,51 @@
-using Prospect.Server.Api.Services.CloudScript.Models;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.UserData;

 namespace Prospect.Server.Api.Services.CloudScript.Functions;

+// Persisted presence, read back by GetFriendList to show friends' online / in-match state.
+public class PlayerPresenceState
+{
+    [JsonPropertyName("inMatch")]
+    public bool InMatch { get; set; }
+    [JsonPropertyName("lastSeenUtc")]
+    public long LastSeenUtc { get; set; }
+}
+
 [CloudScriptFunction("UpdatePlayerPresenceState")]
 public class UpdatePlayerPresenceState : ICloudScriptFunction<FYUpdatePlayerPresenceStateRequest, object>
 {
-    public Task<object> ExecuteAsync(FYUpdatePlayerPresenceStateRequest request)
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+
+    public UpdatePlayerPresenceState(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
    {
-        return Task.FromResult<object>(new { });
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+    }
+
+    public async Task<object> ExecuteAsync(FYUpdatePlayerPresenceStateRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            return new { };
+        }
+
+        var userId = context.User.FindAuthUserId();
+        var state = new PlayerPresenceState
+        {
+            InMatch = request.InMatch,
+            LastSeenUtc = DateTimeOffset.UtcNow.ToUnixTimeSeconds(),
+        };
+        await _userDataService.UpdateAsync(
+            userId, userId,
+            new Dictionary<string, string> { ["PresenceState"] = JsonSerializer.Serialize(state) }
+        );
+
+        return new { };
    }
 }
@@ -16,6 +16,12 @@ public class DbEntityService : BaseDbService<PlayFabEntity>
        return await Collection.Find(user => user.UserId == userId).SingleOrDefaultAsync();
    }

+    // Admin back-office: list every entity (title_player_account).
+    public async Task<List<PlayFabEntity>> GetAllAsync()
+    {
+        return await Collection.Find(_ => true).ToListAsync();
+    }
+
    private async Task<PlayFabEntity> CreateAsync(string userId)
    {
        var user = new PlayFabEntity
@@ -46,6 +46,19 @@ public class DbUserDataService : BaseDbService<PlayFabUserData>
        return await query.ToCursorAsync();
    }

+    // Admin back-office: every key/value stored for a player.
+    public async Task<List<PlayFabUserData>> GetAllForUserAsync(string playFabId)
+    {
+        return await Collection.Find(data => data.PlayFabId == playFabId)
+            .SortBy(data => data.Key).ToListAsync();
+    }
+
+    // Admin back-office: total stored key/value documents.
+    public async Task<long> CountAsync()
+    {
+        return await Collection.CountDocumentsAsync(_ => true);
+    }
+
    public async Task UpdateValueAsync(string dataId, string value)
    {
        var update = Builders<PlayFabUserData>.Update
@@ -24,6 +24,20 @@ public class DbUserService : BaseDbService<PlayFabUser>
        return await Collection.Find(user => user.Id == id).FirstOrDefaultAsync();
    }

+    // Admin back-office: list every player.
+    public async Task<List<PlayFabUser>> GetAllAsync()
+    {
+        return await Collection.Find(_ => true).ToListAsync();
+    }
+
+    // Persist a display-name change (UpdateUserTitleDisplayName). Without this the rename
+    // is echoed back to the client but lost on next login.
+    public async Task UpdateDisplayNameAsync(string id, string displayName)
+    {
+        var update = Builders<PlayFabUser>.Update.Set(user => user.DisplayName, displayName);
+        await Collection.UpdateOneAsync(user => user.Id == id, update);
+    }
+
    private async Task<PlayFabUser> CreateAsync(PlayFabUserAuthType type, string key)
    {
        var user = new PlayFabUser
@@ -0,0 +1,49 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace Prospect.Server.Api.Services.GameRef;
+
+// One reference entry: readable name, rarity, category. Sourced from community-datamined
+// data (TCF-Wiki), bundled as Data/gameref.json. Compact keys n/r/c to keep the file small.
+public class GameRefEntry
+{
+    [JsonPropertyName("n")] public string Name { get; set; } = "";
+    [JsonPropertyName("r")] public string Rarity { get; set; } = "";
+    [JsonPropertyName("c")] public string Category { get; set; } = "";
+}
+
+// Resolves internal item / vanity ids to readable names for the admin back-office.
+public class GameRefService
+{
+    private readonly Dictionary<string, GameRefEntry> _ref = new(StringComparer.OrdinalIgnoreCase);
+
+    public GameRefService(ILogger<GameRefService> logger)
+    {
+        try
+        {
+            var path = Path.Combine(AppContext.BaseDirectory, "Data", "gameref.json");
+            if (File.Exists(path))
+            {
+                var data = JsonSerializer.Deserialize<Dictionary<string, GameRefEntry>>(File.ReadAllText(path));
+                if (data != null)
+                {
+                    foreach (var kv in data)
+                    {
+                        _ref[kv.Key] = kv.Value;
+                    }
+                }
+            }
+            logger.LogInformation("GameRef loaded {Count} entries", _ref.Count);
+        }
+        catch (Exception e)
+        {
+            logger.LogWarning(e, "GameRef load failed");
+        }
+    }
+
+    public GameRefEntry? Get(string? id) => id != null && _ref.TryGetValue(id, out var e) ? e : null;
+
+    public string Name(string? id) => Get(id)?.Name ?? id ?? "";
+
+    public IReadOnlyDictionary<string, GameRefEntry> All => _ref;
+}
@@ -0,0 +1,55 @@
+using System.Text.Json;
+
+namespace Prospect.Server.Api.Services.Steam;
+
+// Resolves a Steam persona (display) name from a SteamID64 via the Steam Web API.
+// PlayFab does this server-side too; our emulator only gets the SteamID from the auth
+// ticket, so the real name needs an API key. Inert (no-op) when no key is configured.
+public class SteamWebApiService
+{
+    private static readonly HttpClient Http = new() { Timeout = TimeSpan.FromSeconds(5) };
+
+    private readonly string? _apiKey;
+    private readonly ILogger<SteamWebApiService> _logger;
+
+    public SteamWebApiService(IConfiguration configuration, ILogger<SteamWebApiService> logger)
+    {
+        _apiKey = configuration["SteamWebApiKey"];
+        _logger = logger;
+    }
+
+    public bool Enabled => !string.IsNullOrWhiteSpace(_apiKey);
+
+    public async Task<string?> GetPersonaNameAsync(string steamId64)
+    {
+        if (!Enabled)
+        {
+            return null;
+        }
+
+        try
+        {
+            var url = $"https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key={_apiKey}&steamids={steamId64}";
+            var json = await Http.GetStringAsync(url);
+            using var doc = JsonDocument.Parse(json);
+            if (doc.RootElement.TryGetProperty("response", out var response) &&
+                response.TryGetProperty("players", out var players) &&
+                players.ValueKind == JsonValueKind.Array)
+            {
+                foreach (var player in players.EnumerateArray())
+                {
+                    if (player.TryGetProperty("personaname", out var name))
+                    {
+                        return name.GetString();
+                    }
+                }
+            }
+        }
+        catch (Exception e)
+        {
+            _logger.LogWarning(e, "Steam GetPlayerSummaries failed for {SteamId}", steamId64);
+        }
+
+        return null;
+    }
+}
@@ -30,6 +30,9 @@ public class Startup
        services.AddSingleton<UserDataService>();
        services.AddSingleton<TitleDataService>();

+        services.AddSingleton<Prospect.Server.Api.Services.Steam.SteamWebApiService>();
+        services.AddSingleton<Prospect.Server.Api.Services.GameRef.GameRefService>();
+
        services.AddSingleton<DbUserService>();
        services.AddSingleton<DbEntityService>();
Author	SHA1	Message	Date
neckfireandClaude Opus 4.8	3243b70555	game-server: catch-all request capture for squad-invite RE Build & Deploy / build (push) Successful in 50s Details Log every unrouted POST at Warning [CAPTURE UNROUTED] (reveals native PlayFab endpoints the emulator doesn't implement, e.g. /Group/CreateGroup, /Lobby/*) and every social/squad/invite/friend/matchmaking call (path or body) at Information [CAPTURE SOCIAL]. Lets us pin the exact invite mechanism when reproduced in game. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-16 11:45:24 +02:00
neckfireandClaude Opus 4.8	d7821ebf1f	friends: richer GetFriendList payload (field aliases) + log returned JSON Build & Deploy / build (push) Successful in 53s Details The friend tile rendered empty/offline because the UE client couldn't read our best-guess response shape. Expose each friend's identity/name/steam/presence under every plausible field name (camelCase + PlayFab PascalCase, flat + nested profile) under both friends/Friends keys, and log the JSON so we can pin the exact shape. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-16 09:06:17 +02:00
neckfireandClaude Opus 4.8	81092b077e	fortuna: add FortunaPass2_Rewards catalog so tiers can be claimed Build & Deploy / build (push) Successful in 50s Details The claim function only grants a tier when a FortunaPass2_Rewards TitleData catalog maps its rewardId (Level_N, sent by the client) to an item/amount. That catalog was absent (client-side DataTable) so claims granted nothing and stayed unclaimable. Add a Level_1..Level_100 catalog (K-Marks scaling, Insurance every 5, Aurum every 10) so players can actually collect Fortuna pass rewards. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-15 22:17:34 +02:00
neckfireandClaude Opus 4.8	95541b6221	docs: rewrite README around our build/CI + client switch tool Build & Deploy / build (push) Successful in 32s Details Replace the upstream Windows/local-run README with a dev-focused one: how the client redirection works (loader+agent+backend.txt), repo structure, building and running the API in a container, the TLS cert SAN gotcha, the Gitea CI/CD branch model (preprod:preprod / main:latest), the Prospect.Client.Config switch+cert tool, and an up-to-date feature status. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-15 13:54:36 +02:00
neckfireandClaude Opus 4.8	a8fca38038	admin: fix empty tables — define DT engine before page init scripts Build & Deploy / build (push) Successful in 43s Details The DT table engine lived in the page footer, after the per-page <script>DT.init(...)</script> in the body, so DT was undefined when init ran (ReferenceError, nothing rendered). Move the engine into a DtScript const injected right after <main>, before any body content, so it is always defined first. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-15 11:51:58 +02:00
neckfireandClaude Opus 4.8	b5c295f45c	admin: interactive tables (sort/filter/search/paging) via client-side JS engine Build & Deploy / build (push) Successful in 42s Details Players and Catalog pages now fetch /admin/api/{players,catalog} JSON and render a self-contained vanilla-JS data table: clickable column sort, live search, dropdown filters (auth / category / rarity), page-size selector + prev/next paging, result count. No CDN, works offline. Server-rendered dashboard, player detail and titledata pages unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-15 11:30:22 +02:00
neckfireandClaude Opus 4.8	0b771c5447	feat(admin): resolve item/vanity ids to readable names + catalog browser Build & Deploy / build (push) Successful in 42s Details Bundle a compact id -> {name,rarity,category} lookup (Data/gameref.json, 1177 entries, built from community-datamined TCF-Wiki data) and a GameRefService. The admin back-office now shows readable names + coloured rarity for inventory items instead of raw ids, and a new /admin/catalog page browses the known game catalog (searchable, by category). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-15 11:19:14 +02:00
neckfireandClaude Opus 4.8	4614b135a1	feat: resolve player display names from Steam persona (Steam Web API) Build & Deploy / build (push) Successful in 41s Details Accounts were created as 'Unknown' and the client never sends a name, so the admin panel / friends / squad showed no names. Add SteamWebApiService (GetPlayerSummaries), wired into LoginWithSteam to backfill the DisplayName from the Steam persona when it's still 'Unknown'. Admin gets a LAN-only /admin/backfill-names action (+ button) to backfill existing accounts in one shot. Key read from config SteamWebApiKey (Vault -> env), inert when unset. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-15 10:25:52 +02:00
neckfireandClaude Opus 4.8	b8d023b02a	feat(admin): read-only back-office at /admin (LAN-only) Build & Deploy / build (push) Successful in 38s Details Filament-style dark UI served directly by the API: - Dashboard: player/entity/userdata/titledata counts + recent players - /admin/players: searchable player list (name/id/steam) - /admin/players/{id}: full player view — balance/faction/Fortuna cards, inventory table, and every UserData key pretty-printed (collapsible) - /admin/titledata + /admin/titledata/{key}: browse in-memory title data Restricted to LAN/loopback callers (RemoteIpAddress check) so it is never reachable from the public internet even though :8443 is port-forwarded. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-15 09:56:34 +02:00
neckfireandClaude Opus 4.8	0a68a97291	fix(audit léger): stats carrière, présence amis, AddGenericId Build & Deploy / build (push) Successful in 43s Details - GetPlayerStatisticsRequestsClient: renvoyait vide -> renvoie les stats demandées (0 pour l'instant, raid client-hosted non traçable) pour que l'écran carrière s'affiche. - UpdatePlayerPresenceState: persiste {inMatch,lastSeenUtc}; GetFriendList lit la présence et calcule onlineState (online si vu <3min, 2=en raid) au lieu de 0 en dur. - AddGenericId: persiste l'id de service lié (était un no-op). (Free-loadout non touché: S3 only, pas de free-loadout en S2.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-15 09:02:45 +02:00
neckfireandClaude Opus 4.8	1b4c1b2606	fix(audit): Fortuna pass level, display-name persist, loadout & craft-timer queries Build & Deploy / build (push) Successful in 39s Details Audit of the emulator surface + 4 fixes: - Fortuna pass level was frozen: nothing ever granted season XP. ClaimActiveContract now grants + persists FortunaPass{2,3}_SeasonXp (scaled to the contract's reputation) and returns the new total, so the pass level moves as you complete contracts. - UpdateUserTitleDisplayName never persisted the rename (echoed back, lost on relog). Added DbUserService.UpdateDisplayNameAsync and call it. - GetPlayerSets returned a blank loadout; now reads the persisted LOADOUT key. - GetCraftingInProgressData was a stub; now returns the persisted CraftingTimer so an in-progress craft + remaining time survive a menu reopen/relog. Remaining known gaps documented in Plane (need client data / multiplayer / out of scope). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-15 02:56:47 +02:00
neckfireandClaude Opus 4.8	14ab3267f4	fix(shop): don't treat ContractLockPurchase sentinel 'None' as a real lock Build & Deploy / build (push) Successful in 34s Details Regression from the contract-lock feature: the check gated on any non-empty ContractLockPurchase, but the blueprint data uses the string "None" (not "") for items with no lock (749/773 items). So virtually every item returned 'Item is locked' before the currency deduction -> players couldn't buy anything (error shown, K-Marks unchanged). Skip the gate when the value is null/empty/"None". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-15 02:15:13 +02:00