A universal, internationalized game aggregation platform. After registering, users top up on the platform and exchange that balance for game coins; they use the coins to play games and earn more coins, and coins can be converted back into wallet balance for withdrawal. The admin panel provides complete game management, withdrawal review, user management and payment management. Multi-language switching (English/Chinese) is supported.
Version strategy
Version
Goal
Status
Basic (MVP)
Get the core loop working: register → top up → exchange → play → withdraw → review
Done
Standard
Production-ready: global payments, third-party game SDKs, basic risk control, three front ends
Planned
Full
The complete version: multi-language, leaderboards, coupons, full risk control, every feature
# Create the database mysql -u root -e "CREATE DATABASE IF NOT EXISTS game_platform CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
# Run the migrations (in numeric order) mysql -u root game_platform < admin/database/migrations/2026_05_16_000000_init_tables.sql mysql -u root game_platform < admin/database/migrations/2026_05_22_000003_platform_tables.sql mysql -u root game_platform < admin/database/migrations/2026_05_22_000004_i18n_tables.sql
# Client-facing service (port 8788) cd service cp .env.example .env# edit the database connection settings composer install php start.php start -d
3. Start the frontend
1 2 3 4 5 6 7 8 9
# Admin panel (Flutter Web PC) cd admin/apps/flutter flutter pub get flutter run -d chrome
# Client user platform (Flutter Web PC) cd apps/flutter/platform flutter pub get flutter run -d chrome
4. Verify
1 2 3 4 5 6 7 8 9 10
# Test the admin panel curl http://localhost:8787/health
# Test the client-facing service curl http://localhost:8788/health
# Test user registration curl -X POST http://localhost:8788/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username":"testuser","password":"123456"}'
Security features
18 layers of defense in depth: XSS/SQL injection/CSRF/path traversal/command injection detection and blocking
HTTP method whitelist: only GET/POST/PUT/DELETE/OPTIONS/HEAD allowed
JWT authentication: access_token 2h + refresh_token 14d, with a limit on concurrent sessions
RBAC permissions: method.path granularity permission control, cached in Redis for 60s
Click captcha: mandatory human verification on login/registration
Password re-confirmation: sensitive operations require the password to be entered again
Data encryption: AES-256-CBC at the transport layer + AES-128-ECB at the storage layer
ID encryption: Snowflake generation + Hashids encoding, so IDs cannot be reverse-engineered from outside
Wallet optimistic locking: prevents concurrent debits and duplicate credits
Operation auditing: full operation logs, with automatic detection of 8 source platforms
Rate limiting: Redis sliding window, made atomic with Lua
CSP header: Content-Security-Policy to prevent XSS
Account security: 5 consecutive failed logins locks the account for 15 minutes
Business model
1 2 3 4 5 6 7 8 9 10
Fiat currency (USD/CNY/EUR...) │ Top up (Stripe/PayPal/Alipay/WeChat Pay) ▼ Platform coin (unified, precision decimal(18,4)) │ Exchange (includes the exchange rate + platform spread) ▼ Game coin (independent per game, independent exchange rate) │ Play games to earn/spend ▼ Platform coin ← convert back → withdrawal (reviewed/automatic)
