Add Rz Coin utility store

api/QuestionsApi/Controllers/CreditsController.cs

@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using QuestionsApi.Services;
+using QuestionsApi.Models;
 using System.Security.Claims;
 
 namespace QuestionsApi.Controllers;
@@ -8,13 +9,50 @@ namespace QuestionsApi.Controllers;
 [ApiController]
 [Route("api/credits")]
 [Authorize(Roles = "USER,SUPER")]
-public sealed class CreditsController(CreditStore credits) : ControllerBase
+public sealed class CreditsController(CreditStore credits, ExamSimulationStore simulations) : ControllerBase
 {
     [HttpGet]
     public async Task<IActionResult> Get() => Ok(await credits.GetStatusAsync(UserId()));
 
+    [HttpPost("purchases")]
+    public async Task<IActionResult> Purchase([FromBody] CreditPurchaseRequest request)
+    {
+        var product = CreditEconomy.FindProduct(request.Sku);
+        if (product is null) return BadRequest(new { code = "unknown_sku", message = "Unknown store product." });
+        if (!ValidOperationId(request.OperationId))
+            return BadRequest(new { code = "invalid_operation_id", message = "A valid operation ID is required." });
+        var result = await credits.PurchaseAsync(UserId(), product, request.OperationId);
+        return result.Result switch
+        {
+            CreditOperationResult.Succeeded => Ok(result.Status),
+            CreditOperationResult.InsufficientCredits => Conflict(new
+                { code = "insufficient_coins", message = "Not enough Rz Coins.", credits = result.Status }),
+            _ => Conflict(new
+                { code = "operation_conflict", message = "That operation ID was already used.", credits = result.Status })
+        };
+    }
+
+    [HttpPost("qbank-reset")]
+    public async Task<IActionResult> ResetQBank([FromBody] QBankResetRequest request)
+    {
+        if (request.Confirmation != "RESET_QBANK")
+            return BadRequest(new { code = "confirmation_required", message = "Enter RESET_QBANK to confirm." });
+        if (!ValidOperationId(request.OperationId))
+            return BadRequest(new { code = "invalid_operation_id", message = "A valid operation ID is required." });
+        if (await simulations.FindActiveAsync(UserId()) is not null)
+            return Conflict(new { code = "active_exam", message = "Finish or end the active exam before resetting the QBank." });
+        var result = await credits.ApplyQBankResetAsync(UserId(), request.OperationId);
+        return result.Result == CreditOperationResult.Succeeded
+            ? Ok(result.Status)
+            : Conflict(new
+                { code = "reset_token_required", message = "A QBank Reset Token is required.", credits = result.Status });
+    }
+
     private string UserId() => User.FindFirstValue(ClaimTypes.NameIdentifier)
         ?? User.FindFirstValue(ClaimTypes.Name)
         ?? User.Identity?.Name
         ?? throw new UnauthorizedAccessException();
+
+    private static bool ValidOperationId(string value) =>
+        !string.IsNullOrWhiteSpace(value) && value.Length <= 100;
 }

api/QuestionsApi/Controllers/ExamSimulationsController.cs

@@ -9,7 +9,7 @@ namespace QuestionsApi.Controllers;
 [ApiController]
 [Route("api/exam-simulations")]
 [Authorize(Roles = "USER,SUPER")]
-public class ExamSimulationsController(ExamSimulationStore simulations) : ControllerBase
+public class ExamSimulationsController(ExamSimulationStore simulations, CreditStore credits) : ControllerBase
 {
     [HttpGet("readiness")]
     public async Task<IActionResult> Readiness() => Ok(await simulations.GetReadinessAsync(UserId()));
@@ -17,12 +17,33 @@ public class ExamSimulationsController(ExamSimulationStore simulations) : Contro
     [HttpPost]
     public async Task<IActionResult> Create()
     {
+        var userId = UserId();
+        if (await simulations.FindActiveAsync(userId) is not null)
+            return Conflict(new { code = "active_exam", message = "An active Step 3 simulation already exists." });
+        var operationId = $"exam-create:{Guid.NewGuid():N}";
+        var bypass = User.IsInRole("SUPER");
+        if (!bypass && !await credits.TryConsumeExamTokenAsync(userId, operationId))
+            return Conflict(new
+            {
+                code = "exam_token_required",
+                message = "An Exam Simulation Token is required.",
+                credits = await credits.GetStatusAsync(userId)
+            });
         try
         {
-            var simulation = await simulations.CreateAsync(UserId());
+            var simulation = await simulations.CreateAsync(userId);
             return Ok(await simulations.ToResponseAsync(simulation));
         }
-        catch (InvalidOperationException exception) { return Conflict(exception.Message); }
+        catch (InvalidOperationException exception)
+        {
+            if (!bypass) await credits.RefundExamTokenAsync(userId, operationId);
+            return Conflict(new { code = "exam_creation_failed", message = exception.Message });
+        }
+        catch
+        {
+            if (!bypass) await credits.RefundExamTokenAsync(userId, operationId);
+            throw;
+        }
     }
 
     [HttpGet("preview-results")]

api/QuestionsApi/Controllers/QuestionsController.cs

@@ -157,7 +157,8 @@ public class QuestionsController : ControllerBase
             req.ChoiceId.Trim() == question.CorrectChoiceId,
             false,
             presentedChoiceIds,
-            req.DurationSeconds);
+            req.DurationSeconds,
+            await _credits.GetBankCycleAsync(userId));
         if (record.Inserted)
         {
             _metrics.AttemptCreated();
@@ -276,7 +277,8 @@ public class QuestionsController : ControllerBase
             userId,
             "",
             false,
-            true);
+            true,
+            bankCycle: await _credits.GetBankCycleAsync(userId));
         if (record.Inserted)
             _metrics.AttemptCreated();
         else