Loading Scratch Cards runtime…
engineering.case-study
Inside the Scratch Cards system boundary.
What the player experiences, what the implementation actually owns, and where production responsibilities would begin.
Scratch cards are instant-win games that reveal a concealed symbol layout. From a software perspective, the important problem is preserving the sealed outcome while allowing progressive, authorized reveals without leaking unrevealed symbols.
- Create a card with a virtual stake.
- The server seals nine weighted symbols before the first reveal.
- Reveal cells individually or request the remaining cells.
- When the card is complete, matching symbol groups are evaluated and the payout is returned.
The NestJS service keeps a ScratchCardsGame and activity timestamps in an in-memory session map. Unrevealed cells are masked in API state; reveal commands expose only the requested server-owned symbols.
ClientREST APISealed sessionCrypto symbolsRevealPayout
- Game Client
- Presentation, input, accessibility, and demo-credit display.
- REST API
- Request validation and routing into one isolated game session.
- Game Session
- Ephemeral configuration and the previous authoritative result.
- Game Engine / RNG
- Outcome generation, game rules, win evaluation, and result contracts.
- Reveal Boundary
- Which sealed cells may be exposed in each response.
- Generate and seal the card server-side before interaction starts.
- Never send unrevealed symbols in the public state contract.
- Prevent bet changes after reveal begins.
- Use weighted symbols and an explicit paytable so outcome math is testable independently of the UI.
- A duplicate reveal returns the already-known cell rather than generating a new symbol.
- An expired gameId is rejected because the sealed card no longer exists.
- A disconnect can resume only while the in-memory session remains available and the client retains gameId.
- The demo deducts and credits locally; a production implementation would need an idempotent wager and settlement ledger.
Weighted symbols are created with backend cryptographic random bytes. The sealed state prevents the browser from choosing outcomes, but there is no public commitment/proof protocol or certification layer.
CardSession- gameId- betAmount- createdAt- lastActivityCard- symbols- revealed- statusCardWin- symbol- count- multiplier- payout