feat: implement secure item drop system with server-side validation

game_data/migrations/0008_playerpendingdrop.py

@@ -0,0 +1,30 @@
+# Generated by Django 4.2.8 on 2026-06-27 08:56
+
+from django.db import migrations, models
+import django.db.models.deletion
+import uuid
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('game_data', '0007_alter_playerprofile_class_name_and_more'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='PlayerPendingDrop',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('instance_id', models.UUIDField(default=uuid.uuid4, editable=False, unique=True)),
+                ('item_data', models.JSONField(blank=True, default=dict, null=True)),
+                ('gold_amount', models.PositiveIntegerField(default=0)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('owner', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='pending_drops', to='game_data.playerprofile')),
+            ],
+            options={
+                'db_table': 'player_pending_drop',
+                'ordering': ['-created_at'],
+            },
+        ),
+    ]

game_data/models.py

@@ -151,3 +151,25 @@ class Meta:
 
     def __str__(self) -> str:
         return f"Listing {self.pk} {self.status} {self.price}"
+
+
+class PlayerPendingDrop(models.Model):
+    owner = models.ForeignKey(
+        PlayerProfile,
+        on_delete=models.CASCADE,
+        related_name='pending_drops',
+    )
+    instance_id = models.UUIDField(default=uuid.uuid4, unique=True, editable=False)
+    item_data = models.JSONField(default=dict, blank=True, null=True) # None/empty means gold
+    gold_amount = models.PositiveIntegerField(default=0)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+    class Meta:
+        db_table = 'player_pending_drop'
+        ordering = ['-created_at']
+
+    def __str__(self) -> str:
+        if self.gold_amount > 0:
+            return f"Pending Gold {self.gold_amount} for {self.owner.user.username} ({self.instance_id})"
+        return f"Pending Item {(self.item_data or {}).get('name', 'Unknown')} for {self.owner.user.username} ({self.instance_id})"
+

game_data/serializers.py

@@ -119,6 +119,12 @@ class PlayerProfileUpdateSerializer(serializers.Serializer):
     session_id = serializers.CharField(required=False, allow_blank=False, max_length=64)
     sequence = serializers.IntegerField(required=False, min_value=0)
 
+    # Secure drop claims
+    claimed_drops = serializers.ListField(
+        child=serializers.CharField(),
+        required=False,
+    )
+
     def validate(self, attrs):
         hp_max = attrs.get('hp_max')
         hp_current = attrs.get('hp_current')

game_data/tests.py

@@ -65,6 +65,67 @@ def test_patch_profile_with_sequence_is_idempotent(self):
         self.assertFalse(first.data['ignored'])
         self.assertTrue(second.data['ignored'])
 
+    def test_patch_profile_rejects_excessive_gold(self):
+        self.authenticate()
+        response = self.client.patch(
+            self.url,
+            {'gold': 999999},
+            format='json',
+        )
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertTrue(response.data['ignored'])
+        self.assertEqual(response.data['reason'], 'invalid_gold_gain')
+
+    def test_patch_profile_rejects_excessive_hp_max(self):
+        self.authenticate()
+        response = self.client.patch(
+            self.url,
+            {'hp_max': 99999},
+            format='json',
+        )
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertTrue(response.data['ignored'])
+        self.assertEqual(response.data['reason'], 'invalid_hp_max')
+
+    def test_patch_profile_rejects_level_jump(self):
+        self.authenticate()
+        response = self.client.patch(
+            self.url,
+            {'level': 10},
+            format='json',
+        )
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertTrue(response.data['ignored'])
+        self.assertEqual(response.data['reason'], 'invalid_level_jump')
+
+    def test_patch_profile_rejects_hacked_item_spawn(self):
+        self.authenticate()
+        # Spawn an equipment with 9999 ATK
+        response = self.client.patch(
+            self.url,
+            {
+                'inventory_items': [
+                    {
+                        'instance_id': '99999999-9999-9999-9999-999999999999',
+                        'name': 'God Sword',
+                        'item_type': 'weapon',
+                        'rarity': 5,
+                        'level_requirement': 1,
+                        'abilities': {
+                            'atk': 9999,
+                            'def': 0,
+                            'spd': 0,
+                            'vit': 0
+                        }
+                    }
+                ]
+            },
+            format='json',
+        )
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertTrue(response.data['ignored'])
+        self.assertIn('item_validation_failed', response.data['reason'])
+
     def test_patch_profile_replaces_skills_list(self):
         self.authenticate()
         response = self.client.patch(

game_data/urls.py

@@ -7,13 +7,15 @@
     PlayerGoldView,
     PlayerInventoryView,
     PlayerProfileView,
+    PlayerDropView,
 )
 
 
 urlpatterns = [
     path('profile/', PlayerProfileView.as_view(), name='player-profile'),
     path('inventory/', PlayerInventoryView.as_view(), name='player-inventory'),
     path('gold/', PlayerGoldView.as_view(), name='player-gold'),
+    path('drop/', PlayerDropView.as_view(), name='player-drop'),
     # Marketplace
     path('marketplace/', MarketplaceListView.as_view(), name='marketplace-list'),
     path('marketplace/<int:pk>/', MarketplaceDetailView.as_view(), name='marketplace-detail'),