100K+ Concurrent
Multiplayer Quiz Platform

// Answer submission handler — full validation pipeline
socket.on('game:answer:submit', async ({ gameCode, qIndex, answerIdx, clientTime, answerHash }) => {
  const playerId = socket.data.playerId;  // set from JWT on connect

  // 1. Validate room state
  const room = await redis.hgetall(`room:${gameCode}`);
  if (room.state !== 'ACTIVE' || +room.currentQ !== qIndex) return;

  // 2. Anti-cheat: check not already answered this question
  const alreadyAnswered = await redis.hexists(
    `room:${gameCode}:q:${qIndex}:answers`, playerId
  );
  if (alreadyAnswered) return;

  // 3. Validate server-side deadline (client can't fake timing)
  const serverNow = Date.now();
  if (serverNow > +room.questionEndsAt + 500) return; // 500ms grace

  // 4. Validate HMAC hash (anti-replay / packet tampering)
  const expected = hmac(`${gameCode}:${playerId}:${qIndex}:${answerIdx}`);
  if (answerHash !== expected) return;

  // 5. Atomic store — HSETNX prevents race conditions
  const stored = await redis.hsetnx(
    `room:${gameCode}:q:${qIndex}:answers`,
    playerId,
    `${answerIdx}:${serverNow}`  // store server time, not client time
  );
  if (!stored) return;  // race condition — already set

  // 6. Increment distribution counter for progress bar
  await Promise.all([
    redis.incr(`room:${gameCode}:q:${qIndex}:dist:${answerIdx}`),
    redis.incr(`room:${gameCode}:q:${qIndex}:totalAnswered`),
  ]);

  // 7. Ack immediately (before reveal)
  socket.emit('game:answer:ack', { received: true, serverTime });

  // 8. Check if all players answered → early reveal
  const [answered, total] = await Promise.all([
    redis.get(`room:${gameCode}:q:${qIndex}:totalAnswered`),
    redis.scard(`room:${gameCode}:players`),
  ]);
  if (+answered >= total) triggerEarlyReveal(gameCode, qIndex);
});

interface ScoringConfig {
  basePoints:      number;  // 1000
  maxTimeBonus:    number;  // 500 — for answering instantly
  streakMultiplier:number;  // 1.5x for 3+ streak
  wrongPenalty:    number;  // 0 (no negative) or -50 for hard mode
}

async function calculateScore(
  gameCode: string, playerId: string,
  qIdx: number,   correctIdx: number,
  config: ScoringConfig
): Promise<number> {

  // Retrieve player's answer (stored with server timestamp)
  const raw = await redis.hget(
    `room:${gameCode}:q:${qIdx}:answers`, playerId
  );
  if (!raw) return 0;  // didn't answer

  const [answerIdx, submittedAt] = raw.split(':');
  if (+answerIdx !== correctIdx) return config.wrongPenalty;

  // Time bonus: full points for instant, zero at deadline
  const room      = await redis.hgetall(`room:${gameCode}`);
  const qDuration = await getQuestionDuration(room.quizId, qIdx);
  const elapsed   = +submittedAt - (+room.questionEndsAt - qDuration);
  const timeFrac  = Math.max(0, 1 - elapsed / qDuration);
  const timeBonus = Math.floor(config.maxTimeBonus * timeFrac);

  // Streak bonus from player metadata
  const streak = await redis.hget(
    `room:${gameCode}:player:${playerId}`, 'streak'
  );
  const mult = +streak >= 3 ? config.streakMultiplier : 1;

  return Math.floor((config.basePoints + timeBonus) * mult);
}

// Hash tags force related keys to same shard
// All keys for a room route to same Redis node via {gameCode}
room:{ABC123}
room:{ABC123}:players
room:{ABC123}:lb
room:{ABC123}:q:3:answers
room:{ABC123}:player:uid_xyz

// This means all room operations are local — no cross-shard transactions
// ZADD, HSET, HSETNX, INCR all execute on same shard = fast + atomic

// Leaderboard sorted set — O(log N) insertion, O(N) range query
ZADD room:{ABC123}:lb NX 0 playerId        // init score 0
ZINCRBY room:{ABC123}:lb 850 playerId      // add points atomically
ZREVRANGE room:{ABC123}:lb 0 49 WITHSCORES // top 50 in O(N)

// Throttled leaderboard broadcast — push every 2s, not on every answer
const lbKey = `lb_throttle:${gameCode}`;
const shouldSend = await redis.set(lbKey, 1, 'NX', 'EX', 2);
if (shouldSend) broadcastLeaderboard(gameCode);

-- Users
CREATE TABLE users (
  id            UUID         PRIMARY KEY DEFAULT gen_random_uuid(),
  username      VARCHAR(32)  UNIQUE NOT NULL,
  email         VARCHAR(255) UNIQUE NOT NULL,
  password_hash TEXT         NOT NULL,
  avatar_id     SMALLINT     DEFAULT 0,
  xp            INT          DEFAULT 0,
  level         SMALLINT     DEFAULT 1,
  streak        SMALLINT     DEFAULT 0,
  streak_last_at TIMESTAMPTZ,
  badges        JSONB        DEFAULT '[]',
  settings      JSONB        DEFAULT '{}',
  created_at    TIMESTAMPTZ  DEFAULT NOW(),
  last_seen_at  TIMESTAMPTZ  DEFAULT NOW()
);
CREATE INDEX idx_users_xp ON users (xp DESC);

-- Quizzes
CREATE TABLE quizzes (
  id          UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
  creator_id  UUID        REFERENCES users(id) ON DELETE CASCADE,
  title       VARCHAR(120) NOT NULL,
  description TEXT,
  category    VARCHAR(40),
  difficulty  SMALLINT    CHECK (difficulty BETWEEN 1 AND 3),
  is_public   BOOLEAN     DEFAULT TRUE,
  play_count  INT         DEFAULT 0,
  avg_score   NUMERIC(5,2),
  created_at  TIMESTAMPTZ DEFAULT NOW()
);

-- Questions (stored as JSONB array on quiz for fast reads)
CREATE TABLE questions (
  id          UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
  quiz_id     UUID        REFERENCES quizzes(id) ON DELETE CASCADE,
  position    SMALLINT    NOT NULL,
  question    TEXT        NOT NULL,
  options     JSONB       NOT NULL,  -- ["opt0","opt1","opt2","opt3"]
  correct_idx SMALLINT    NOT NULL,  -- NEVER exposed via API pre-reveal
  explanation TEXT,
  time_ms     INT         DEFAULT 20000,
  points      SMALLINT    DEFAULT 1000
);

-- Game sessions (persistent record)
CREATE TABLE game_sessions (
  id           UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
  game_code    CHAR(6)     NOT NULL,
  quiz_id      UUID        REFERENCES quizzes(id),
  host_id      UUID        REFERENCES users(id),
  player_count SMALLINT,
  final_state  JSONB,       -- full leaderboard snapshot
  started_at   TIMESTAMPTZ,
  ended_at     TIMESTAMPTZ,
  duration_ms  INT
);
CREATE INDEX idx_sessions_quiz ON game_sessions(quiz_id, started_at DESC);

-- Player game results
CREATE TABLE player_results (
  id           UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
  session_id   UUID        REFERENCES game_sessions(id) ON DELETE CASCADE,
  player_id    UUID        REFERENCES users(id),
  rank         SMALLINT,
  score        INT,
  correct_count SMALLINT,
  best_streak  SMALLINT,
  xp_earned    INT,
  answers      JSONB,       -- [{qIdx, answerIdx, correct, pts, ms}]
  created_at   TIMESTAMPTZ DEFAULT NOW()
);
CREATE INDEX idx_results_player ON player_results(player_id, created_at DESC);
CREATE INDEX idx_results_session ON player_results(session_id, rank);

// next.config.js — CDN asset configuration
const nextConfig = {
  assetPrefix: process.env.CDN_URL,  // https://cdn.quizblaze.com
  images: {
    domains: ['cdn.quizblaze.com'],
    formats: ['image/avif', 'image/webp'],
  },

  // Aggressive caching — JS/CSS chunks are content-hashed
  async headers() {
    return [{
      source: '/_next/static/:path*',
      headers: [{
        key: 'Cache-Control',
        value: 'public, max-age=31536000, immutable'  // 1 year
      }]
    }];
  }
};

// CloudFront cache behavior for game assets
# TTL: 1yr for hashed assets, 0 for API routes, 5min for HTML
# Compress: gzip + brotli enabled
# HTTP/3: enabled on all distributions
# Origin shield: us-east-1 (reduces origin hits 90%)
# Price class: PriceClass_All (all edge locations)

// WS connections bypass CDN — direct to LB via separate subdomain
// wss://ws.quizblaze.com → HAProxy → WS pods
// https://quizblaze.com  → CloudFront → Next.js → API