From 81d8137fd577b1b495d430fc399edca38e66d8b2 Mon Sep 17 00:00:00 2001
From: Ben Robson <shadowolfbusiness@gmail.com>
Date: Tue, 30 Dec 2025 08:53:16 +1100
Subject: [PATCH 1/9] Add webstore checkout and fulfillment flow

---
 api/internal_redirect/webstore.js | 258 ++++++++++++++++++++++++++
 app.js                            |  14 ++
 controllers/webstoreController.js | 291 ++++++++++++++++++++++++++++++
 cron/webstoreCommandSyncCron.js   | 102 +++++++++++
 dbinit.sql                        |  52 ++++++
 migration/v1.8.0_v1.9.0.sql       |  51 ++++++
 routes/index.js                   |   2 +
 routes/redirectRoutes.js          |   7 -
 routes/webstoreRoutes.js          | 159 ++++++++++++++++
 views/webstore/index.ejs          |  49 +++++
 views/webstore/thank-you.ejs      |  24 +++
 webstoreItems.json                |  76 ++++++++
 12 files changed, 1078 insertions(+), 7 deletions(-)
 create mode 100644 api/internal_redirect/webstore.js
 create mode 100644 controllers/webstoreController.js
 create mode 100644 cron/webstoreCommandSyncCron.js
 create mode 100644 migration/v1.8.0_v1.9.0.sql
 create mode 100644 routes/webstoreRoutes.js
 create mode 100644 views/webstore/index.ejs
 create mode 100644 views/webstore/thank-you.ejs
 create mode 100644 webstoreItems.json

diff --git a/api/internal_redirect/webstore.js b/api/internal_redirect/webstore.js
new file mode 100644
index 00000000..f0d0497e
--- /dev/null
+++ b/api/internal_redirect/webstore.js
@@ -0,0 +1,258 @@
+import fetch from "node-fetch";
+import { MessageBuilder, Webhook } from "discord-webhook-node";
+import { Colors } from "discord.js";
+import { sendWebhookMessage } from "../../lib/discord/webhooks.mjs";
+import crypto from "crypto";
+import {
+  findWebstoreItem,
+  getPurchaseBySessionId,
+  hasWebhookEvent,
+  insertCommandRuns,
+  recordWebhookEvent,
+  resolveCommandTemplate,
+  updatePurchasePayment,
+  updatePurchaseStatus,
+} from "../../controllers/webstoreController.js";
+
+function parseStripeSignature(signatureHeader) {
+  if (!signatureHeader) return null;
+
+  const parts = signatureHeader.split(",");
+  const signatureData = {
+    timestamp: null,
+    signatures: [],
+  };
+
+  parts.forEach((part) => {
+    const [key, value] = part.split("=").map((entry) => entry.trim());
+    if (key === "t") signatureData.timestamp = Number(value);
+    if (key === "v1") signatureData.signatures.push(value);
+  });
+
+  if (!signatureData.timestamp || !signatureData.signatures.length) {
+    return null;
+  }
+
+  return signatureData;
+}
+
+function computeStripeSignature(secret, payload, timestamp) {
+  return crypto
+    .createHmac("sha256", secret)
+    .update(`${timestamp}.${payload}`)
+    .digest("hex");
+}
+
+function verifyStripeSignature({ signatureHeader, payload, secret }) {
+  const signatureData = parseStripeSignature(signatureHeader);
+  if (!signatureData) return false;
+
+  const expectedSignature = computeStripeSignature(
+    secret,
+    payload,
+    signatureData.timestamp
+  );
+
+  const signatureMatch = signatureData.signatures.some((signature) => {
+    try {
+      return crypto.timingSafeEqual(
+        Buffer.from(signature),
+        Buffer.from(expectedSignature)
+      );
+    } catch (error) {
+      return false;
+    }
+  });
+
+  if (!signatureMatch) return false;
+
+  const toleranceSeconds = 300;
+  const now = Math.floor(Date.now() / 1000);
+  return Math.abs(now - signatureData.timestamp) <= toleranceSeconds;
+}
+
+function normalizeCurrency(currency) {
+  return (currency || "usd").toLowerCase();
+}
+
+export default function webstoreWebhookRoutes(app, config) {
+  const baseEndpoint = "/api/webstore";
+
+  app.post(`${baseEndpoint}/stripe/webhook`, async function (req, res) {
+    const signature = req.headers["stripe-signature"];
+    const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;
+
+    if (!signature || !webhookSecret) {
+      res.status(400);
+      return res.send({ success: false, message: "Missing Stripe webhook configuration." });
+    }
+
+    const rawBody = req.body;
+    if (!rawBody) {
+      res.status(400);
+      return res.send({ success: false, message: "Missing webhook payload." });
+    }
+
+    const payload = Buffer.isBuffer(rawBody) ? rawBody.toString("utf8") : String(rawBody);
+
+    if (
+      !verifyStripeSignature({
+        signatureHeader: signature,
+        payload,
+        secret: webhookSecret,
+      })
+    ) {
+      res.status(400);
+      return res.send({ success: false, message: "Webhook signature verification failed." });
+    }
+
+    let event;
+    try {
+      event = JSON.parse(payload);
+    } catch (error) {
+      res.status(400);
+      return res.send({ success: false, message: "Invalid JSON payload." });
+    }
+
+    try {
+      if (await hasWebhookEvent(event.id)) {
+        return res.send({ success: true, message: "Duplicate event ignored." });
+      }
+
+      if (event.type !== "checkout.session.completed") {
+        await recordWebhookEvent({
+          stripeEventId: event.id,
+          purchaseId: null,
+          eventType: event.type,
+          payload: event,
+        });
+        return res.send({ success: true, message: "Event ignored." });
+      }
+
+      const session = event.data.object;
+      const stripeSessionId = session.id;
+      const purchase = await getPurchaseBySessionId(stripeSessionId);
+
+      if (!purchase) {
+        await recordWebhookEvent({
+          stripeEventId: event.id,
+          purchaseId: null,
+          eventType: event.type,
+          payload: event,
+        });
+        return res.send({ success: false, message: "Purchase record not found." });
+      }
+
+      if (session.payment_status && session.payment_status !== "paid") {
+        await recordWebhookEvent({
+          stripeEventId: event.id,
+          purchaseId: purchase.purchaseId,
+          eventType: event.type,
+          payload: event,
+        });
+        return res.send({ success: true, message: "Payment not completed yet." });
+      }
+
+      if (purchase.status && purchase.status !== "pending") {
+        await recordWebhookEvent({
+          stripeEventId: event.id,
+          purchaseId: purchase.purchaseId,
+          eventType: event.type,
+          payload: event,
+        });
+        return res.send({ success: true, message: "Purchase already processed." });
+      }
+
+      const item = findWebstoreItem(purchase.itemSlug);
+      await updatePurchasePayment({
+        purchaseId: purchase.purchaseId,
+        status: "paid",
+        paymentIntentId: session.payment_intent,
+        subscriptionId: session.subscription,
+      });
+
+      await recordWebhookEvent({
+        stripeEventId: event.id,
+        purchaseId: purchase.purchaseId,
+        eventType: event.type,
+        payload: event,
+      });
+
+      if (!item || !Array.isArray(item.commandTemplates) || !item.commandTemplates.length) {
+        await updatePurchaseStatus(purchase.purchaseId, "fulfilled");
+      } else {
+        const metadata = {
+          username: purchase.minecraftUsername,
+          purchaseId: purchase.purchaseId,
+          itemSlug: purchase.itemSlug,
+          purchaseType: purchase.purchaseType,
+        };
+
+        const tasks = item.commandTemplates.map((command) => ({
+          slug: `webstore-${purchase.itemSlug}`,
+          command,
+        }));
+
+        const response = await fetch(
+          `${process.env.siteAddress}/api/bridge/processor/command/add`,
+          {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "x-access-token": process.env.apiKey,
+            },
+            body: JSON.stringify({
+              tasks,
+              metadata,
+              priority: 5,
+            }),
+          }
+        );
+
+        const responseData = await response.json();
+        if (!responseData.success) {
+          await updatePurchaseStatus(purchase.purchaseId, "failed");
+        } else {
+          const tasksResponse = Array.isArray(responseData.data) ? responseData.data : [];
+          const commandRuns = tasksResponse.map((task, index) => {
+            const template = item.commandTemplates[index] || task.command;
+            return {
+              purchaseId: purchase.purchaseId,
+              commandTemplate: template,
+              resolvedCommand: resolveCommandTemplate(template, metadata),
+              executorTaskId: task.executorTaskId,
+              status: task.status === "completed" ? "completed" : "queued",
+              attempts: 0,
+            };
+          });
+
+          if (commandRuns.length) {
+            await insertCommandRuns(commandRuns);
+          }
+        }
+      }
+
+      if (config?.discord?.webhooks?.staffChannel) {
+        const staffChannelHook = new Webhook(config.discord.webhooks.staffChannel);
+        const embed = new MessageBuilder()
+          .setTitle(`${purchase.itemName} Purchased`)
+          .addField("Player", purchase.minecraftUsername, true)
+          .addField("Type", purchase.purchaseType === "subscription" ? "Subscription" : "One-time", true)
+          .addField(
+            "Amount",
+            `${normalizeCurrency(purchase.currency).toUpperCase()} ${purchase.amountCents / 100}`,
+            true
+          )
+          .setColor(Colors.Green)
+          .setTimestamp();
+
+        await sendWebhookMessage(staffChannelHook, embed, { context: "webstore#purchase" });
+      }
+
+      return res.send({ success: true });
+    } catch (error) {
+      console.error("Stripe webhook processing error", error);
+      return res.status(500).send({ success: false, message: "Webhook processing failed." });
+    }
+  });
+}
diff --git a/app.js b/app.js
index 1439941b..6baae38b 100644
--- a/app.js
+++ b/app.js
@@ -30,6 +30,7 @@ import("./cron/bridgeCleanupCron.js");
 import("./cron/cakeDayUserCheck.js");
 import("./cron/staffAuditReportCron.js");
 import("./cron/schedulerCron.js");
+import("./cron/webstoreCommandSyncCron.js");
 
 //
 // Website Related
@@ -39,6 +40,7 @@ import("./cron/schedulerCron.js");
 import siteRoutes from "./routes/index.js";
 import apiRoutes from "./api/routes/index.js";
 import apiRedirectRoutes from "./api/internal_redirect/index.js";
+import webstoreWebhookRoutes from "./api/internal_redirect/webstore.js";
 
 // API token authentication
 import verifyToken from "./api/routes/verifyToken.js";
@@ -129,6 +131,18 @@ const buildApp = async () => {
     next();
   });
 
+  await app.register((instance, options, next) => {
+    instance.addContentTypeParser(
+      "application/json",
+      { parseAs: "buffer" },
+      (req, body, done) => {
+        done(null, body);
+      }
+    );
+    webstoreWebhookRoutes(instance, config, lang);
+    next();
+  });
+
   // Sessions
   await app.register(fastifyCookie, {
     secret: process.env.sessionCookieSecret, // for cookies signature
diff --git a/controllers/webstoreController.js b/controllers/webstoreController.js
new file mode 100644
index 00000000..5b8a2f0d
--- /dev/null
+++ b/controllers/webstoreController.js
@@ -0,0 +1,291 @@
+import { createRequire } from "module";
+import path from "path";
+import db from "./databaseController.js";
+
+const require = createRequire(import.meta.url);
+const itemsData = require(path.join(process.cwd(), "webstoreItems.json"));
+
+let webstoreTableCheck;
+
+function query(sql, params = []) {
+  return new Promise((resolve, reject) => {
+    db.query(sql, params, (error, results) => {
+      if (error) return reject(error);
+      return resolve(results);
+    });
+  });
+}
+
+export function getWebstoreItems() {
+  return itemsData?.items || [];
+}
+
+export function findWebstoreItem(slug) {
+  const items = getWebstoreItems();
+  return items.find((item) => item.slug === slug && item.isActive !== false) || null;
+}
+
+export async function ensureWebstoreTables() {
+  if (!webstoreTableCheck) {
+    webstoreTableCheck = new Promise((resolve) => {
+      db.query(
+        "CREATE TABLE IF NOT EXISTS webstorePurchases (\n" +
+          "  purchaseId INT AUTO_INCREMENT PRIMARY KEY,\n" +
+          "  userId INT NOT NULL,\n" +
+          "  itemSlug VARCHAR(64) NOT NULL,\n" +
+          "  itemName VARCHAR(120) NOT NULL,\n" +
+          "  purchaseType ENUM('one_time', 'subscription') NOT NULL,\n" +
+          "  minecraftUsername VARCHAR(16) NOT NULL,\n" +
+          "  status ENUM('pending', 'paid', 'fulfilled', 'failed') DEFAULT 'pending',\n" +
+          "  stripeSessionId VARCHAR(255) NOT NULL,\n" +
+          "  stripePaymentIntentId VARCHAR(255),\n" +
+          "  stripeSubscriptionId VARCHAR(255),\n" +
+          "  amountCents INT NOT NULL,\n" +
+          "  currency VARCHAR(10) NOT NULL,\n" +
+          "  createdAt DATETIME DEFAULT NOW(),\n" +
+          "  updatedAt DATETIME DEFAULT NOW(),\n" +
+          "  UNIQUE KEY webstorePurchases_session (stripeSessionId),\n" +
+          "  INDEX webstorePurchases_user (userId),\n" +
+          "  INDEX webstorePurchases_status (status)\n" +
+          ")",
+        (purchaseErr) => {
+          if (purchaseErr) {
+            console.error("Failed to ensure webstorePurchases table", purchaseErr);
+            resolve(false);
+            return;
+          }
+
+          db.query(
+            "CREATE TABLE IF NOT EXISTS webstoreCommandRuns (\n" +
+              "  commandRunId INT AUTO_INCREMENT PRIMARY KEY,\n" +
+              "  purchaseId INT NOT NULL,\n" +
+              "  commandTemplate TEXT NOT NULL,\n" +
+              "  resolvedCommand TEXT NOT NULL,\n" +
+              "  executorTaskId INT NULL,\n" +
+              "  status ENUM('queued', 'processing', 'completed', 'failed') DEFAULT 'queued',\n" +
+              "  attempts INT DEFAULT 0,\n" +
+              "  lastError TEXT,\n" +
+              "  createdAt DATETIME DEFAULT NOW(),\n" +
+              "  updatedAt DATETIME DEFAULT NOW(),\n" +
+              "  INDEX webstoreCommandRuns_purchase (purchaseId),\n" +
+              "  INDEX webstoreCommandRuns_executor (executorTaskId)\n" +
+              ")",
+            (commandErr) => {
+              if (commandErr) {
+                console.error("Failed to ensure webstoreCommandRuns table", commandErr);
+                resolve(false);
+                return;
+              }
+
+              db.query(
+                "CREATE TABLE IF NOT EXISTS webstoreWebhookEvents (\n" +
+                  "  webhookEventId INT AUTO_INCREMENT PRIMARY KEY,\n" +
+                  "  stripeEventId VARCHAR(255) NOT NULL,\n" +
+                  "  purchaseId INT NULL,\n" +
+                  "  eventType VARCHAR(80) NOT NULL,\n" +
+                  "  payload JSON,\n" +
+                  "  createdAt DATETIME DEFAULT NOW(),\n" +
+                  "  UNIQUE KEY webstoreWebhookEvents_event (stripeEventId),\n" +
+                  "  INDEX webstoreWebhookEvents_purchase (purchaseId)\n" +
+                  ")",
+                (eventErr) => {
+                  if (eventErr) {
+                    console.error("Failed to ensure webstoreWebhookEvents table", eventErr);
+                    resolve(false);
+                    return;
+                  }
+
+                  resolve(true);
+                }
+              );
+            }
+          );
+        }
+      );
+    });
+  }
+
+  return webstoreTableCheck;
+}
+
+export async function createPendingPurchase({
+  userId,
+  item,
+  minecraftUsername,
+  stripeSessionId,
+}) {
+  await ensureWebstoreTables();
+
+  const params = [
+    userId,
+    item.slug,
+    item.displayName,
+    item.purchaseType,
+    minecraftUsername,
+    stripeSessionId,
+    item.priceCents,
+    item.currency,
+  ];
+
+  const result = await query(
+    "INSERT INTO webstorePurchases (userId, itemSlug, itemName, purchaseType, minecraftUsername, stripeSessionId, amountCents, currency) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
+    params
+  );
+
+  return result.insertId;
+}
+
+export async function recordWebhookEvent({ stripeEventId, purchaseId, eventType, payload }) {
+  await ensureWebstoreTables();
+
+  return query(
+    "INSERT INTO webstoreWebhookEvents (stripeEventId, purchaseId, eventType, payload) VALUES (?, ?, ?, ?)",
+    [stripeEventId, purchaseId || null, eventType, payload ? JSON.stringify(payload) : null]
+  );
+}
+
+export async function hasWebhookEvent(stripeEventId) {
+  await ensureWebstoreTables();
+
+  const rows = await query(
+    "SELECT webhookEventId FROM webstoreWebhookEvents WHERE stripeEventId = ? LIMIT 1",
+    [stripeEventId]
+  );
+
+  return rows.length > 0;
+}
+
+export async function getPurchaseBySessionId(stripeSessionId) {
+  await ensureWebstoreTables();
+
+  const rows = await query(
+    "SELECT * FROM webstorePurchases WHERE stripeSessionId = ? LIMIT 1",
+    [stripeSessionId]
+  );
+
+  return rows[0] || null;
+}
+
+export async function updatePurchasePayment({
+  purchaseId,
+  status,
+  paymentIntentId,
+  subscriptionId,
+}) {
+  await ensureWebstoreTables();
+
+  return query(
+    "UPDATE webstorePurchases SET status = ?, stripePaymentIntentId = ?, stripeSubscriptionId = ?, updatedAt = NOW() WHERE purchaseId = ?",
+    [status, paymentIntentId || null, subscriptionId || null, purchaseId]
+  );
+}
+
+export async function insertCommandRuns(commandRuns) {
+  await ensureWebstoreTables();
+
+  if (!commandRuns.length) return 0;
+
+  const values = commandRuns.map((run) => [
+    run.purchaseId,
+    run.commandTemplate,
+    run.resolvedCommand,
+    run.executorTaskId || null,
+    run.status || "queued",
+    run.attempts || 0,
+    run.lastError || null,
+  ]);
+
+  const result = await query(
+    "INSERT INTO webstoreCommandRuns (purchaseId, commandTemplate, resolvedCommand, executorTaskId, status, attempts, lastError) VALUES ?",
+    [values]
+  );
+
+  return result.affectedRows || 0;
+}
+
+export async function updatePurchaseStatus(purchaseId, status) {
+  await ensureWebstoreTables();
+
+  return query(
+    "UPDATE webstorePurchases SET status = ?, updatedAt = NOW() WHERE purchaseId = ?",
+    [status, purchaseId]
+  );
+}
+
+export async function updateCommandRunStatus(commandRunId, status, lastError = null) {
+  await ensureWebstoreTables();
+
+  return query(
+    "UPDATE webstoreCommandRuns SET status = ?, lastError = ?, updatedAt = NOW() WHERE commandRunId = ?",
+    [status, lastError, commandRunId]
+  );
+}
+
+export async function incrementCommandRunAttempts(commandRunId, lastError = null) {
+  await ensureWebstoreTables();
+
+  return query(
+    "UPDATE webstoreCommandRuns SET attempts = attempts + 1, lastError = ?, updatedAt = NOW() WHERE commandRunId = ?",
+    [lastError, commandRunId]
+  );
+}
+
+export async function getCommandRunsByPurchase(purchaseId) {
+  await ensureWebstoreTables();
+
+  return query(
+    "SELECT * FROM webstoreCommandRuns WHERE purchaseId = ?",
+    [purchaseId]
+  );
+}
+
+export async function getCommandRunsForSync(limit = 50) {
+  await ensureWebstoreTables();
+
+  return query(
+    "SELECT cr.*, et.status AS taskStatus, et.result AS taskResult FROM webstoreCommandRuns cr JOIN executorTasks et ON cr.executorTaskId = et.executorTaskId WHERE cr.status IN ('queued', 'processing', 'failed') ORDER BY cr.updatedAt ASC LIMIT ?",
+    [limit]
+  );
+}
+
+export async function updateCommandRunForTask(commandRunId, status, taskResult = null) {
+  await ensureWebstoreTables();
+
+  return query(
+    "UPDATE webstoreCommandRuns SET status = ?, lastError = ?, updatedAt = NOW() WHERE commandRunId = ?",
+    [status, taskResult || null, commandRunId]
+  );
+}
+
+export async function getPurchasesNeedingFulfillment() {
+  await ensureWebstoreTables();
+
+  return query(
+    "SELECT purchaseId FROM webstorePurchases WHERE status IN ('paid')",
+    []
+  );
+}
+
+export function formatPrice(priceCents, currency) {
+  const amount = Number(priceCents) || 0;
+  const normalizedCurrency = (currency || "usd").toUpperCase();
+  return new Intl.NumberFormat("en-US", {
+    style: "currency",
+    currency: normalizedCurrency,
+    minimumFractionDigits: 2,
+  }).format(amount / 100);
+}
+
+export function resolveCommandTemplate(commandTemplate, metadata) {
+  let resolved = typeof commandTemplate === "string" ? commandTemplate : "";
+  if (!metadata) return resolved;
+
+  Object.entries(metadata).forEach(([key, value]) => {
+    if (value === undefined || value === null) return;
+    const replacement = typeof value === "string" ? value : String(value);
+    const pattern = new RegExp(`{{\\s*${key}\\s*}}`, "gi");
+    resolved = resolved.replace(pattern, replacement);
+  });
+
+  return resolved;
+}
diff --git a/cron/webstoreCommandSyncCron.js b/cron/webstoreCommandSyncCron.js
new file mode 100644
index 00000000..9fdd5484
--- /dev/null
+++ b/cron/webstoreCommandSyncCron.js
@@ -0,0 +1,102 @@
+import cron from "node-cron";
+import db from "../controllers/databaseController.js";
+import {
+  getCommandRunsForSync,
+  getPurchasesNeedingFulfillment,
+  incrementCommandRunAttempts,
+  updateCommandRunForTask,
+  updatePurchaseStatus,
+} from "../controllers/webstoreController.js";
+
+const MAX_RETRIES = 3;
+
+function resetExecutorTask(taskId) {
+  return new Promise((resolve, reject) => {
+    db.query(
+      "UPDATE executorTasks SET status = 'pending', executedBy = NULL, result = NULL, processedAt = NULL, updatedAt = NOW() WHERE executorTaskId = ?",
+      [taskId],
+      (error) => {
+        if (error) return reject(error);
+        return resolve(true);
+      }
+    );
+  });
+}
+
+async function syncCommandRuns() {
+  try {
+    const commandRuns = await getCommandRunsForSync(100);
+
+    for (const run of commandRuns) {
+      const taskStatus = run.taskStatus;
+      if (!taskStatus) continue;
+
+      if (taskStatus === "completed") {
+        await updateCommandRunForTask(run.commandRunId, "completed", null);
+        continue;
+      }
+
+      if (taskStatus === "processing") {
+        await updateCommandRunForTask(run.commandRunId, "processing", null);
+        continue;
+      }
+
+      if (taskStatus === "failed") {
+        if (run.attempts + 1 < MAX_RETRIES) {
+          await incrementCommandRunAttempts(run.commandRunId, run.taskResult || "failed");
+          await resetExecutorTask(run.executorTaskId);
+          await updateCommandRunForTask(run.commandRunId, "queued", run.taskResult || "failed");
+        } else {
+          await updateCommandRunForTask(run.commandRunId, "failed", run.taskResult || "failed");
+        }
+        continue;
+      }
+
+      if (taskStatus === "pending") {
+        await updateCommandRunForTask(run.commandRunId, "queued", null);
+      }
+    }
+  } catch (error) {
+    console.error("Webstore command sync failed", error);
+  }
+}
+
+async function syncPurchaseStatuses() {
+  try {
+    const purchases = await getPurchasesNeedingFulfillment();
+
+    for (const purchase of purchases) {
+      db.query(
+        "SELECT status FROM webstoreCommandRuns WHERE purchaseId = ?",
+        [purchase.purchaseId],
+        async (error, results) => {
+          if (error) {
+            console.error("Failed to load webstore command runs", error);
+            return;
+          }
+
+          if (!results.length) {
+            await updatePurchaseStatus(purchase.purchaseId, "fulfilled");
+            return;
+          }
+
+          const statuses = results.map((row) => row.status);
+          if (statuses.every((status) => status === "completed")) {
+            await updatePurchaseStatus(purchase.purchaseId, "fulfilled");
+          } else if (statuses.some((status) => status === "failed")) {
+            await updatePurchaseStatus(purchase.purchaseId, "failed");
+          }
+        }
+      );
+    }
+  } catch (error) {
+    console.error("Webstore purchase sync failed", error);
+  }
+}
+
+const task = cron.schedule("*/5 * * * *", async () => {
+  await syncCommandRuns();
+  await syncPurchaseStatuses();
+});
+
+task.start();
diff --git a/dbinit.sql b/dbinit.sql
index e3c01d73..e7ad5f76 100644
--- a/dbinit.sql
+++ b/dbinit.sql
@@ -200,6 +200,58 @@ CREATE TABLE serverStatus (
     PRIMARY KEY (serverStatusId)
 );
 
+CREATE TABLE webstorePurchases (
+        purchaseId INT NOT NULL AUTO_INCREMENT,
+    userId INT NOT NULL,
+    itemSlug VARCHAR(64) NOT NULL,
+    itemName VARCHAR(120) NOT NULL,
+    purchaseType ENUM('one_time', 'subscription') NOT NULL,
+    minecraftUsername VARCHAR(16) NOT NULL,
+    status ENUM('pending', 'paid', 'fulfilled', 'failed') DEFAULT 'pending',
+    stripeSessionId VARCHAR(255) NOT NULL,
+    stripePaymentIntentId VARCHAR(255),
+    stripeSubscriptionId VARCHAR(255),
+    amountCents INT NOT NULL,
+    currency VARCHAR(10) NOT NULL,
+    createdAt DATETIME DEFAULT NOW(),
+    updatedAt DATETIME DEFAULT NOW(),
+    PRIMARY KEY (purchaseId),
+    UNIQUE KEY webstorePurchases_session (stripeSessionId),
+    INDEX webstorePurchases_user (userId),
+    INDEX webstorePurchases_status (status),
+    CONSTRAINT fk_webstorePurchases_users FOREIGN KEY (userId) REFERENCES users(userId) ON DELETE CASCADE
+);
+
+CREATE TABLE webstoreCommandRuns (
+        commandRunId INT NOT NULL AUTO_INCREMENT,
+    purchaseId INT NOT NULL,
+    commandTemplate TEXT NOT NULL,
+    resolvedCommand TEXT NOT NULL,
+    executorTaskId INT NULL,
+    status ENUM('queued', 'processing', 'completed', 'failed') DEFAULT 'queued',
+    attempts INT DEFAULT 0,
+    lastError TEXT,
+    createdAt DATETIME DEFAULT NOW(),
+    updatedAt DATETIME DEFAULT NOW(),
+    PRIMARY KEY (commandRunId),
+    INDEX webstoreCommandRuns_purchase (purchaseId),
+    INDEX webstoreCommandRuns_executor (executorTaskId),
+    CONSTRAINT fk_webstoreCommandRuns_purchase FOREIGN KEY (purchaseId) REFERENCES webstorePurchases(purchaseId) ON DELETE CASCADE
+);
+
+CREATE TABLE webstoreWebhookEvents (
+        webhookEventId INT NOT NULL AUTO_INCREMENT,
+    stripeEventId VARCHAR(255) NOT NULL,
+    purchaseId INT NULL,
+    eventType VARCHAR(80) NOT NULL,
+    payload JSON,
+    createdAt DATETIME DEFAULT NOW(),
+    PRIMARY KEY (webhookEventId),
+    UNIQUE KEY webstoreWebhookEvents_event (stripeEventId),
+    INDEX webstoreWebhookEvents_purchase (purchaseId),
+    CONSTRAINT fk_webstoreWebhookEvents_purchase FOREIGN KEY (purchaseId) REFERENCES webstorePurchases(purchaseId) ON DELETE SET NULL
+);
+
 INSERT INTO serverStatus (serverStatusId, statusInfo)
 VALUES (1, null);
 
diff --git a/migration/v1.8.0_v1.9.0.sql b/migration/v1.8.0_v1.9.0.sql
new file mode 100644
index 00000000..382fdaa8
--- /dev/null
+++ b/migration/v1.8.0_v1.9.0.sql
@@ -0,0 +1,51 @@
+CREATE TABLE webstorePurchases (
+    purchaseId INT NOT NULL AUTO_INCREMENT,
+    userId INT NOT NULL,
+    itemSlug VARCHAR(64) NOT NULL,
+    itemName VARCHAR(120) NOT NULL,
+    purchaseType ENUM('one_time', 'subscription') NOT NULL,
+    minecraftUsername VARCHAR(16) NOT NULL,
+    status ENUM('pending', 'paid', 'fulfilled', 'failed') DEFAULT 'pending',
+    stripeSessionId VARCHAR(255) NOT NULL,
+    stripePaymentIntentId VARCHAR(255),
+    stripeSubscriptionId VARCHAR(255),
+    amountCents INT NOT NULL,
+    currency VARCHAR(10) NOT NULL,
+    createdAt DATETIME DEFAULT NOW(),
+    updatedAt DATETIME DEFAULT NOW(),
+    PRIMARY KEY (purchaseId),
+    UNIQUE KEY webstorePurchases_session (stripeSessionId),
+    INDEX webstorePurchases_user (userId),
+    INDEX webstorePurchases_status (status),
+    CONSTRAINT fk_webstorePurchases_users FOREIGN KEY (userId) REFERENCES users(userId) ON DELETE CASCADE
+);
+
+CREATE TABLE webstoreCommandRuns (
+    commandRunId INT NOT NULL AUTO_INCREMENT,
+    purchaseId INT NOT NULL,
+    commandTemplate TEXT NOT NULL,
+    resolvedCommand TEXT NOT NULL,
+    executorTaskId INT NULL,
+    status ENUM('queued', 'processing', 'completed', 'failed') DEFAULT 'queued',
+    attempts INT DEFAULT 0,
+    lastError TEXT,
+    createdAt DATETIME DEFAULT NOW(),
+    updatedAt DATETIME DEFAULT NOW(),
+    PRIMARY KEY (commandRunId),
+    INDEX webstoreCommandRuns_purchase (purchaseId),
+    INDEX webstoreCommandRuns_executor (executorTaskId),
+    CONSTRAINT fk_webstoreCommandRuns_purchase FOREIGN KEY (purchaseId) REFERENCES webstorePurchases(purchaseId) ON DELETE CASCADE
+);
+
+CREATE TABLE webstoreWebhookEvents (
+    webhookEventId INT NOT NULL AUTO_INCREMENT,
+    stripeEventId VARCHAR(255) NOT NULL,
+    purchaseId INT NULL,
+    eventType VARCHAR(80) NOT NULL,
+    payload JSON,
+    createdAt DATETIME DEFAULT NOW(),
+    PRIMARY KEY (webhookEventId),
+    UNIQUE KEY webstoreWebhookEvents_event (stripeEventId),
+    INDEX webstoreWebhookEvents_purchase (purchaseId),
+    CONSTRAINT fk_webstoreWebhookEvents_purchase FOREIGN KEY (purchaseId) REFERENCES webstorePurchases(purchaseId) ON DELETE SET NULL
+);
diff --git a/routes/index.js b/routes/index.js
index 3fcff18f..05f36f01 100644
--- a/routes/index.js
+++ b/routes/index.js
@@ -15,6 +15,7 @@ import redirectSiteRoutes from "./redirectRoutes.js";
 import profileSiteRoutes from "./profileRoutes.js";
 import supportRoutes from "./support.js";
 import notificationRoutes from "./notificationRoutes.js";
+import webstoreRoutes from "./webstoreRoutes.js";
 
 const rankData = require("../ranks.json");
 
@@ -35,6 +36,7 @@ export default function applicationSiteRoutes(
   redirectSiteRoutes(app, config, features);
   supportRoutes(app, client, fetch, moment, config, db, features, lang);
   notificationRoutes(app, config, features);
+  webstoreRoutes(app, config, features);
 
   app.get("/", async function (req, res) {
     const fetchURL = `${process.env.siteAddress}/api/web/statistics`;
diff --git a/routes/redirectRoutes.js b/routes/redirectRoutes.js
index 5149df72..cc0753ba 100644
--- a/routes/redirectRoutes.js
+++ b/routes/redirectRoutes.js
@@ -6,13 +6,6 @@ export default function redirectSiteRoutes(app, config, featuress) {
     return res.redirect(config.siteConfiguration.platforms.discord);
   });
 
-  //
-  // Webstore Redirect
-  //
-  app.get("/webstore", async function (req, res) {
-    return res.redirect(config.siteConfiguration.platforms.webstore);
-  });
-
   //
   // Guides Redirect
   //
diff --git a/routes/webstoreRoutes.js b/routes/webstoreRoutes.js
new file mode 100644
index 00000000..ea477619
--- /dev/null
+++ b/routes/webstoreRoutes.js
@@ -0,0 +1,159 @@
+import fetch from "node-fetch";
+import { getGlobalImage, isLoggedIn, setBannerCookie } from "../api/common.js";
+import { getWebAnnouncement } from "../controllers/announcementController.js";
+import {
+  createPendingPurchase,
+  findWebstoreItem,
+  formatPrice,
+  getWebstoreItems,
+} from "../controllers/webstoreController.js";
+
+async function createStripeCheckoutSession({ item, userId, minecraftUsername }) {
+  const apiKey = process.env.STRIPE_SECRET_KEY;
+  if (!apiKey) {
+    throw new Error("Stripe secret key is not configured");
+  }
+
+  const body = new URLSearchParams();
+  body.append("mode", item.purchaseType === "subscription" ? "subscription" : "payment");
+  body.append("line_items[0][price]", item.stripePriceId);
+  body.append("line_items[0][quantity]", "1");
+  body.append(
+    "success_url",
+    `${process.env.siteAddress}/webstore/thank-you?session_id={CHECKOUT_SESSION_ID}`
+  );
+  body.append("cancel_url", `${process.env.siteAddress}/webstore?canceled=1`);
+  body.append("client_reference_id", String(userId));
+  body.append("metadata[itemSlug]", item.slug);
+  body.append("metadata[minecraftUsername]", minecraftUsername);
+  body.append("metadata[userId]", String(userId));
+
+  const response = await fetch("https://api.stripe.com/v1/checkout/sessions", {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/x-www-form-urlencoded",
+    },
+    body,
+  });
+
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`Stripe API error: ${response.status} ${errorText}`);
+  }
+
+  return response.json();
+}
+
+export default function webstoreRoutes(app, config, features) {
+  app.get("/webstore", async function (req, res) {
+    if (!isLoggedIn(req)) {
+      return res.redirect(`/login?returnTo=/webstore`);
+    }
+
+    if (req.query?.canceled) {
+      setBannerCookie("info", "Checkout canceled. You can try again anytime.", res);
+    }
+
+    if (!req.session?.user?.username) {
+      setBannerCookie(
+        "warning",
+        "Please verify your Minecraft account before purchasing.",
+        res
+      );
+      return res.redirect("/profile");
+    }
+
+    const items = getWebstoreItems().map((item) => ({
+      ...item,
+      priceDisplay: formatPrice(item.priceCents, item.currency),
+      purchaseLabel:
+        item.purchaseType === "subscription" ? "Subscribe" : "Buy once",
+    }));
+
+    return res.view("webstore/index", {
+      pageTitle: "Webstore",
+      config,
+      req,
+      features,
+      globalImage: await getGlobalImage(),
+      announcementWeb: await getWebAnnouncement(),
+      items,
+      username: req.session.user.username,
+    });
+  });
+
+  app.get("/webstore/thank-you", async function (req, res) {
+    if (!isLoggedIn(req)) {
+      return res.redirect(`/login?returnTo=/webstore/thank-you`);
+    }
+
+    return res.view("webstore/thank-you", {
+      pageTitle: "Thank you",
+      config,
+      req,
+      features,
+      globalImage: await getGlobalImage(),
+      announcementWeb: await getWebAnnouncement(),
+    });
+  });
+
+  app.post("/webstore/checkout", async function (req, res) {
+    if (!isLoggedIn(req)) {
+      return res.redirect(`/login?returnTo=/webstore`);
+    }
+
+    const itemSlug = req.body.itemSlug ? req.body.itemSlug.trim() : "";
+    const item = findWebstoreItem(itemSlug);
+
+    if (!item) {
+      setBannerCookie("warning", "That item is no longer available.", res);
+      return res.redirect("/webstore");
+    }
+
+    if (!item.stripePriceId) {
+      setBannerCookie("danger", "Stripe price ID is missing for this item.", res);
+      return res.redirect("/webstore");
+    }
+
+    const minecraftUsername = req.session?.user?.username;
+    if (!minecraftUsername) {
+      setBannerCookie(
+        "warning",
+        "Please verify your Minecraft account before purchasing.",
+        res
+      );
+      return res.redirect("/profile");
+    }
+
+    try {
+      const session = await createStripeCheckoutSession({
+        item,
+        userId: req.session.user.userId,
+        minecraftUsername,
+      });
+
+      await createPendingPurchase({
+        userId: req.session.user.userId,
+        item,
+        minecraftUsername,
+        stripeSessionId: session.id,
+      });
+
+      if (!session.url) {
+        setBannerCookie("danger", "Stripe checkout was not created.", res);
+        return res.redirect("/webstore");
+      }
+
+      return res.redirect(session.url);
+    } catch (error) {
+      console.error("Failed to create Stripe checkout session", error);
+      setBannerCookie(
+        "danger",
+        "We could not start checkout right now. Please try again soon.",
+        res
+      );
+      return res.redirect("/webstore");
+    }
+  });
+}
diff --git a/views/webstore/index.ejs b/views/webstore/index.ejs
new file mode 100644
index 00000000..7e882247
--- /dev/null
+++ b/views/webstore/index.ejs
@@ -0,0 +1,49 @@
+<%- include("modules/header.ejs", {
+    pageTitle: pageTitle,
+    pageDescription: "Support the server with ranks, cosmetics, keys, and more."
+}) %>
+
+<%- include("modules/navigationBar.ejs") %>
+
+<%- include("partials/miniHeader.ejs", {
+  headerTitle: "Webstore",
+  backgroundImage: globalImage
+}) %>
+
+<section class="section">
+  <div class="container">
+    <div class="mb-4">
+      <h3>Welcome, <%= username %></h3>
+      <p class="text-muted mb-0">All purchases are linked to your Minecraft username.</p>
+    </div>
+
+    <div class="row">
+      <% if (!items.length) { %>
+        <div class="col-12">
+          <div class="alert alert-info">The webstore is being stocked. Check back soon!</div>
+        </div>
+      <% } %>
+
+      <% items.forEach(function (item) { %>
+        <div class="col-lg-4 col-md-6 col-sm-12">
+          <div class="service-item mb-4">
+            <div class="feature-item mb-5 mb-lg-0">
+              <h4 class="mb-2"><%= item.displayName %></h4>
+              <p class="text-muted"><%= item.description %></p>
+              <div class="d-flex align-items-center justify-content-between mb-3">
+                <span class="fw-bold"><%= item.priceDisplay %></span>
+                <span class="badge bg-info"><%= item.purchaseType === "subscription" ? "Monthly" : "One-time" %></span>
+              </div>
+              <form method="post" action="/webstore/checkout">
+                <input type="hidden" name="itemSlug" value="<%= item.slug %>">
+                <button type="submit" class="btn btn-primary btn-sm"><%= item.purchaseLabel %></button>
+              </form>
+            </div>
+          </div>
+        </div>
+      <% }) %>
+    </div>
+  </div>
+</section>
+
+<%- include("modules/footer.ejs") %>
diff --git a/views/webstore/thank-you.ejs b/views/webstore/thank-you.ejs
new file mode 100644
index 00000000..f776332a
--- /dev/null
+++ b/views/webstore/thank-you.ejs
@@ -0,0 +1,24 @@
+<%- include("modules/header.ejs", {
+    pageTitle: pageTitle,
+    pageDescription: "Thanks for supporting the server."
+}) %>
+
+<%- include("modules/navigationBar.ejs") %>
+
+<%- include("partials/miniHeader.ejs", {
+  headerTitle: "Thank you",
+  backgroundImage: globalImage
+}) %>
+
+<section class="section">
+  <div class="container">
+    <div class="alert alert-success">
+      <h4 class="alert-heading">Payment received!</h4>
+      <p class="mb-0">Your purchase is being processed. Commands will run on the server shortly.</p>
+    </div>
+    <p class="text-muted">If you have any issues, contact staff with your Minecraft username.</p>
+    <a href="/webstore" class="btn btn-primary btn-sm">Back to webstore</a>
+  </div>
+</section>
+
+<%- include("modules/footer.ejs") %>
diff --git a/webstoreItems.json b/webstoreItems.json
new file mode 100644
index 00000000..af9b053f
--- /dev/null
+++ b/webstoreItems.json
@@ -0,0 +1,76 @@
+{
+  "items": [
+    {
+      "slug": "iron-rank-monthly",
+      "displayName": "Iron Rank (Monthly)",
+      "description": "Monthly Iron rank subscription with ongoing perks.",
+      "priceCents": 499,
+      "currency": "usd",
+      "purchaseType": "subscription",
+      "stripePriceId": "price_iron_monthly",
+      "commandTemplates": [
+        "lp user {{username}} parent add iron"
+      ]
+    },
+    {
+      "slug": "iron-rank-onetime",
+      "displayName": "Iron Rank (Lifetime)",
+      "description": "One-time Iron rank unlock.",
+      "priceCents": 2999,
+      "currency": "usd",
+      "purchaseType": "one_time",
+      "stripePriceId": "price_iron_onetime",
+      "commandTemplates": [
+        "lp user {{username}} parent add iron"
+      ]
+    },
+    {
+      "slug": "gold-rank-monthly",
+      "displayName": "Gold Rank (Monthly)",
+      "description": "Monthly Gold rank subscription with ongoing perks.",
+      "priceCents": 899,
+      "currency": "usd",
+      "purchaseType": "subscription",
+      "stripePriceId": "price_gold_monthly",
+      "commandTemplates": [
+        "lp user {{username}} parent add gold"
+      ]
+    },
+    {
+      "slug": "gold-rank-onetime",
+      "displayName": "Gold Rank (Lifetime)",
+      "description": "One-time Gold rank unlock.",
+      "priceCents": 4999,
+      "currency": "usd",
+      "purchaseType": "one_time",
+      "stripePriceId": "price_gold_onetime",
+      "commandTemplates": [
+        "lp user {{username}} parent add gold"
+      ]
+    },
+    {
+      "slug": "diamond-rank-monthly",
+      "displayName": "Diamond Rank (Monthly)",
+      "description": "Monthly Diamond rank subscription with ongoing perks.",
+      "priceCents": 1499,
+      "currency": "usd",
+      "purchaseType": "subscription",
+      "stripePriceId": "price_diamond_monthly",
+      "commandTemplates": [
+        "lp user {{username}} parent add diamond"
+      ]
+    },
+    {
+      "slug": "diamond-rank-onetime",
+      "displayName": "Diamond Rank (Lifetime)",
+      "description": "One-time Diamond rank unlock.",
+      "priceCents": 8999,
+      "currency": "usd",
+      "purchaseType": "one_time",
+      "stripePriceId": "price_diamond_onetime",
+      "commandTemplates": [
+        "lp user {{username}} parent add diamond"
+      ]
+    }
+  ]
+}

From aadaf8a6a27f4a8d38c6b0ef77fa795dc3f1627c Mon Sep 17 00:00:00 2001
From: Ben Robson <shadowolfbusiness@gmail.com>
Date: Tue, 30 Dec 2025 09:04:32 +1100
Subject: [PATCH 2/9] Move webstore catalog to database and add gifting

---
 api/internal_redirect/webstore.js |  19 ++-
 controllers/webstoreController.js | 227 +++++++++++++++++++++++++++---
 dbinit.sql                        |  55 +++++++-
 migration/v1.8.0_v1.9.0.sql       |  55 +++++++-
 routes/webstoreRoutes.js          |  93 ++++++++++--
 views/give/index.ejs              | 109 ++++++++++++++
 views/modules/navigationBar.ejs   |   1 +
 views/webstore/index.ejs          |  11 ++
 webstoreItems.json                |  76 ----------
 9 files changed, 534 insertions(+), 112 deletions(-)
 create mode 100644 views/give/index.ejs
 delete mode 100644 webstoreItems.json

diff --git a/api/internal_redirect/webstore.js b/api/internal_redirect/webstore.js
index f0d0497e..6c4d1619 100644
--- a/api/internal_redirect/webstore.js
+++ b/api/internal_redirect/webstore.js
@@ -4,6 +4,7 @@ import { Colors } from "discord.js";
 import { sendWebhookMessage } from "../../lib/discord/webhooks.mjs";
 import crypto from "crypto";
 import {
+  createTransactionsForPurchase,
   findWebstoreItem,
   getPurchaseBySessionId,
   hasWebhookEvent,
@@ -163,7 +164,7 @@ export default function webstoreWebhookRoutes(app, config) {
         return res.send({ success: true, message: "Purchase already processed." });
       }
 
-      const item = findWebstoreItem(purchase.itemSlug);
+      const item = await findWebstoreItem(purchase.itemSlug);
       await updatePurchasePayment({
         purchaseId: purchase.purchaseId,
         status: "paid",
@@ -182,10 +183,12 @@ export default function webstoreWebhookRoutes(app, config) {
         await updatePurchaseStatus(purchase.purchaseId, "fulfilled");
       } else {
         const metadata = {
-          username: purchase.minecraftUsername,
+          username: purchase.recipientMinecraftUsername,
+          purchaserUsername: purchase.purchaserMinecraftUsername,
           purchaseId: purchase.purchaseId,
           itemSlug: purchase.itemSlug,
           purchaseType: purchase.purchaseType,
+          isGift: purchase.isGift === 1 || purchase.isGift === true,
         };
 
         const tasks = item.commandTemplates.map((command) => ({
@@ -232,17 +235,27 @@ export default function webstoreWebhookRoutes(app, config) {
         }
       }
 
+      await createTransactionsForPurchase({
+        purchaseId: purchase.purchaseId,
+        payerUserId: purchase.userId,
+        payerMinecraftUsername: purchase.purchaserMinecraftUsername,
+        recipientMinecraftUsername: purchase.recipientMinecraftUsername,
+        amountCents: purchase.amountCents,
+        currency: purchase.currency,
+      });
+
       if (config?.discord?.webhooks?.staffChannel) {
         const staffChannelHook = new Webhook(config.discord.webhooks.staffChannel);
         const embed = new MessageBuilder()
           .setTitle(`${purchase.itemName} Purchased`)
-          .addField("Player", purchase.minecraftUsername, true)
+          .addField("Player", purchase.recipientMinecraftUsername, true)
           .addField("Type", purchase.purchaseType === "subscription" ? "Subscription" : "One-time", true)
           .addField(
             "Amount",
             `${normalizeCurrency(purchase.currency).toUpperCase()} ${purchase.amountCents / 100}`,
             true
           )
+          .addField("Gifted", purchase.isGift ? "Yes" : "No", true)
           .setColor(Colors.Green)
           .setTimestamp();
 
diff --git a/controllers/webstoreController.js b/controllers/webstoreController.js
index 5b8a2f0d..1e1c5e06 100644
--- a/controllers/webstoreController.js
+++ b/controllers/webstoreController.js
@@ -1,10 +1,5 @@
-import { createRequire } from "module";
-import path from "path";
 import db from "./databaseController.js";
 
-const require = createRequire(import.meta.url);
-const itemsData = require(path.join(process.cwd(), "webstoreItems.json"));
-
 let webstoreTableCheck;
 
 function query(sql, params = []) {
@@ -16,15 +11,6 @@ function query(sql, params = []) {
   });
 }
 
-export function getWebstoreItems() {
-  return itemsData?.items || [];
-}
-
-export function findWebstoreItem(slug) {
-  const items = getWebstoreItems();
-  return items.find((item) => item.slug === slug && item.isActive !== false) || null;
-}
-
 export async function ensureWebstoreTables() {
   if (!webstoreTableCheck) {
     webstoreTableCheck = new Promise((resolve) => {
@@ -35,13 +21,15 @@ export async function ensureWebstoreTables() {
           "  itemSlug VARCHAR(64) NOT NULL,\n" +
           "  itemName VARCHAR(120) NOT NULL,\n" +
           "  purchaseType ENUM('one_time', 'subscription') NOT NULL,\n" +
-          "  minecraftUsername VARCHAR(16) NOT NULL,\n" +
+          "  purchaserMinecraftUsername VARCHAR(16) NOT NULL,\n" +
+          "  recipientMinecraftUsername VARCHAR(16) NOT NULL,\n" +
           "  status ENUM('pending', 'paid', 'fulfilled', 'failed') DEFAULT 'pending',\n" +
           "  stripeSessionId VARCHAR(255) NOT NULL,\n" +
           "  stripePaymentIntentId VARCHAR(255),\n" +
           "  stripeSubscriptionId VARCHAR(255),\n" +
           "  amountCents INT NOT NULL,\n" +
           "  currency VARCHAR(10) NOT NULL,\n" +
+          "  isGift TINYINT(1) DEFAULT 0,\n" +
           "  createdAt DATETIME DEFAULT NOW(),\n" +
           "  updatedAt DATETIME DEFAULT NOW(),\n" +
           "  UNIQUE KEY webstorePurchases_session (stripeSessionId),\n" +
@@ -95,7 +83,96 @@ export async function ensureWebstoreTables() {
                     return;
                   }
 
-                  resolve(true);
+                  db.query(
+                    "CREATE TABLE IF NOT EXISTS webstoreItems (\n" +
+                      "  itemId INT AUTO_INCREMENT PRIMARY KEY,\n" +
+                      "  slug VARCHAR(64) NOT NULL UNIQUE,\n" +
+                      "  displayName VARCHAR(120) NOT NULL,\n" +
+                      "  description TEXT,\n" +
+                      "  priceCents INT NOT NULL,\n" +
+                      "  currency VARCHAR(10) NOT NULL DEFAULT 'usd',\n" +
+                      "  purchaseType ENUM('one_time', 'subscription') NOT NULL,\n" +
+                      "  stripePriceId VARCHAR(120) NOT NULL,\n" +
+                      "  isActive TINYINT(1) DEFAULT 1,\n" +
+                      "  sortOrder INT DEFAULT 0,\n" +
+                      "  createdAt DATETIME DEFAULT NOW(),\n" +
+                      "  updatedAt DATETIME DEFAULT NOW()\n" +
+                      ")",
+                    (itemsErr) => {
+                      if (itemsErr) {
+                        console.error("Failed to ensure webstoreItems table", itemsErr);
+                        resolve(false);
+                        return;
+                      }
+
+                      db.query(
+                        "CREATE TABLE IF NOT EXISTS webstoreItemCommands (\n" +
+                          "  itemCommandId INT AUTO_INCREMENT PRIMARY KEY,\n" +
+                          "  itemId INT NOT NULL,\n" +
+                          "  commandTemplate TEXT NOT NULL,\n" +
+                          "  sortOrder INT DEFAULT 0,\n" +
+                          "  createdAt DATETIME DEFAULT NOW(),\n" +
+                          "  INDEX webstoreItemCommands_item (itemId),\n" +
+                          "  CONSTRAINT fk_webstoreItemCommands_item FOREIGN KEY (itemId) REFERENCES webstoreItems(itemId) ON DELETE CASCADE\n" +
+                          ")",
+                        (commandsErr) => {
+                          if (commandsErr) {
+                            console.error("Failed to ensure webstoreItemCommands table", commandsErr);
+                            resolve(false);
+                            return;
+                          }
+
+                          db.query(
+                            "CREATE TABLE IF NOT EXISTS webstoreTransactions (\n" +
+                              "  transactionId INT AUTO_INCREMENT PRIMARY KEY,\n" +
+                              "  purchaseId INT NOT NULL,\n" +
+                              "  userId INT NOT NULL,\n" +
+                              "  direction ENUM('incoming', 'outgoing') NOT NULL,\n" +
+                              "  counterpartyMinecraftUsername VARCHAR(16) NOT NULL,\n" +
+                              "  amountCents INT NOT NULL,\n" +
+                              "  currency VARCHAR(10) NOT NULL,\n" +
+                              "  createdAt DATETIME DEFAULT NOW(),\n" +
+                              "  INDEX webstoreTransactions_user (userId),\n" +
+                              "  INDEX webstoreTransactions_purchase (purchaseId)\n" +
+                              ")",
+                            (transactionsErr) => {
+                              if (transactionsErr) {
+                                console.error(
+                                  "Failed to ensure webstoreTransactions table",
+                                  transactionsErr
+                                );
+                                resolve(false);
+                                return;
+                              }
+
+                              db.query(
+                                "CREATE TABLE IF NOT EXISTS webstoreContacts (\n" +
+                                  "  contactId INT AUTO_INCREMENT PRIMARY KEY,\n" +
+                                  "  userId INT NOT NULL,\n" +
+                                  "  minecraftUsername VARCHAR(16) NOT NULL,\n" +
+                                  "  lastTransactionAt DATETIME DEFAULT NOW(),\n" +
+                                  "  lastTransactionDirection ENUM('incoming', 'outgoing') NOT NULL,\n" +
+                                  "  UNIQUE KEY webstoreContacts_user (userId, minecraftUsername)\n" +
+                                  ")",
+                                (contactsErr) => {
+                                  if (contactsErr) {
+                                    console.error(
+                                      "Failed to ensure webstoreContacts table",
+                                      contactsErr
+                                    );
+                                    resolve(false);
+                                    return;
+                                  }
+
+                                  resolve(true);
+                                }
+                              );
+                            }
+                          );
+                        }
+                      );
+                    }
+                  );
                 }
               );
             }
@@ -111,8 +188,10 @@ export async function ensureWebstoreTables() {
 export async function createPendingPurchase({
   userId,
   item,
-  minecraftUsername,
+  purchaserMinecraftUsername,
+  recipientMinecraftUsername,
   stripeSessionId,
+  isGift,
 }) {
   await ensureWebstoreTables();
 
@@ -121,14 +200,16 @@ export async function createPendingPurchase({
     item.slug,
     item.displayName,
     item.purchaseType,
-    minecraftUsername,
+    purchaserMinecraftUsername,
+    recipientMinecraftUsername,
     stripeSessionId,
     item.priceCents,
     item.currency,
+    isGift ? 1 : 0,
   ];
 
   const result = await query(
-    "INSERT INTO webstorePurchases (userId, itemSlug, itemName, purchaseType, minecraftUsername, stripeSessionId, amountCents, currency) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
+    "INSERT INTO webstorePurchases (userId, itemSlug, itemName, purchaseType, purchaserMinecraftUsername, recipientMinecraftUsername, stripeSessionId, amountCents, currency, isGift) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
     params
   );
 
@@ -166,6 +247,47 @@ export async function getPurchaseBySessionId(stripeSessionId) {
   return rows[0] || null;
 }
 
+export async function getWebstoreItems() {
+  await ensureWebstoreTables();
+
+  const items = await query(
+    "SELECT * FROM webstoreItems WHERE isActive = 1 ORDER BY sortOrder ASC, displayName ASC"
+  );
+
+  if (!items.length) return [];
+
+  const itemIds = items.map((item) => item.itemId);
+  const commands = await query(
+    `SELECT itemId, commandTemplate FROM webstoreItemCommands WHERE itemId IN (${itemIds
+      .map(() => "?")
+      .join(",")}) ORDER BY sortOrder ASC, itemCommandId ASC`,
+    itemIds
+  );
+
+  const commandsByItem = commands.reduce((acc, command) => {
+    if (!acc[command.itemId]) acc[command.itemId] = [];
+    acc[command.itemId].push(command.commandTemplate);
+    return acc;
+  }, {});
+
+  return items.map((item) => ({
+    slug: item.slug,
+    displayName: item.displayName,
+    description: item.description,
+    priceCents: item.priceCents,
+    currency: item.currency,
+    purchaseType: item.purchaseType,
+    stripePriceId: item.stripePriceId,
+    isActive: item.isActive === 1,
+    commandTemplates: commandsByItem[item.itemId] || [],
+  }));
+}
+
+export async function findWebstoreItem(slug) {
+  const items = await getWebstoreItems();
+  return items.find((item) => item.slug === slug && item.isActive !== false) || null;
+}
+
 export async function updatePurchasePayment({
   purchaseId,
   status,
@@ -266,6 +388,73 @@ export async function getPurchasesNeedingFulfillment() {
   );
 }
 
+export async function createTransactionsForPurchase({
+  purchaseId,
+  payerUserId,
+  payerMinecraftUsername,
+  recipientMinecraftUsername,
+  amountCents,
+  currency,
+}) {
+  await ensureWebstoreTables();
+
+  const transactions = [
+    [
+      purchaseId,
+      payerUserId,
+      "outgoing",
+      recipientMinecraftUsername,
+      amountCents,
+      currency,
+    ],
+  ];
+
+  if (payerMinecraftUsername !== recipientMinecraftUsername) {
+    const recipientRows = await query(
+      "SELECT userId FROM users WHERE username = ? LIMIT 1",
+      [recipientMinecraftUsername]
+    );
+    const recipientUserId = recipientRows?.[0]?.userId;
+    if (recipientUserId) {
+      transactions.push([
+        purchaseId,
+        recipientUserId,
+        "incoming",
+        payerMinecraftUsername,
+        amountCents,
+        currency,
+      ]);
+    }
+  }
+
+  await query(
+    "INSERT INTO webstoreTransactions (purchaseId, userId, direction, counterpartyMinecraftUsername, amountCents, currency) VALUES ?",
+    [transactions]
+  );
+
+  const contactUpdates = transactions.map((transaction) => [
+    transaction[1],
+    transaction[3],
+    transaction[2],
+  ]);
+
+  await query(
+    "INSERT INTO webstoreContacts (userId, minecraftUsername, lastTransactionDirection) VALUES ? ON DUPLICATE KEY UPDATE lastTransactionAt = NOW(), lastTransactionDirection = VALUES(lastTransactionDirection)",
+    [contactUpdates]
+  );
+}
+
+export async function getMonthlyPurchaseTotals(startDate, endDate) {
+  await ensureWebstoreTables();
+
+  const results = await query(
+    "SELECT COALESCE(SUM(amountCents), 0) AS totalCents FROM webstorePurchases WHERE status IN ('paid', 'fulfilled') AND createdAt BETWEEN ? AND ?",
+    [startDate, endDate]
+  );
+
+  return Number(results?.[0]?.totalCents || 0);
+}
+
 export function formatPrice(priceCents, currency) {
   const amount = Number(priceCents) || 0;
   const normalizedCurrency = (currency || "usd").toUpperCase();
diff --git a/dbinit.sql b/dbinit.sql
index e7ad5f76..d53569fa 100644
--- a/dbinit.sql
+++ b/dbinit.sql
@@ -206,13 +206,15 @@ CREATE TABLE webstorePurchases (
     itemSlug VARCHAR(64) NOT NULL,
     itemName VARCHAR(120) NOT NULL,
     purchaseType ENUM('one_time', 'subscription') NOT NULL,
-    minecraftUsername VARCHAR(16) NOT NULL,
+    purchaserMinecraftUsername VARCHAR(16) NOT NULL,
+    recipientMinecraftUsername VARCHAR(16) NOT NULL,
     status ENUM('pending', 'paid', 'fulfilled', 'failed') DEFAULT 'pending',
     stripeSessionId VARCHAR(255) NOT NULL,
     stripePaymentIntentId VARCHAR(255),
     stripeSubscriptionId VARCHAR(255),
     amountCents INT NOT NULL,
     currency VARCHAR(10) NOT NULL,
+    isGift TINYINT(1) DEFAULT 0,
     createdAt DATETIME DEFAULT NOW(),
     updatedAt DATETIME DEFAULT NOW(),
     PRIMARY KEY (purchaseId),
@@ -252,6 +254,57 @@ CREATE TABLE webstoreWebhookEvents (
     CONSTRAINT fk_webstoreWebhookEvents_purchase FOREIGN KEY (purchaseId) REFERENCES webstorePurchases(purchaseId) ON DELETE SET NULL
 );
 
+CREATE TABLE webstoreItems (
+        itemId INT NOT NULL AUTO_INCREMENT,
+    slug VARCHAR(64) NOT NULL UNIQUE,
+    displayName VARCHAR(120) NOT NULL,
+    description TEXT,
+    priceCents INT NOT NULL,
+    currency VARCHAR(10) NOT NULL DEFAULT 'usd',
+    purchaseType ENUM('one_time', 'subscription') NOT NULL,
+    stripePriceId VARCHAR(120) NOT NULL,
+    isActive TINYINT(1) DEFAULT 1,
+    sortOrder INT DEFAULT 0,
+    createdAt DATETIME DEFAULT NOW(),
+    updatedAt DATETIME DEFAULT NOW(),
+    PRIMARY KEY (itemId)
+);
+
+CREATE TABLE webstoreItemCommands (
+        itemCommandId INT NOT NULL AUTO_INCREMENT,
+    itemId INT NOT NULL,
+    commandTemplate TEXT NOT NULL,
+    sortOrder INT DEFAULT 0,
+    createdAt DATETIME DEFAULT NOW(),
+    PRIMARY KEY (itemCommandId),
+    INDEX webstoreItemCommands_item (itemId),
+    CONSTRAINT fk_webstoreItemCommands_item FOREIGN KEY (itemId) REFERENCES webstoreItems(itemId) ON DELETE CASCADE
+);
+
+CREATE TABLE webstoreTransactions (
+        transactionId INT NOT NULL AUTO_INCREMENT,
+    purchaseId INT NOT NULL,
+    userId INT NOT NULL,
+    direction ENUM('incoming', 'outgoing') NOT NULL,
+    counterpartyMinecraftUsername VARCHAR(16) NOT NULL,
+    amountCents INT NOT NULL,
+    currency VARCHAR(10) NOT NULL,
+    createdAt DATETIME DEFAULT NOW(),
+    PRIMARY KEY (transactionId),
+    INDEX webstoreTransactions_user (userId),
+    INDEX webstoreTransactions_purchase (purchaseId)
+);
+
+CREATE TABLE webstoreContacts (
+        contactId INT NOT NULL AUTO_INCREMENT,
+    userId INT NOT NULL,
+    minecraftUsername VARCHAR(16) NOT NULL,
+    lastTransactionAt DATETIME DEFAULT NOW(),
+    lastTransactionDirection ENUM('incoming', 'outgoing') NOT NULL,
+    PRIMARY KEY (contactId),
+    UNIQUE KEY webstoreContacts_user (userId, minecraftUsername)
+);
+
 INSERT INTO serverStatus (serverStatusId, statusInfo)
 VALUES (1, null);
 
diff --git a/migration/v1.8.0_v1.9.0.sql b/migration/v1.8.0_v1.9.0.sql
index 382fdaa8..b0b67a61 100644
--- a/migration/v1.8.0_v1.9.0.sql
+++ b/migration/v1.8.0_v1.9.0.sql
@@ -4,13 +4,15 @@ CREATE TABLE webstorePurchases (
     itemSlug VARCHAR(64) NOT NULL,
     itemName VARCHAR(120) NOT NULL,
     purchaseType ENUM('one_time', 'subscription') NOT NULL,
-    minecraftUsername VARCHAR(16) NOT NULL,
+    purchaserMinecraftUsername VARCHAR(16) NOT NULL,
+    recipientMinecraftUsername VARCHAR(16) NOT NULL,
     status ENUM('pending', 'paid', 'fulfilled', 'failed') DEFAULT 'pending',
     stripeSessionId VARCHAR(255) NOT NULL,
     stripePaymentIntentId VARCHAR(255),
     stripeSubscriptionId VARCHAR(255),
     amountCents INT NOT NULL,
     currency VARCHAR(10) NOT NULL,
+    isGift TINYINT(1) DEFAULT 0,
     createdAt DATETIME DEFAULT NOW(),
     updatedAt DATETIME DEFAULT NOW(),
     PRIMARY KEY (purchaseId),
@@ -49,3 +51,54 @@ CREATE TABLE webstoreWebhookEvents (
     INDEX webstoreWebhookEvents_purchase (purchaseId),
     CONSTRAINT fk_webstoreWebhookEvents_purchase FOREIGN KEY (purchaseId) REFERENCES webstorePurchases(purchaseId) ON DELETE SET NULL
 );
+
+CREATE TABLE webstoreItems (
+    itemId INT NOT NULL AUTO_INCREMENT,
+    slug VARCHAR(64) NOT NULL UNIQUE,
+    displayName VARCHAR(120) NOT NULL,
+    description TEXT,
+    priceCents INT NOT NULL,
+    currency VARCHAR(10) NOT NULL DEFAULT 'usd',
+    purchaseType ENUM('one_time', 'subscription') NOT NULL,
+    stripePriceId VARCHAR(120) NOT NULL,
+    isActive TINYINT(1) DEFAULT 1,
+    sortOrder INT DEFAULT 0,
+    createdAt DATETIME DEFAULT NOW(),
+    updatedAt DATETIME DEFAULT NOW(),
+    PRIMARY KEY (itemId)
+);
+
+CREATE TABLE webstoreItemCommands (
+    itemCommandId INT NOT NULL AUTO_INCREMENT,
+    itemId INT NOT NULL,
+    commandTemplate TEXT NOT NULL,
+    sortOrder INT DEFAULT 0,
+    createdAt DATETIME DEFAULT NOW(),
+    PRIMARY KEY (itemCommandId),
+    INDEX webstoreItemCommands_item (itemId),
+    CONSTRAINT fk_webstoreItemCommands_item FOREIGN KEY (itemId) REFERENCES webstoreItems(itemId) ON DELETE CASCADE
+);
+
+CREATE TABLE webstoreTransactions (
+    transactionId INT NOT NULL AUTO_INCREMENT,
+    purchaseId INT NOT NULL,
+    userId INT NOT NULL,
+    direction ENUM('incoming', 'outgoing') NOT NULL,
+    counterpartyMinecraftUsername VARCHAR(16) NOT NULL,
+    amountCents INT NOT NULL,
+    currency VARCHAR(10) NOT NULL,
+    createdAt DATETIME DEFAULT NOW(),
+    PRIMARY KEY (transactionId),
+    INDEX webstoreTransactions_user (userId),
+    INDEX webstoreTransactions_purchase (purchaseId)
+);
+
+CREATE TABLE webstoreContacts (
+    contactId INT NOT NULL AUTO_INCREMENT,
+    userId INT NOT NULL,
+    minecraftUsername VARCHAR(16) NOT NULL,
+    lastTransactionAt DATETIME DEFAULT NOW(),
+    lastTransactionDirection ENUM('incoming', 'outgoing') NOT NULL,
+    PRIMARY KEY (contactId),
+    UNIQUE KEY webstoreContacts_user (userId, minecraftUsername)
+);
diff --git a/routes/webstoreRoutes.js b/routes/webstoreRoutes.js
index ea477619..7259bad5 100644
--- a/routes/webstoreRoutes.js
+++ b/routes/webstoreRoutes.js
@@ -6,9 +6,16 @@ import {
   findWebstoreItem,
   formatPrice,
   getWebstoreItems,
+  getMonthlyPurchaseTotals,
 } from "../controllers/webstoreController.js";
 
-async function createStripeCheckoutSession({ item, userId, minecraftUsername }) {
+async function createStripeCheckoutSession({
+  item,
+  userId,
+  minecraftUsername,
+  purchaserMinecraftUsername,
+  isGift,
+}) {
   const apiKey = process.env.STRIPE_SECRET_KEY;
   if (!apiKey) {
     throw new Error("Stripe secret key is not configured");
@@ -26,6 +33,8 @@ async function createStripeCheckoutSession({ item, userId, minecraftUsername })
   body.append("client_reference_id", String(userId));
   body.append("metadata[itemSlug]", item.slug);
   body.append("metadata[minecraftUsername]", minecraftUsername);
+  body.append("metadata[purchaserMinecraftUsername]", purchaserMinecraftUsername);
+  body.append("metadata[isGift]", isGift ? "true" : "false");
   body.append("metadata[userId]", String(userId));
 
   const response = await fetch("https://api.stripe.com/v1/checkout/sessions", {
@@ -64,12 +73,18 @@ export default function webstoreRoutes(app, config, features) {
       return res.redirect("/profile");
     }
 
-    const items = getWebstoreItems().map((item) => ({
-      ...item,
-      priceDisplay: formatPrice(item.priceCents, item.currency),
-      purchaseLabel:
-        item.purchaseType === "subscription" ? "Subscribe" : "Buy once",
-    }));
+    let items = [];
+    try {
+      items = (await getWebstoreItems()).map((item) => ({
+        ...item,
+        priceDisplay: formatPrice(item.priceCents, item.currency),
+        purchaseLabel:
+          item.purchaseType === "subscription" ? "Subscribe" : "Buy once",
+      }));
+    } catch (error) {
+      console.error("Failed to load webstore items", error);
+      setBannerCookie("warning", "Webstore items are unavailable right now.", res);
+    }
 
     return res.view("webstore/index", {
       pageTitle: "Webstore",
@@ -104,7 +119,7 @@ export default function webstoreRoutes(app, config, features) {
     }
 
     const itemSlug = req.body.itemSlug ? req.body.itemSlug.trim() : "";
-    const item = findWebstoreItem(itemSlug);
+    const item = await findWebstoreItem(itemSlug);
 
     if (!item) {
       setBannerCookie("warning", "That item is no longer available.", res);
@@ -116,8 +131,8 @@ export default function webstoreRoutes(app, config, features) {
       return res.redirect("/webstore");
     }
 
-    const minecraftUsername = req.session?.user?.username;
-    if (!minecraftUsername) {
+    const purchaserMinecraftUsername = req.session?.user?.username;
+    if (!purchaserMinecraftUsername) {
       setBannerCookie(
         "warning",
         "Please verify your Minecraft account before purchasing.",
@@ -126,18 +141,36 @@ export default function webstoreRoutes(app, config, features) {
       return res.redirect("/profile");
     }
 
+    const recipientUsernameRaw = req.body.recipientUsername
+      ? req.body.recipientUsername.trim()
+      : "";
+    const recipientMinecraftUsername = recipientUsernameRaw || purchaserMinecraftUsername;
+
+    if (!/^[A-Za-z0-9_]{1,16}$/.test(recipientMinecraftUsername)) {
+      setBannerCookie(
+        "warning",
+        "Recipient Minecraft username must be 1-16 characters.",
+        res
+      );
+      return res.redirect("/webstore");
+    }
+
     try {
       const session = await createStripeCheckoutSession({
         item,
         userId: req.session.user.userId,
-        minecraftUsername,
+        minecraftUsername: recipientMinecraftUsername,
+        purchaserMinecraftUsername,
+        isGift: recipientMinecraftUsername !== purchaserMinecraftUsername,
       });
 
       await createPendingPurchase({
         userId: req.session.user.userId,
         item,
-        minecraftUsername,
+        purchaserMinecraftUsername,
+        recipientMinecraftUsername,
         stripeSessionId: session.id,
+        isGift: recipientMinecraftUsername !== purchaserMinecraftUsername,
       });
 
       if (!session.url) {
@@ -156,4 +189,40 @@ export default function webstoreRoutes(app, config, features) {
       return res.redirect("/webstore");
     }
   });
+
+  app.get("/give", async function (req, res) {
+    const startOfMonth = new Date();
+    startOfMonth.setDate(1);
+    startOfMonth.setHours(0, 0, 0, 0);
+
+    const endOfMonth = new Date(startOfMonth);
+    endOfMonth.setMonth(endOfMonth.getMonth() + 1);
+    endOfMonth.setMilliseconds(-1);
+
+    const monthlyGoalCents =
+      config?.siteConfiguration?.webstore?.monthlyGoalCents ??
+      Number(process.env.WEBSTORE_MONTHLY_GOAL_CENTS || 100000);
+
+    let raisedCents = 0;
+    try {
+      raisedCents = await getMonthlyPurchaseTotals(startOfMonth, endOfMonth);
+    } catch (error) {
+      console.error("Failed to load monthly webstore totals", error);
+    }
+    const progressPercent = monthlyGoalCents
+      ? Math.min(100, Math.round((raisedCents / monthlyGoalCents) * 100))
+      : 0;
+
+    return res.view("give/index", {
+      pageTitle: "Support the Server",
+      config,
+      req,
+      features,
+      globalImage: await getGlobalImage(),
+      announcementWeb: await getWebAnnouncement(),
+      monthlyGoalCents,
+      raisedCents,
+      progressPercent,
+    });
+  });
 }
diff --git a/views/give/index.ejs b/views/give/index.ejs
new file mode 100644
index 00000000..6d4603d4
--- /dev/null
+++ b/views/give/index.ejs
@@ -0,0 +1,109 @@
+<%- include("modules/header.ejs", {
+    pageTitle: pageTitle,
+    pageDescription: "Support Crafting For Christ and keep the network growing."
+}) %>
+
+<%- include("modules/navigationBar.ejs") %>
+
+<%- include("partials/miniHeader.ejs", {
+  headerTitle: "Support the Server",
+  backgroundImage: globalImage
+}) %>
+
+<section class="section">
+  <div class="container">
+    <div class="mb-5 text-center">
+      <h2>🙏 Support Crafting For Christ</h2>
+      <p class="text-muted">
+        Crafting For Christ is a Minecraft network built around faith, friendship, and fun.
+        Your support helps keep the servers online and the community growing.
+      </p>
+      <div class="d-flex justify-content-center gap-2 flex-wrap">
+        <a href="/ranks" class="btn btn-outline-primary">See Ranks &amp; Perks</a>
+        <a href="/webstore" class="btn btn-primary">Support the Server</a>
+      </div>
+    </div>
+
+    <div class="mb-5">
+      <h3>✨ Why We Ask for Support</h3>
+      <p>Running Minecraft servers costs money every month. Your support helps pay for things like:</p>
+      <ul>
+        <li>Server hosting</li>
+        <li>Backups and security</li>
+        <li>Plugins and updates</li>
+        <li>Events and new features</li>
+      </ul>
+      <p>
+        Our goal is to keep Crafting For Christ a safe, positive, Christ-centred place for everyone to enjoy.
+      </p>
+    </div>
+
+    <div class="mb-5">
+      <h3>💰 This Month’s Server Goal</h3>
+      <p>Each month we have a set goal to cover our server costs.</p>
+      <div class="progress mb-2" style="height: 24px;">
+        <div
+          class="progress-bar"
+          role="progressbar"
+          style="width: <%= progressPercent %>%"
+          aria-valuenow="<%= progressPercent %>"
+          aria-valuemin="0"
+          aria-valuemax="100"
+        >
+          <%= progressPercent %>% funded
+        </div>
+      </div>
+      <p class="text-muted">
+        <strong>$<%= (raisedCents / 100).toFixed(2) %></strong>
+        of <strong>$<%= (monthlyGoalCents / 100).toFixed(2) %></strong>
+      </p>
+      <p class="text-muted">Every purchase or donation through the store helps move this bar forward.</p>
+    </div>
+
+    <div class="mb-5">
+      <h3>💬 How You Can Help</h3>
+      <ol>
+        <li>
+          <strong>Buy a Rank</strong>
+          <p>Ranks help support the server and give you cool in-game perks.</p>
+          <a href="/ranks">View ranks here</a>
+        </li>
+        <li class="mt-3">
+          <strong>Monthly Support</strong>
+          <p>You can also support the server monthly if you want to help long-term.</p>
+          <a href="/webstore">Support or gift here</a>
+          <p class="text-muted mb-0">You can even gift a rank to another player to bless them!</p>
+        </li>
+      </ol>
+    </div>
+
+    <div class="mb-5">
+      <h3>❤️ What Your Support Does</h3>
+      <ul>
+        <li>Keep the servers running smoothly</li>
+        <li>Create a safe place to play</li>
+        <li>Encourage faith and kindness</li>
+        <li>Welcome new players</li>
+      </ul>
+      <p>
+        Crafting For Christ isn’t just a server — it’s a community where people can grow together.
+      </p>
+    </div>
+
+    <div class="mb-5">
+      <h3>📢 Server Updates</h3>
+      <p>
+        This section is used for important updates, like server upgrades, maintenance times, or big changes.
+      </p>
+      <p class="text-muted">(Updates will appear here when needed.)</p>
+    </div>
+
+    <div class="text-center">
+      <h3>🙏 Thank You for Being Here</h3>
+      <p>Thank you for playing, praying, and supporting Crafting For Christ.</p>
+      <p class="text-muted">“Whatever you do, do it all for the glory of God.” ❤️</p>
+    </div>
+  </div>
+</section>
+
+<%- include("modules/footer.ejs") %>
diff --git a/views/modules/navigationBar.ejs b/views/modules/navigationBar.ejs
index 4becd3cf..92e8a136 100644
--- a/views/modules/navigationBar.ejs
+++ b/views/modules/navigationBar.ejs
@@ -35,6 +35,7 @@
                         <li class="nav-item"><a class="nav-link" href="/ranks">Ranks</a></li>
                     <% } %>
                     <li class="nav-item"><a class="nav-link" href="/webstore">Webstore</a></li>
+                    <li class="nav-item"><a class="nav-link" href="/give">Give</a></li>
                     <% if (req.session?.user?.permissions?.includes('zander.web.dashboard') || req.session?.user?.permissions?.includes('zander.web.*') || req.session?.user?.permissions?.includes('*')) { %>
                         <li class="nav-item dropdown">
                             <a class="nav-link dropdown-toggle" href="#" id="dashboardDropdown" role="button" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
diff --git a/views/webstore/index.ejs b/views/webstore/index.ejs
index 7e882247..6d3d71d0 100644
--- a/views/webstore/index.ejs
+++ b/views/webstore/index.ejs
@@ -36,6 +36,17 @@
               </div>
               <form method="post" action="/webstore/checkout">
                 <input type="hidden" name="itemSlug" value="<%= item.slug %>">
+                <div class="mb-2">
+                  <label class="form-label">Gift to another player (optional)</label>
+                  <input
+                    type="text"
+                    name="recipientUsername"
+                    class="form-control form-control-sm"
+                    placeholder="Minecraft username"
+                    maxlength="16"
+                  >
+                  <small class="text-muted">Leave blank to buy for yourself.</small>
+                </div>
                 <button type="submit" class="btn btn-primary btn-sm"><%= item.purchaseLabel %></button>
               </form>
             </div>
diff --git a/webstoreItems.json b/webstoreItems.json
deleted file mode 100644
index af9b053f..00000000
--- a/webstoreItems.json
+++ /dev/null
@@ -1,76 +0,0 @@
-{
-  "items": [
-    {
-      "slug": "iron-rank-monthly",
-      "displayName": "Iron Rank (Monthly)",
-      "description": "Monthly Iron rank subscription with ongoing perks.",
-      "priceCents": 499,
-      "currency": "usd",
-      "purchaseType": "subscription",
-      "stripePriceId": "price_iron_monthly",
-      "commandTemplates": [
-        "lp user {{username}} parent add iron"
-      ]
-    },
-    {
-      "slug": "iron-rank-onetime",
-      "displayName": "Iron Rank (Lifetime)",
-      "description": "One-time Iron rank unlock.",
-      "priceCents": 2999,
-      "currency": "usd",
-      "purchaseType": "one_time",
-      "stripePriceId": "price_iron_onetime",
-      "commandTemplates": [
-        "lp user {{username}} parent add iron"
-      ]
-    },
-    {
-      "slug": "gold-rank-monthly",
-      "displayName": "Gold Rank (Monthly)",
-      "description": "Monthly Gold rank subscription with ongoing perks.",
-      "priceCents": 899,
-      "currency": "usd",
-      "purchaseType": "subscription",
-      "stripePriceId": "price_gold_monthly",
-      "commandTemplates": [
-        "lp user {{username}} parent add gold"
-      ]
-    },
-    {
-      "slug": "gold-rank-onetime",
-      "displayName": "Gold Rank (Lifetime)",
-      "description": "One-time Gold rank unlock.",
-      "priceCents": 4999,
-      "currency": "usd",
-      "purchaseType": "one_time",
-      "stripePriceId": "price_gold_onetime",
-      "commandTemplates": [
-        "lp user {{username}} parent add gold"
-      ]
-    },
-    {
-      "slug": "diamond-rank-monthly",
-      "displayName": "Diamond Rank (Monthly)",
-      "description": "Monthly Diamond rank subscription with ongoing perks.",
-      "priceCents": 1499,
-      "currency": "usd",
-      "purchaseType": "subscription",
-      "stripePriceId": "price_diamond_monthly",
-      "commandTemplates": [
-        "lp user {{username}} parent add diamond"
-      ]
-    },
-    {
-      "slug": "diamond-rank-onetime",
-      "displayName": "Diamond Rank (Lifetime)",
-      "description": "One-time Diamond rank unlock.",
-      "priceCents": 8999,
-      "currency": "usd",
-      "purchaseType": "one_time",
-      "stripePriceId": "price_diamond_onetime",
-      "commandTemplates": [
-        "lp user {{username}} parent add diamond"
-      ]
-    }
-  ]
-}

From cab8ad5214f5d9f6619601e41289797b6a53471f Mon Sep 17 00:00:00 2001
From: Ben Robson <shadowolfbusiness@gmail.com>
Date: Tue, 30 Dec 2025 21:03:51 +1100
Subject: [PATCH 3/9] Fix give/webstore view include paths

---
 views/give/index.ejs         | 8 ++++----
 views/webstore/index.ejs     | 8 ++++----
 views/webstore/thank-you.ejs | 8 ++++----
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/views/give/index.ejs b/views/give/index.ejs
index 6d4603d4..f4f57cde 100644
--- a/views/give/index.ejs
+++ b/views/give/index.ejs
@@ -1,11 +1,11 @@
-<%- include("modules/header.ejs", {
+<%- include("../modules/header.ejs", {
     pageTitle: pageTitle,
     pageDescription: "Support Crafting For Christ and keep the network growing."
 }) %>
 
-<%- include("modules/navigationBar.ejs") %>
+<%- include("../modules/navigationBar.ejs") %>
 
-<%- include("partials/miniHeader.ejs", {
+<%- include("../partials/miniHeader.ejs", {
   headerTitle: "Support the Server",
   backgroundImage: globalImage
 }) %>
@@ -106,4 +106,4 @@
   </div>
 </section>
 
-<%- include("modules/footer.ejs") %>
+<%- include("../modules/footer.ejs") %>
diff --git a/views/webstore/index.ejs b/views/webstore/index.ejs
index 6d3d71d0..dd77d71d 100644
--- a/views/webstore/index.ejs
+++ b/views/webstore/index.ejs
@@ -1,11 +1,11 @@
-<%- include("modules/header.ejs", {
+<%- include("../modules/header.ejs", {
     pageTitle: pageTitle,
     pageDescription: "Support the server with ranks, cosmetics, keys, and more."
 }) %>
 
-<%- include("modules/navigationBar.ejs") %>
+<%- include("../modules/navigationBar.ejs") %>
 
-<%- include("partials/miniHeader.ejs", {
+<%- include("../partials/miniHeader.ejs", {
   headerTitle: "Webstore",
   backgroundImage: globalImage
 }) %>
@@ -57,4 +57,4 @@
   </div>
 </section>
 
-<%- include("modules/footer.ejs") %>
+<%- include("../modules/footer.ejs") %>
diff --git a/views/webstore/thank-you.ejs b/views/webstore/thank-you.ejs
index f776332a..851fc212 100644
--- a/views/webstore/thank-you.ejs
+++ b/views/webstore/thank-you.ejs
@@ -1,11 +1,11 @@
-<%- include("modules/header.ejs", {
+<%- include("../modules/header.ejs", {
     pageTitle: pageTitle,
     pageDescription: "Thanks for supporting the server."
 }) %>
 
-<%- include("modules/navigationBar.ejs") %>
+<%- include("../modules/navigationBar.ejs") %>
 
-<%- include("partials/miniHeader.ejs", {
+<%- include("../partials/miniHeader.ejs", {
   headerTitle: "Thank you",
   backgroundImage: globalImage
 }) %>
@@ -21,4 +21,4 @@
   </div>
 </section>
 
-<%- include("modules/footer.ejs") %>
+<%- include("../modules/footer.ejs") %>

From 14fdb97679f609e0ddf00e87f1ed734e4531f60a Mon Sep 17 00:00:00 2001
From: Ben Robson <shadowolfbusiness@gmail.com>
Date: Tue, 30 Dec 2025 21:25:19 +1100
Subject: [PATCH 4/9] Add dashboard webstore management page

---
 controllers/webstoreController.js             |  52 ++++++
 routes/dashboard/index.js                     |   2 +
 routes/dashboard/webstore.js                  | 119 +++++++++++++
 views/dashboard/webstore/index.ejs            | 166 ++++++++++++++++++
 views/modules/dashboard/dashboard-sidebar.ejs |   3 +
 5 files changed, 342 insertions(+)
 create mode 100644 routes/dashboard/webstore.js
 create mode 100644 views/dashboard/webstore/index.ejs

diff --git a/controllers/webstoreController.js b/controllers/webstoreController.js
index 1e1c5e06..c3cc9142 100644
--- a/controllers/webstoreController.js
+++ b/controllers/webstoreController.js
@@ -271,6 +271,7 @@ export async function getWebstoreItems() {
   }, {});
 
   return items.map((item) => ({
+    itemId: item.itemId,
     slug: item.slug,
     displayName: item.displayName,
     description: item.description,
@@ -288,6 +289,57 @@ export async function findWebstoreItem(slug) {
   return items.find((item) => item.slug === slug && item.isActive !== false) || null;
 }
 
+export async function createWebstoreItem({
+  slug,
+  displayName,
+  description,
+  priceCents,
+  currency,
+  purchaseType,
+  stripePriceId,
+  isActive,
+  sortOrder,
+}) {
+  await ensureWebstoreTables();
+
+  const result = await query(
+    "INSERT INTO webstoreItems (slug, displayName, description, priceCents, currency, purchaseType, stripePriceId, isActive, sortOrder) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+    [
+      slug,
+      displayName,
+      description || null,
+      priceCents,
+      currency,
+      purchaseType,
+      stripePriceId,
+      isActive ? 1 : 0,
+      sortOrder || 0,
+    ]
+  );
+
+  return result.insertId;
+}
+
+export async function addWebstoreItemCommand({ itemId, commandTemplate, sortOrder }) {
+  await ensureWebstoreTables();
+
+  const result = await query(
+    "INSERT INTO webstoreItemCommands (itemId, commandTemplate, sortOrder) VALUES (?, ?, ?)",
+    [itemId, commandTemplate, sortOrder || 0]
+  );
+
+  return result.insertId;
+}
+
+export async function updateWebstoreItemStatus(itemId, isActive) {
+  await ensureWebstoreTables();
+
+  return query(
+    "UPDATE webstoreItems SET isActive = ?, updatedAt = NOW() WHERE itemId = ?",
+    [isActive ? 1 : 0, itemId]
+  );
+}
+
 export async function updatePurchasePayment({
   purchaseId,
   status,
diff --git a/routes/dashboard/index.js b/routes/dashboard/index.js
index 6ffa4672..ba69cdbd 100644
--- a/routes/dashboard/index.js
+++ b/routes/dashboard/index.js
@@ -6,6 +6,7 @@ import dashboardVaultSiteRoute from "./vault.js";
 import dashboardRanksSiteRoute from "./ranks.js";
 import supportDashboardRoutes from "./support.js";
 import dashboardSchedulerSiteRoute from "./scheduler.js";
+import dashboardWebstoreRoutes from "./webstore.js";
 
 export default function dashboardSiteRoutes(
   app,
@@ -25,4 +26,5 @@ export default function dashboardSiteRoutes(
   dashboardVaultSiteRoute(app, fetch, config, db, features, lang);
   dashboardRanksSiteRoute(app, fetch, config, db, features, lang);
   dashboardSchedulerSiteRoute(app, client, fetch, config, features, lang);
+  dashboardWebstoreRoutes(app, config, features, lang);
 }
diff --git a/routes/dashboard/webstore.js b/routes/dashboard/webstore.js
new file mode 100644
index 00000000..b54a2792
--- /dev/null
+++ b/routes/dashboard/webstore.js
@@ -0,0 +1,119 @@
+import { getGlobalImage, hasPermission, setBannerCookie } from "../../api/common.js";
+import { getWebAnnouncement } from "../../controllers/announcementController.js";
+import {
+  addWebstoreItemCommand,
+  createWebstoreItem,
+  getWebstoreItems,
+  updateWebstoreItemStatus,
+} from "../../controllers/webstoreController.js";
+
+export default function dashboardWebstoreRoutes(app, config, features, lang) {
+  app.get("/dashboard/webstore", async function (req, res) {
+    if (!hasPermission("zander.web.webstore", req, res, features)) return;
+
+    let items = [];
+    try {
+      items = await getWebstoreItems();
+    } catch (error) {
+      console.error("Failed to load webstore items", error);
+      setBannerCookie("warning", "Unable to load webstore items.", res);
+    }
+
+    return res.view("dashboard/webstore/index", {
+      pageTitle: "Dashboard - Webstore",
+      config,
+      features,
+      req,
+      items,
+      globalImage: await getGlobalImage(),
+      announcementWeb: await getWebAnnouncement(),
+    });
+  });
+
+  app.post("/dashboard/webstore/items", async function (req, res) {
+    if (!hasPermission("zander.web.webstore", req, res, features)) return;
+
+    const slug = req.body.slug ? req.body.slug.trim() : "";
+    const displayName = req.body.displayName ? req.body.displayName.trim() : "";
+    const description = req.body.description ? req.body.description.trim() : "";
+    const stripePriceId = req.body.stripePriceId ? req.body.stripePriceId.trim() : "";
+    const purchaseType = req.body.purchaseType ? req.body.purchaseType.trim() : "one_time";
+    const currency = req.body.currency ? req.body.currency.trim() : "usd";
+    const priceCents = Number(req.body.priceCents) || 0;
+    const sortOrder = Number(req.body.sortOrder) || 0;
+    const isActive = req.body.isActive === "on";
+
+    if (!slug || !displayName || !stripePriceId || !priceCents) {
+      setBannerCookie("warning", "Slug, display name, Stripe price, and price are required.", res);
+      return res.redirect("/dashboard/webstore");
+    }
+
+    try {
+      await createWebstoreItem({
+        slug,
+        displayName,
+        description,
+        priceCents,
+        currency,
+        purchaseType,
+        stripePriceId,
+        isActive,
+        sortOrder,
+      });
+
+      setBannerCookie("success", "Webstore item created.", res);
+    } catch (error) {
+      console.error("Failed to create webstore item", error);
+      setBannerCookie("danger", "Unable to create webstore item.", res);
+    }
+
+    return res.redirect("/dashboard/webstore");
+  });
+
+  app.post("/dashboard/webstore/items/:itemId/commands", async function (req, res) {
+    if (!hasPermission("zander.web.webstore", req, res, features)) return;
+
+    const itemId = Number(req.params.itemId);
+    const commandTemplate = req.body.commandTemplate
+      ? req.body.commandTemplate.trim()
+      : "";
+    const sortOrder = Number(req.body.sortOrder) || 0;
+
+    if (!itemId || Number.isNaN(itemId) || !commandTemplate) {
+      setBannerCookie("warning", "Command template is required.", res);
+      return res.redirect("/dashboard/webstore");
+    }
+
+    try {
+      await addWebstoreItemCommand({ itemId, commandTemplate, sortOrder });
+      setBannerCookie("success", "Command template added.", res);
+    } catch (error) {
+      console.error("Failed to add webstore command", error);
+      setBannerCookie("danger", "Unable to add command template.", res);
+    }
+
+    return res.redirect("/dashboard/webstore");
+  });
+
+  app.post("/dashboard/webstore/items/:itemId/status", async function (req, res) {
+    if (!hasPermission("zander.web.webstore", req, res, features)) return;
+
+    const itemId = Number(req.params.itemId);
+    const isActive = req.body.isActive === "on";
+
+    if (!itemId || Number.isNaN(itemId)) {
+      setBannerCookie("warning", "Invalid item selected.", res);
+      return res.redirect("/dashboard/webstore");
+    }
+
+    try {
+      await updateWebstoreItemStatus(itemId, isActive);
+      setBannerCookie("success", "Item status updated.", res);
+    } catch (error) {
+      console.error("Failed to update webstore item", error);
+      setBannerCookie("danger", "Unable to update item status.", res);
+    }
+
+    return res.redirect("/dashboard/webstore");
+  });
+}
diff --git a/views/dashboard/webstore/index.ejs b/views/dashboard/webstore/index.ejs
new file mode 100644
index 00000000..31d1f89d
--- /dev/null
+++ b/views/dashboard/webstore/index.ejs
@@ -0,0 +1,166 @@
+<%- include("../../modules/header.ejs", {
+  pageTitle: pageTitle,
+  pageDescription: "Manage webstore items and commands."
+}) %>
+
+<%- include("../../modules/navigationBar.ejs") %>
+
+<%- include("../../modules/dashboard/dashboard-header.ejs") %>
+
+<div class="container-fluid">
+  <div class="row">
+    <%- include("../../modules/dashboard/dashboard-sidebar.ejs") %>
+
+    <main role="main" class="col-md-9 ml-sm-auto col-lg-10 px-4">
+      <div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
+        <h1 class="h2">Webstore Management</h1>
+      </div>
+
+      <div class="row g-4">
+        <div class="col-12">
+          <div class="card shadow-sm">
+            <div class="card-header">
+              <h5 class="card-title mb-1">Create new item</h5>
+              <p class="card-subtitle text-muted mb-0">Add a new product or subscription backed by a Stripe price ID.</p>
+            </div>
+            <div class="card-body">
+              <form method="post" action="/dashboard/webstore/items" class="row g-3">
+                <div class="col-md-4">
+                  <label class="form-label">Slug</label>
+                  <input type="text" name="slug" class="form-control" placeholder="diamond-rank-monthly" required>
+                </div>
+                <div class="col-md-4">
+                  <label class="form-label">Display name</label>
+                  <input type="text" name="displayName" class="form-control" placeholder="Diamond Rank (Monthly)" required>
+                </div>
+                <div class="col-md-4">
+                  <label class="form-label">Stripe price ID</label>
+                  <input type="text" name="stripePriceId" class="form-control" placeholder="price_123" required>
+                </div>
+                <div class="col-md-6">
+                  <label class="form-label">Description</label>
+                  <input type="text" name="description" class="form-control" placeholder="Monthly Diamond rank subscription">
+                </div>
+                <div class="col-md-2">
+                  <label class="form-label">Price (cents)</label>
+                  <input type="number" name="priceCents" class="form-control" min="1" required>
+                </div>
+                <div class="col-md-2">
+                  <label class="form-label">Currency</label>
+                  <input type="text" name="currency" class="form-control" value="usd">
+                </div>
+                <div class="col-md-2">
+                  <label class="form-label">Type</label>
+                  <select name="purchaseType" class="form-select">
+                    <option value="one_time">One-time</option>
+                    <option value="subscription">Subscription</option>
+                  </select>
+                </div>
+                <div class="col-md-2">
+                  <label class="form-label">Sort order</label>
+                  <input type="number" name="sortOrder" class="form-control" value="0">
+                </div>
+                <div class="col-md-2 d-flex align-items-end">
+                  <div class="form-check">
+                    <input class="form-check-input" type="checkbox" name="isActive" id="itemActive" checked>
+                    <label class="form-check-label" for="itemActive">Active</label>
+                  </div>
+                </div>
+                <div class="col-12">
+                  <button type="submit" class="btn btn-primary">Create item</button>
+                </div>
+              </form>
+            </div>
+          </div>
+        </div>
+
+        <div class="col-12">
+          <div class="card shadow-sm">
+            <div class="card-header d-flex justify-content-between align-items-center">
+              <div>
+                <h5 class="card-title mb-1">Current items</h5>
+                <p class="card-subtitle text-muted mb-0">Add commands for each item and toggle availability.</p>
+              </div>
+              <span class="badge bg-primary">Total items: <%= items.length %></span>
+            </div>
+            <div class="card-body p-0">
+              <div class="table-responsive">
+                <table class="table mb-0 align-middle">
+                  <thead class="table-light">
+                    <tr>
+                      <th>Item</th>
+                      <th>Stripe price</th>
+                      <th>Type</th>
+                      <th>Commands</th>
+                      <th>Status</th>
+                    </tr>
+                  </thead>
+                  <tbody>
+                    <% if (!items.length) { %>
+                      <tr>
+                        <td colspan="5" class="text-center text-muted py-4">No items available.</td>
+                      </tr>
+                    <% } %>
+                    <% items.forEach(function(item) { %>
+                      <tr>
+                        <td>
+                          <div class="fw-semibold"><%= item.displayName %></div>
+                          <div class="text-muted small">/<%= item.slug %></div>
+                        </td>
+                        <td class="text-muted"><%= item.stripePriceId %></td>
+                        <td>
+                          <span class="badge bg-secondary"><%= item.purchaseType === "subscription" ? "Subscription" : "One-time" %></span>
+                        </td>
+                        <td>
+                          <% if (item.commandTemplates && item.commandTemplates.length) { %>
+                            <ul class="small mb-2">
+                              <% item.commandTemplates.forEach(function(command) { %>
+                                <li><code><%= command %></code></li>
+                              <% }) %>
+                            </ul>
+                          <% } else { %>
+                            <p class="text-muted small mb-2">No commands configured.</p>
+                          <% } %>
+                          <form method="post" action="/dashboard/webstore/items/<%= item.itemId %>/commands" class="row g-2">
+                            <div class="col-md-8">
+                              <input type="text" name="commandTemplate" class="form-control form-control-sm" placeholder="lp user {{username}} parent add diamond" required>
+                            </div>
+                            <div class="col-md-2">
+                              <input type="number" name="sortOrder" class="form-control form-control-sm" value="0">
+                            </div>
+                            <div class="col-md-2">
+                              <button type="submit" class="btn btn-outline-primary btn-sm w-100">Add</button>
+                            </div>
+                          </form>
+                        </td>
+                        <td>
+                          <form method="post" action="/dashboard/webstore/items/<%= item.itemId %>/status">
+                            <div class="form-check form-switch">
+                              <input
+                                class="form-check-input"
+                                type="checkbox"
+                                name="isActive"
+                                id="status-<%= item.itemId %>"
+                                <%= item.isActive ? "checked" : "" %>
+                                onchange="this.form.submit()"
+                              >
+                              <label class="form-check-label" for="status-<%= item.itemId %>">
+                                <%= item.isActive ? "Active" : "Inactive" %>
+                              </label>
+                            </div>
+                          </form>
+                        </td>
+                      </tr>
+                    <% }) %>
+                  </tbody>
+                </table>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </main>
+  </div>
+</div>
+
+<%- include("../../modules/footer.ejs") %>
diff --git a/views/modules/dashboard/dashboard-sidebar.ejs b/views/modules/dashboard/dashboard-sidebar.ejs
index 57eb9c51..cc9e6ffa 100644
--- a/views/modules/dashboard/dashboard-sidebar.ejs
+++ b/views/modules/dashboard/dashboard-sidebar.ejs
@@ -42,6 +42,9 @@
                     <li class="nav-item">
                         <a class="nav-link" href="/dashboard/ranks">Ranks</a>
                     </li>
+                    <li class="nav-item">
+                        <a class="nav-link" href="/dashboard/webstore">Webstore</a>
+                    </li>
                     <li class="nav-item">
                         <a class="nav-link" href="/dashboard/scheduler">Scheduler</a>
                     </li>

From 8c1e3e2e7d746039951ec3a05bb6029710fb196f Mon Sep 17 00:00:00 2001
From: Ben Robson <shadowolfbusiness@gmail.com>
Date: Tue, 30 Dec 2025 21:56:33 +1100
Subject: [PATCH 5/9] Allow webstore browsing without login

---
 routes/webstoreRoutes.js | 11 +++++-----
 views/webstore/index.ejs | 44 ++++++++++++++++++++++++----------------
 2 files changed, 32 insertions(+), 23 deletions(-)

diff --git a/routes/webstoreRoutes.js b/routes/webstoreRoutes.js
index 7259bad5..be858c09 100644
--- a/routes/webstoreRoutes.js
+++ b/routes/webstoreRoutes.js
@@ -56,15 +56,13 @@ async function createStripeCheckoutSession({
 
 export default function webstoreRoutes(app, config, features) {
   app.get("/webstore", async function (req, res) {
-    if (!isLoggedIn(req)) {
-      return res.redirect(`/login?returnTo=/webstore`);
-    }
-
     if (req.query?.canceled) {
       setBannerCookie("info", "Checkout canceled. You can try again anytime.", res);
     }
 
-    if (!req.session?.user?.username) {
+    const loggedIn = isLoggedIn(req);
+
+    if (loggedIn && !req.session?.user?.username) {
       setBannerCookie(
         "warning",
         "Please verify your Minecraft account before purchasing.",
@@ -94,7 +92,8 @@ export default function webstoreRoutes(app, config, features) {
       globalImage: await getGlobalImage(),
       announcementWeb: await getWebAnnouncement(),
       items,
-      username: req.session.user.username,
+      username: loggedIn ? req.session.user.username : null,
+      loggedIn,
     });
   });
 
diff --git a/views/webstore/index.ejs b/views/webstore/index.ejs
index dd77d71d..c979ac59 100644
--- a/views/webstore/index.ejs
+++ b/views/webstore/index.ejs
@@ -13,8 +13,14 @@
 <section class="section">
   <div class="container">
     <div class="mb-4">
-      <h3>Welcome, <%= username %></h3>
-      <p class="text-muted mb-0">All purchases are linked to your Minecraft username.</p>
+      <% if (loggedIn) { %>
+        <h3>Welcome, <%= username %></h3>
+        <p class="text-muted mb-0">All purchases are linked to your Minecraft username.</p>
+      <% } else { %>
+        <h3>Webstore</h3>
+        <p class="text-muted mb-2">Log in to complete a purchase or gift an item.</p>
+        <a href="/login?returnTo=/webstore" class="btn btn-outline-primary btn-sm">Login to buy</a>
+      <% } %>
     </div>
 
     <div class="row">
@@ -34,21 +40,25 @@
                 <span class="fw-bold"><%= item.priceDisplay %></span>
                 <span class="badge bg-info"><%= item.purchaseType === "subscription" ? "Monthly" : "One-time" %></span>
               </div>
-              <form method="post" action="/webstore/checkout">
-                <input type="hidden" name="itemSlug" value="<%= item.slug %>">
-                <div class="mb-2">
-                  <label class="form-label">Gift to another player (optional)</label>
-                  <input
-                    type="text"
-                    name="recipientUsername"
-                    class="form-control form-control-sm"
-                    placeholder="Minecraft username"
-                    maxlength="16"
-                  >
-                  <small class="text-muted">Leave blank to buy for yourself.</small>
-                </div>
-                <button type="submit" class="btn btn-primary btn-sm"><%= item.purchaseLabel %></button>
-              </form>
+              <% if (loggedIn) { %>
+                <form method="post" action="/webstore/checkout">
+                  <input type="hidden" name="itemSlug" value="<%= item.slug %>">
+                  <div class="mb-2">
+                    <label class="form-label">Gift to another player (optional)</label>
+                    <input
+                      type="text"
+                      name="recipientUsername"
+                      class="form-control form-control-sm"
+                      placeholder="Minecraft username"
+                      maxlength="16"
+                    >
+                    <small class="text-muted">Leave blank to buy for yourself.</small>
+                  </div>
+                  <button type="submit" class="btn btn-primary btn-sm"><%= item.purchaseLabel %></button>
+                </form>
+              <% } else { %>
+                <a href="/login?returnTo=/webstore" class="btn btn-primary btn-sm">Login to purchase</a>
+              <% } %>
             </div>
           </div>
         </div>

From dbb73a0a0ed246637df4aad8658b57eafea5f87c Mon Sep 17 00:00:00 2001
From: Ben Robson <shadowolfbusiness@gmail.com>
Date: Tue, 30 Dec 2025 21:56:50 +1100
Subject: [PATCH 6/9] Pull webstore catalog from Stripe

---
 controllers/webstoreController.js  | 228 ++++++++++++++---------------
 dbinit.sql                         |  25 +---
 migration/v1.8.0_v1.9.0.sql        |  25 +---
 routes/dashboard/webstore.js       |  76 +---------
 views/dashboard/webstore/index.ejs |  83 +----------
 5 files changed, 129 insertions(+), 308 deletions(-)

diff --git a/controllers/webstoreController.js b/controllers/webstoreController.js
index c3cc9142..e58103d8 100644
--- a/controllers/webstoreController.js
+++ b/controllers/webstoreController.js
@@ -1,4 +1,5 @@
 import db from "./databaseController.js";
+import fetch from "node-fetch";
 
 let webstoreTableCheck;
 
@@ -11,6 +12,63 @@ function query(sql, params = []) {
   });
 }
 
+async function fetchStripePrices() {
+  const apiKey = process.env.STRIPE_SECRET_KEY;
+  if (!apiKey) {
+    throw new Error("Stripe secret key is not configured");
+  }
+
+  const prices = [];
+  let startingAfter = null;
+  let hasMore = true;
+
+  while (hasMore) {
+    const params = new URLSearchParams({
+      limit: "100",
+      active: "true",
+    });
+    params.append("expand[]", "data.product");
+    if (startingAfter) {
+      params.append("starting_after", startingAfter);
+    }
+
+    const response = await fetch(`https://api.stripe.com/v1/prices?${params}`, {
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+      },
+    });
+
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Stripe API error: ${response.status} ${errorText}`);
+    }
+
+    const data = await response.json();
+    prices.push(...(data.data || []));
+    hasMore = Boolean(data.has_more);
+    startingAfter = data.data?.length ? data.data[data.data.length - 1].id : null;
+  }
+
+  return prices;
+}
+
+async function loadStripeItems() {
+  const prices = await fetchStripePrices();
+
+  return prices
+    .filter((price) => price.active && price.product && price.product.active)
+    .map((price) => ({
+      slug: price.id,
+      stripePriceId: price.id,
+      displayName: price.product?.name || price.nickname || price.id,
+      description: price.product?.description || "",
+      priceCents: price.unit_amount || 0,
+      currency: price.currency || "usd",
+      purchaseType: price.type === "recurring" || price.recurring ? "subscription" : "one_time",
+    }))
+    .sort((a, b) => a.displayName.localeCompare(b.displayName));
+}
+
 export async function ensureWebstoreTables() {
   if (!webstoreTableCheck) {
     webstoreTableCheck = new Promise((resolve) => {
@@ -84,89 +142,64 @@ export async function ensureWebstoreTables() {
                   }
 
                   db.query(
-                    "CREATE TABLE IF NOT EXISTS webstoreItems (\n" +
-                      "  itemId INT AUTO_INCREMENT PRIMARY KEY,\n" +
-                      "  slug VARCHAR(64) NOT NULL UNIQUE,\n" +
-                      "  displayName VARCHAR(120) NOT NULL,\n" +
-                      "  description TEXT,\n" +
-                      "  priceCents INT NOT NULL,\n" +
-                      "  currency VARCHAR(10) NOT NULL DEFAULT 'usd',\n" +
-                      "  purchaseType ENUM('one_time', 'subscription') NOT NULL,\n" +
+                    "CREATE TABLE IF NOT EXISTS webstoreStripeCommands (\n" +
+                      "  commandId INT AUTO_INCREMENT PRIMARY KEY,\n" +
                       "  stripePriceId VARCHAR(120) NOT NULL,\n" +
-                      "  isActive TINYINT(1) DEFAULT 1,\n" +
+                      "  commandTemplate TEXT NOT NULL,\n" +
                       "  sortOrder INT DEFAULT 0,\n" +
                       "  createdAt DATETIME DEFAULT NOW(),\n" +
-                      "  updatedAt DATETIME DEFAULT NOW()\n" +
+                      "  INDEX webstoreStripeCommands_price (stripePriceId)\n" +
                       ")",
-                    (itemsErr) => {
-                      if (itemsErr) {
-                        console.error("Failed to ensure webstoreItems table", itemsErr);
+                    (commandsErr) => {
+                      if (commandsErr) {
+                        console.error("Failed to ensure webstoreStripeCommands table", commandsErr);
                         resolve(false);
                         return;
                       }
 
                       db.query(
-                        "CREATE TABLE IF NOT EXISTS webstoreItemCommands (\n" +
-                          "  itemCommandId INT AUTO_INCREMENT PRIMARY KEY,\n" +
-                          "  itemId INT NOT NULL,\n" +
-                          "  commandTemplate TEXT NOT NULL,\n" +
-                          "  sortOrder INT DEFAULT 0,\n" +
+                        "CREATE TABLE IF NOT EXISTS webstoreTransactions (\n" +
+                          "  transactionId INT AUTO_INCREMENT PRIMARY KEY,\n" +
+                          "  purchaseId INT NOT NULL,\n" +
+                          "  userId INT NOT NULL,\n" +
+                          "  direction ENUM('incoming', 'outgoing') NOT NULL,\n" +
+                          "  counterpartyMinecraftUsername VARCHAR(16) NOT NULL,\n" +
+                          "  amountCents INT NOT NULL,\n" +
+                          "  currency VARCHAR(10) NOT NULL,\n" +
                           "  createdAt DATETIME DEFAULT NOW(),\n" +
-                          "  INDEX webstoreItemCommands_item (itemId),\n" +
-                          "  CONSTRAINT fk_webstoreItemCommands_item FOREIGN KEY (itemId) REFERENCES webstoreItems(itemId) ON DELETE CASCADE\n" +
+                          "  INDEX webstoreTransactions_user (userId),\n" +
+                          "  INDEX webstoreTransactions_purchase (purchaseId)\n" +
                           ")",
-                        (commandsErr) => {
-                          if (commandsErr) {
-                            console.error("Failed to ensure webstoreItemCommands table", commandsErr);
+                        (transactionsErr) => {
+                          if (transactionsErr) {
+                            console.error(
+                              "Failed to ensure webstoreTransactions table",
+                              transactionsErr
+                            );
                             resolve(false);
                             return;
                           }
 
                           db.query(
-                            "CREATE TABLE IF NOT EXISTS webstoreTransactions (\n" +
-                              "  transactionId INT AUTO_INCREMENT PRIMARY KEY,\n" +
-                              "  purchaseId INT NOT NULL,\n" +
+                            "CREATE TABLE IF NOT EXISTS webstoreContacts (\n" +
+                              "  contactId INT AUTO_INCREMENT PRIMARY KEY,\n" +
                               "  userId INT NOT NULL,\n" +
-                              "  direction ENUM('incoming', 'outgoing') NOT NULL,\n" +
-                              "  counterpartyMinecraftUsername VARCHAR(16) NOT NULL,\n" +
-                              "  amountCents INT NOT NULL,\n" +
-                              "  currency VARCHAR(10) NOT NULL,\n" +
-                              "  createdAt DATETIME DEFAULT NOW(),\n" +
-                              "  INDEX webstoreTransactions_user (userId),\n" +
-                              "  INDEX webstoreTransactions_purchase (purchaseId)\n" +
+                              "  minecraftUsername VARCHAR(16) NOT NULL,\n" +
+                              "  lastTransactionAt DATETIME DEFAULT NOW(),\n" +
+                              "  lastTransactionDirection ENUM('incoming', 'outgoing') NOT NULL,\n" +
+                              "  UNIQUE KEY webstoreContacts_user (userId, minecraftUsername)\n" +
                               ")",
-                            (transactionsErr) => {
-                              if (transactionsErr) {
+                            (contactsErr) => {
+                              if (contactsErr) {
                                 console.error(
-                                  "Failed to ensure webstoreTransactions table",
-                                  transactionsErr
+                                  "Failed to ensure webstoreContacts table",
+                                  contactsErr
                                 );
                                 resolve(false);
                                 return;
                               }
 
-                              db.query(
-                                "CREATE TABLE IF NOT EXISTS webstoreContacts (\n" +
-                                  "  contactId INT AUTO_INCREMENT PRIMARY KEY,\n" +
-                                  "  userId INT NOT NULL,\n" +
-                                  "  minecraftUsername VARCHAR(16) NOT NULL,\n" +
-                                  "  lastTransactionAt DATETIME DEFAULT NOW(),\n" +
-                                  "  lastTransactionDirection ENUM('incoming', 'outgoing') NOT NULL,\n" +
-                                  "  UNIQUE KEY webstoreContacts_user (userId, minecraftUsername)\n" +
-                                  ")",
-                                (contactsErr) => {
-                                  if (contactsErr) {
-                                    console.error(
-                                      "Failed to ensure webstoreContacts table",
-                                      contactsErr
-                                    );
-                                    resolve(false);
-                                    return;
-                                  }
-
-                                  resolve(true);
-                                }
-                              );
+                              resolve(true);
                             }
                           );
                         }
@@ -250,96 +283,49 @@ export async function getPurchaseBySessionId(stripeSessionId) {
 export async function getWebstoreItems() {
   await ensureWebstoreTables();
 
-  const items = await query(
-    "SELECT * FROM webstoreItems WHERE isActive = 1 ORDER BY sortOrder ASC, displayName ASC"
-  );
-
+  const items = await loadStripeItems();
   if (!items.length) return [];
 
-  const itemIds = items.map((item) => item.itemId);
+  const priceIds = items.map((item) => item.stripePriceId);
   const commands = await query(
-    `SELECT itemId, commandTemplate FROM webstoreItemCommands WHERE itemId IN (${itemIds
+    `SELECT stripePriceId, commandTemplate FROM webstoreStripeCommands WHERE stripePriceId IN (${priceIds
       .map(() => "?")
-      .join(",")}) ORDER BY sortOrder ASC, itemCommandId ASC`,
-    itemIds
+      .join(",")}) ORDER BY sortOrder ASC, commandId ASC`,
+    priceIds
   );
 
-  const commandsByItem = commands.reduce((acc, command) => {
-    if (!acc[command.itemId]) acc[command.itemId] = [];
-    acc[command.itemId].push(command.commandTemplate);
+  const commandsByPrice = commands.reduce((acc, command) => {
+    if (!acc[command.stripePriceId]) acc[command.stripePriceId] = [];
+    acc[command.stripePriceId].push(command.commandTemplate);
     return acc;
   }, {});
 
   return items.map((item) => ({
-    itemId: item.itemId,
-    slug: item.slug,
-    displayName: item.displayName,
-    description: item.description,
-    priceCents: item.priceCents,
-    currency: item.currency,
-    purchaseType: item.purchaseType,
-    stripePriceId: item.stripePriceId,
-    isActive: item.isActive === 1,
-    commandTemplates: commandsByItem[item.itemId] || [],
+    ...item,
+    commandTemplates: commandsByPrice[item.stripePriceId] || [],
   }));
 }
 
 export async function findWebstoreItem(slug) {
   const items = await getWebstoreItems();
-  return items.find((item) => item.slug === slug && item.isActive !== false) || null;
+  return items.find((item) => item.slug === slug) || null;
 }
 
-export async function createWebstoreItem({
-  slug,
-  displayName,
-  description,
-  priceCents,
-  currency,
-  purchaseType,
+export async function addWebstoreItemCommand({
   stripePriceId,
-  isActive,
+  commandTemplate,
   sortOrder,
 }) {
   await ensureWebstoreTables();
 
   const result = await query(
-    "INSERT INTO webstoreItems (slug, displayName, description, priceCents, currency, purchaseType, stripePriceId, isActive, sortOrder) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
-    [
-      slug,
-      displayName,
-      description || null,
-      priceCents,
-      currency,
-      purchaseType,
-      stripePriceId,
-      isActive ? 1 : 0,
-      sortOrder || 0,
-    ]
+    "INSERT INTO webstoreStripeCommands (stripePriceId, commandTemplate, sortOrder) VALUES (?, ?, ?)",
+    [stripePriceId, commandTemplate, sortOrder || 0]
   );
 
   return result.insertId;
 }
 
-export async function addWebstoreItemCommand({ itemId, commandTemplate, sortOrder }) {
-  await ensureWebstoreTables();
-
-  const result = await query(
-    "INSERT INTO webstoreItemCommands (itemId, commandTemplate, sortOrder) VALUES (?, ?, ?)",
-    [itemId, commandTemplate, sortOrder || 0]
-  );
-
-  return result.insertId;
-}
-
-export async function updateWebstoreItemStatus(itemId, isActive) {
-  await ensureWebstoreTables();
-
-  return query(
-    "UPDATE webstoreItems SET isActive = ?, updatedAt = NOW() WHERE itemId = ?",
-    [isActive ? 1 : 0, itemId]
-  );
-}
-
 export async function updatePurchasePayment({
   purchaseId,
   status,
diff --git a/dbinit.sql b/dbinit.sql
index d53569fa..0fd8f745 100644
--- a/dbinit.sql
+++ b/dbinit.sql
@@ -254,31 +254,14 @@ CREATE TABLE webstoreWebhookEvents (
     CONSTRAINT fk_webstoreWebhookEvents_purchase FOREIGN KEY (purchaseId) REFERENCES webstorePurchases(purchaseId) ON DELETE SET NULL
 );
 
-CREATE TABLE webstoreItems (
-        itemId INT NOT NULL AUTO_INCREMENT,
-    slug VARCHAR(64) NOT NULL UNIQUE,
-    displayName VARCHAR(120) NOT NULL,
-    description TEXT,
-    priceCents INT NOT NULL,
-    currency VARCHAR(10) NOT NULL DEFAULT 'usd',
-    purchaseType ENUM('one_time', 'subscription') NOT NULL,
+CREATE TABLE webstoreStripeCommands (
+        commandId INT NOT NULL AUTO_INCREMENT,
     stripePriceId VARCHAR(120) NOT NULL,
-    isActive TINYINT(1) DEFAULT 1,
-    sortOrder INT DEFAULT 0,
-    createdAt DATETIME DEFAULT NOW(),
-    updatedAt DATETIME DEFAULT NOW(),
-    PRIMARY KEY (itemId)
-);
-
-CREATE TABLE webstoreItemCommands (
-        itemCommandId INT NOT NULL AUTO_INCREMENT,
-    itemId INT NOT NULL,
     commandTemplate TEXT NOT NULL,
     sortOrder INT DEFAULT 0,
     createdAt DATETIME DEFAULT NOW(),
-    PRIMARY KEY (itemCommandId),
-    INDEX webstoreItemCommands_item (itemId),
-    CONSTRAINT fk_webstoreItemCommands_item FOREIGN KEY (itemId) REFERENCES webstoreItems(itemId) ON DELETE CASCADE
+    PRIMARY KEY (commandId),
+    INDEX webstoreStripeCommands_price (stripePriceId)
 );
 
 CREATE TABLE webstoreTransactions (
diff --git a/migration/v1.8.0_v1.9.0.sql b/migration/v1.8.0_v1.9.0.sql
index b0b67a61..9224a9d7 100644
--- a/migration/v1.8.0_v1.9.0.sql
+++ b/migration/v1.8.0_v1.9.0.sql
@@ -52,31 +52,14 @@ CREATE TABLE webstoreWebhookEvents (
     CONSTRAINT fk_webstoreWebhookEvents_purchase FOREIGN KEY (purchaseId) REFERENCES webstorePurchases(purchaseId) ON DELETE SET NULL
 );
 
-CREATE TABLE webstoreItems (
-    itemId INT NOT NULL AUTO_INCREMENT,
-    slug VARCHAR(64) NOT NULL UNIQUE,
-    displayName VARCHAR(120) NOT NULL,
-    description TEXT,
-    priceCents INT NOT NULL,
-    currency VARCHAR(10) NOT NULL DEFAULT 'usd',
-    purchaseType ENUM('one_time', 'subscription') NOT NULL,
+CREATE TABLE webstoreStripeCommands (
+    commandId INT NOT NULL AUTO_INCREMENT,
     stripePriceId VARCHAR(120) NOT NULL,
-    isActive TINYINT(1) DEFAULT 1,
-    sortOrder INT DEFAULT 0,
-    createdAt DATETIME DEFAULT NOW(),
-    updatedAt DATETIME DEFAULT NOW(),
-    PRIMARY KEY (itemId)
-);
-
-CREATE TABLE webstoreItemCommands (
-    itemCommandId INT NOT NULL AUTO_INCREMENT,
-    itemId INT NOT NULL,
     commandTemplate TEXT NOT NULL,
     sortOrder INT DEFAULT 0,
     createdAt DATETIME DEFAULT NOW(),
-    PRIMARY KEY (itemCommandId),
-    INDEX webstoreItemCommands_item (itemId),
-    CONSTRAINT fk_webstoreItemCommands_item FOREIGN KEY (itemId) REFERENCES webstoreItems(itemId) ON DELETE CASCADE
+    PRIMARY KEY (commandId),
+    INDEX webstoreStripeCommands_price (stripePriceId)
 );
 
 CREATE TABLE webstoreTransactions (
diff --git a/routes/dashboard/webstore.js b/routes/dashboard/webstore.js
index b54a2792..efe7ea4a 100644
--- a/routes/dashboard/webstore.js
+++ b/routes/dashboard/webstore.js
@@ -2,9 +2,7 @@ import { getGlobalImage, hasPermission, setBannerCookie } from "../../api/common
 import { getWebAnnouncement } from "../../controllers/announcementController.js";
 import {
   addWebstoreItemCommand,
-  createWebstoreItem,
   getWebstoreItems,
-  updateWebstoreItemStatus,
 } from "../../controllers/webstoreController.js";
 
 export default function dashboardWebstoreRoutes(app, config, features, lang) {
@@ -30,62 +28,26 @@ export default function dashboardWebstoreRoutes(app, config, features, lang) {
     });
   });
 
-  app.post("/dashboard/webstore/items", async function (req, res) {
+  app.post("/dashboard/webstore/items/:priceId/commands", async function (req, res) {
     if (!hasPermission("zander.web.webstore", req, res, features)) return;
 
-    const slug = req.body.slug ? req.body.slug.trim() : "";
-    const displayName = req.body.displayName ? req.body.displayName.trim() : "";
-    const description = req.body.description ? req.body.description.trim() : "";
-    const stripePriceId = req.body.stripePriceId ? req.body.stripePriceId.trim() : "";
-    const purchaseType = req.body.purchaseType ? req.body.purchaseType.trim() : "one_time";
-    const currency = req.body.currency ? req.body.currency.trim() : "usd";
-    const priceCents = Number(req.body.priceCents) || 0;
-    const sortOrder = Number(req.body.sortOrder) || 0;
-    const isActive = req.body.isActive === "on";
-
-    if (!slug || !displayName || !stripePriceId || !priceCents) {
-      setBannerCookie("warning", "Slug, display name, Stripe price, and price are required.", res);
-      return res.redirect("/dashboard/webstore");
-    }
-
-    try {
-      await createWebstoreItem({
-        slug,
-        displayName,
-        description,
-        priceCents,
-        currency,
-        purchaseType,
-        stripePriceId,
-        isActive,
-        sortOrder,
-      });
-
-      setBannerCookie("success", "Webstore item created.", res);
-    } catch (error) {
-      console.error("Failed to create webstore item", error);
-      setBannerCookie("danger", "Unable to create webstore item.", res);
-    }
-
-    return res.redirect("/dashboard/webstore");
-  });
-
-  app.post("/dashboard/webstore/items/:itemId/commands", async function (req, res) {
-    if (!hasPermission("zander.web.webstore", req, res, features)) return;
-
-    const itemId = Number(req.params.itemId);
+    const priceId = req.params.priceId ? req.params.priceId.trim() : "";
     const commandTemplate = req.body.commandTemplate
       ? req.body.commandTemplate.trim()
       : "";
     const sortOrder = Number(req.body.sortOrder) || 0;
 
-    if (!itemId || Number.isNaN(itemId) || !commandTemplate) {
+    if (!priceId || !commandTemplate) {
       setBannerCookie("warning", "Command template is required.", res);
       return res.redirect("/dashboard/webstore");
     }
 
     try {
-      await addWebstoreItemCommand({ itemId, commandTemplate, sortOrder });
+      await addWebstoreItemCommand({
+        stripePriceId: priceId,
+        commandTemplate,
+        sortOrder,
+      });
       setBannerCookie("success", "Command template added.", res);
     } catch (error) {
       console.error("Failed to add webstore command", error);
@@ -94,26 +56,4 @@ export default function dashboardWebstoreRoutes(app, config, features, lang) {
 
     return res.redirect("/dashboard/webstore");
   });
-
-  app.post("/dashboard/webstore/items/:itemId/status", async function (req, res) {
-    if (!hasPermission("zander.web.webstore", req, res, features)) return;
-
-    const itemId = Number(req.params.itemId);
-    const isActive = req.body.isActive === "on";
-
-    if (!itemId || Number.isNaN(itemId)) {
-      setBannerCookie("warning", "Invalid item selected.", res);
-      return res.redirect("/dashboard/webstore");
-    }
-
-    try {
-      await updateWebstoreItemStatus(itemId, isActive);
-      setBannerCookie("success", "Item status updated.", res);
-    } catch (error) {
-      console.error("Failed to update webstore item", error);
-      setBannerCookie("danger", "Unable to update item status.", res);
-    }
-
-    return res.redirect("/dashboard/webstore");
-  });
 }
diff --git a/views/dashboard/webstore/index.ejs b/views/dashboard/webstore/index.ejs
index 31d1f89d..4e2f6057 100644
--- a/views/dashboard/webstore/index.ejs
+++ b/views/dashboard/webstore/index.ejs
@@ -17,69 +17,12 @@
       </div>
 
       <div class="row g-4">
-        <div class="col-12">
-          <div class="card shadow-sm">
-            <div class="card-header">
-              <h5 class="card-title mb-1">Create new item</h5>
-              <p class="card-subtitle text-muted mb-0">Add a new product or subscription backed by a Stripe price ID.</p>
-            </div>
-            <div class="card-body">
-              <form method="post" action="/dashboard/webstore/items" class="row g-3">
-                <div class="col-md-4">
-                  <label class="form-label">Slug</label>
-                  <input type="text" name="slug" class="form-control" placeholder="diamond-rank-monthly" required>
-                </div>
-                <div class="col-md-4">
-                  <label class="form-label">Display name</label>
-                  <input type="text" name="displayName" class="form-control" placeholder="Diamond Rank (Monthly)" required>
-                </div>
-                <div class="col-md-4">
-                  <label class="form-label">Stripe price ID</label>
-                  <input type="text" name="stripePriceId" class="form-control" placeholder="price_123" required>
-                </div>
-                <div class="col-md-6">
-                  <label class="form-label">Description</label>
-                  <input type="text" name="description" class="form-control" placeholder="Monthly Diamond rank subscription">
-                </div>
-                <div class="col-md-2">
-                  <label class="form-label">Price (cents)</label>
-                  <input type="number" name="priceCents" class="form-control" min="1" required>
-                </div>
-                <div class="col-md-2">
-                  <label class="form-label">Currency</label>
-                  <input type="text" name="currency" class="form-control" value="usd">
-                </div>
-                <div class="col-md-2">
-                  <label class="form-label">Type</label>
-                  <select name="purchaseType" class="form-select">
-                    <option value="one_time">One-time</option>
-                    <option value="subscription">Subscription</option>
-                  </select>
-                </div>
-                <div class="col-md-2">
-                  <label class="form-label">Sort order</label>
-                  <input type="number" name="sortOrder" class="form-control" value="0">
-                </div>
-                <div class="col-md-2 d-flex align-items-end">
-                  <div class="form-check">
-                    <input class="form-check-input" type="checkbox" name="isActive" id="itemActive" checked>
-                    <label class="form-check-label" for="itemActive">Active</label>
-                  </div>
-                </div>
-                <div class="col-12">
-                  <button type="submit" class="btn btn-primary">Create item</button>
-                </div>
-              </form>
-            </div>
-          </div>
-        </div>
-
         <div class="col-12">
           <div class="card shadow-sm">
             <div class="card-header d-flex justify-content-between align-items-center">
               <div>
                 <h5 class="card-title mb-1">Current items</h5>
-                <p class="card-subtitle text-muted mb-0">Add commands for each item and toggle availability.</p>
+                <p class="card-subtitle text-muted mb-0">Items are pulled directly from Stripe. Add commands for each price ID below.</p>
               </div>
               <span class="badge bg-primary">Total items: <%= items.length %></span>
             </div>
@@ -89,7 +32,7 @@
                   <thead class="table-light">
                     <tr>
                       <th>Item</th>
-                      <th>Stripe price</th>
+                      <th>Price</th>
                       <th>Type</th>
                       <th>Commands</th>
                       <th>Status</th>
@@ -105,9 +48,9 @@
                       <tr>
                         <td>
                           <div class="fw-semibold"><%= item.displayName %></div>
-                          <div class="text-muted small">/<%= item.slug %></div>
+                          <div class="text-muted small"><%= item.stripePriceId %></div>
                         </td>
-                        <td class="text-muted"><%= item.stripePriceId %></td>
+                        <td class="text-muted"><%= item.currency.toUpperCase() %> <%= (item.priceCents / 100).toFixed(2) %></td>
                         <td>
                           <span class="badge bg-secondary"><%= item.purchaseType === "subscription" ? "Subscription" : "One-time" %></span>
                         </td>
@@ -121,7 +64,7 @@
                           <% } else { %>
                             <p class="text-muted small mb-2">No commands configured.</p>
                           <% } %>
-                          <form method="post" action="/dashboard/webstore/items/<%= item.itemId %>/commands" class="row g-2">
+                          <form method="post" action="/dashboard/webstore/items/<%= item.stripePriceId %>/commands" class="row g-2">
                             <div class="col-md-8">
                               <input type="text" name="commandTemplate" class="form-control form-control-sm" placeholder="lp user {{username}} parent add diamond" required>
                             </div>
@@ -134,21 +77,7 @@
                           </form>
                         </td>
                         <td>
-                          <form method="post" action="/dashboard/webstore/items/<%= item.itemId %>/status">
-                            <div class="form-check form-switch">
-                              <input
-                                class="form-check-input"
-                                type="checkbox"
-                                name="isActive"
-                                id="status-<%= item.itemId %>"
-                                <%= item.isActive ? "checked" : "" %>
-                                onchange="this.form.submit()"
-                              >
-                              <label class="form-check-label" for="status-<%= item.itemId %>">
-                                <%= item.isActive ? "Active" : "Inactive" %>
-                              </label>
-                            </div>
-                          </form>
+                          <span class="badge bg-success">Active</span>
                         </td>
                       </tr>
                     <% }) %>

From 404df1997fd21b0727866513672a07b0eeaa0478 Mon Sep 17 00:00:00 2001
From: Ben Robson <shadowolfbusiness@gmail.com>
Date: Tue, 30 Dec 2025 22:07:04 +1100
Subject: [PATCH 7/9] Document Stripe catalog setup

---
 SETUP.md | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/SETUP.md b/SETUP.md
index 60a9b049..14b553b6 100644
--- a/SETUP.md
+++ b/SETUP.md
@@ -34,6 +34,32 @@ This document explains how to set up a local environment for this project.
     - `SUPPORT_NOTIFICATION_CHANNEL_ID`: The ID of the Discord channel where new ticket notifications will be sent.
     - `SUPPORT_CATEGORY_ID`: The ID of the Discord category where new ticket channels will be created.
     - `DISCORD_GUILD_ID`: The ID of your Discord server.
+    - `STRIPE_SECRET_KEY`: Stripe secret key used to list products/prices and create Checkout sessions.
+    - `STRIPE_WEBHOOK_SECRET`: Stripe webhook signing secret for `/api/webstore/stripe/webhook`.
+    - `WEBSTORE_MONTHLY_GOAL_CENTS`: Optional monthly goal amount for the `/give` page (defaults to 100000).
+
+## Webstore (Stripe Catalog)
+
+The webstore catalog is pulled directly from Stripe Prices. To add items:
+
+1. In Stripe, create a Product.
+2. Create a Price for the product:
+    - One-time purchase: use a one-time Price.
+    - Subscription: use a recurring Price.
+3. Ensure the Price and Product are marked **Active** in Stripe.
+
+The site lists active Prices and uses the Stripe Price ID for checkout. To run Minecraft commands after payment, map command templates to Stripe Price IDs in the dashboard:
+
+1. Go to **Dashboard → Development → Webstore**.
+2. Find the Stripe item you want and add command templates like:
+    - `lp user {{username}} parent add diamond`
+3. Commands run only after Stripe confirms payment via webhook.
+
+Stripe webhook setup:
+
+1. In Stripe, create a webhook endpoint for `https://<your-site>/api/webstore/stripe/webhook`.
+2. Subscribe to `checkout.session.completed`.
+3. Copy the signing secret into `STRIPE_WEBHOOK_SECRET`.
 
 ## Running the Application
 

From 88705e2053d5bf7da5c53655639e355d888126e6 Mon Sep 17 00:00:00 2001
From: Ben Robson <shadowolfbusiness@gmail.com>
Date: Wed, 31 Dec 2025 16:12:15 +1100
Subject: [PATCH 8/9] Add webstore purchase modal and locale pricing

---
 controllers/webstoreController.js |  14 +++-
 routes/webstoreRoutes.js          |  24 ++++++-
 views/webstore/index.ejs          | 114 ++++++++++++++++++++++++++----
 3 files changed, 134 insertions(+), 18 deletions(-)

diff --git a/controllers/webstoreController.js b/controllers/webstoreController.js
index e58103d8..5dd525e0 100644
--- a/controllers/webstoreController.js
+++ b/controllers/webstoreController.js
@@ -62,6 +62,7 @@ async function loadStripeItems() {
       stripePriceId: price.id,
       displayName: price.product?.name || price.nickname || price.id,
       description: price.product?.description || "",
+      imageUrl: price.product?.images?.[0] || null,
       priceCents: price.unit_amount || 0,
       currency: price.currency || "usd",
       purchaseType: price.type === "recurring" || price.recurring ? "subscription" : "one_time",
@@ -426,6 +427,15 @@ export async function getPurchasesNeedingFulfillment() {
   );
 }
 
+export async function getWebstoreContacts(userId, limit = 10) {
+  await ensureWebstoreTables();
+
+  return query(
+    "SELECT minecraftUsername FROM webstoreContacts WHERE userId = ? ORDER BY lastTransactionAt DESC LIMIT ?",
+    [userId, limit]
+  );
+}
+
 export async function createTransactionsForPurchase({
   purchaseId,
   payerUserId,
@@ -493,10 +503,10 @@ export async function getMonthlyPurchaseTotals(startDate, endDate) {
   return Number(results?.[0]?.totalCents || 0);
 }
 
-export function formatPrice(priceCents, currency) {
+export function formatPrice(priceCents, currency, locale = "en-US") {
   const amount = Number(priceCents) || 0;
   const normalizedCurrency = (currency || "usd").toUpperCase();
-  return new Intl.NumberFormat("en-US", {
+  return new Intl.NumberFormat(locale, {
     style: "currency",
     currency: normalizedCurrency,
     minimumFractionDigits: 2,
diff --git a/routes/webstoreRoutes.js b/routes/webstoreRoutes.js
index be858c09..975a9f61 100644
--- a/routes/webstoreRoutes.js
+++ b/routes/webstoreRoutes.js
@@ -5,6 +5,7 @@ import {
   createPendingPurchase,
   findWebstoreItem,
   formatPrice,
+  getWebstoreContacts,
   getWebstoreItems,
   getMonthlyPurchaseTotals,
 } from "../controllers/webstoreController.js";
@@ -61,6 +62,10 @@ export default function webstoreRoutes(app, config, features) {
     }
 
     const loggedIn = isLoggedIn(req);
+    const locale =
+      typeof req.headers["accept-language"] === "string"
+        ? req.headers["accept-language"].split(",")[0]
+        : "en-US";
 
     if (loggedIn && !req.session?.user?.username) {
       setBannerCookie(
@@ -75,7 +80,7 @@ export default function webstoreRoutes(app, config, features) {
     try {
       items = (await getWebstoreItems()).map((item) => ({
         ...item,
-        priceDisplay: formatPrice(item.priceCents, item.currency),
+        priceDisplay: formatPrice(item.priceCents, item.currency, locale),
         purchaseLabel:
           item.purchaseType === "subscription" ? "Subscribe" : "Buy once",
       }));
@@ -84,6 +89,16 @@ export default function webstoreRoutes(app, config, features) {
       setBannerCookie("warning", "Webstore items are unavailable right now.", res);
     }
 
+    let contacts = [];
+    if (loggedIn && req.session?.user?.userId) {
+      try {
+        const rows = await getWebstoreContacts(req.session.user.userId, 10);
+        contacts = rows.map((row) => row.minecraftUsername);
+      } catch (error) {
+        console.error("Failed to load webstore contacts", error);
+      }
+    }
+
     return res.view("webstore/index", {
       pageTitle: "Webstore",
       config,
@@ -94,6 +109,7 @@ export default function webstoreRoutes(app, config, features) {
       items,
       username: loggedIn ? req.session.user.username : null,
       loggedIn,
+      contacts,
     });
   });
 
@@ -143,8 +159,14 @@ export default function webstoreRoutes(app, config, features) {
     const recipientUsernameRaw = req.body.recipientUsername
       ? req.body.recipientUsername.trim()
       : "";
+    const purchaseFor = req.body.purchaseFor ? req.body.purchaseFor.trim() : "self";
     const recipientMinecraftUsername = recipientUsernameRaw || purchaserMinecraftUsername;
 
+    if (purchaseFor === "gift" && !recipientUsernameRaw) {
+      setBannerCookie("warning", "Please enter a Minecraft username to gift.", res);
+      return res.redirect("/webstore");
+    }
+
     if (!/^[A-Za-z0-9_]{1,16}$/.test(recipientMinecraftUsername)) {
       setBannerCookie(
         "warning",
diff --git a/views/webstore/index.ejs b/views/webstore/index.ejs
index c979ac59..e1b4d3ea 100644
--- a/views/webstore/index.ejs
+++ b/views/webstore/index.ejs
@@ -34,6 +34,11 @@
         <div class="col-lg-4 col-md-6 col-sm-12">
           <div class="service-item mb-4">
             <div class="feature-item mb-5 mb-lg-0">
+              <% if (item.imageUrl) { %>
+                <div class="mb-3">
+                  <img src="<%= item.imageUrl %>" alt="<%= item.displayName %> image" class="img-fluid rounded">
+                </div>
+              <% } %>
               <h4 class="mb-2"><%= item.displayName %></h4>
               <p class="text-muted"><%= item.description %></p>
               <div class="d-flex align-items-center justify-content-between mb-3">
@@ -41,21 +46,17 @@
                 <span class="badge bg-info"><%= item.purchaseType === "subscription" ? "Monthly" : "One-time" %></span>
               </div>
               <% if (loggedIn) { %>
-                <form method="post" action="/webstore/checkout">
-                  <input type="hidden" name="itemSlug" value="<%= item.slug %>">
-                  <div class="mb-2">
-                    <label class="form-label">Gift to another player (optional)</label>
-                    <input
-                      type="text"
-                      name="recipientUsername"
-                      class="form-control form-control-sm"
-                      placeholder="Minecraft username"
-                      maxlength="16"
-                    >
-                    <small class="text-muted">Leave blank to buy for yourself.</small>
-                  </div>
-                  <button type="submit" class="btn btn-primary btn-sm"><%= item.purchaseLabel %></button>
-                </form>
+                <button
+                  type="button"
+                  class="btn btn-primary btn-sm"
+                  data-bs-toggle="modal"
+                  data-bs-target="#purchaseModal"
+                  data-item-slug="<%= item.slug %>"
+                  data-item-name="<%= item.displayName %>"
+                  data-item-action="<%= item.purchaseLabel %>"
+                >
+                  <%= item.purchaseLabel %>
+                </button>
               <% } else { %>
                 <a href="/login?returnTo=/webstore" class="btn btn-primary btn-sm">Login to purchase</a>
               <% } %>
@@ -64,6 +65,89 @@
         </div>
       <% }) %>
     </div>
+
+    <% if (loggedIn) { %>
+      <div class="modal fade" id="purchaseModal" tabindex="-1" aria-hidden="true">
+        <div class="modal-dialog">
+          <form method="post" action="/webstore/checkout" class="modal-content">
+            <div class="modal-header">
+              <h5 class="modal-title" id="purchaseModalTitle">Complete purchase</h5>
+              <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+              <input type="hidden" name="itemSlug" id="purchaseModalItemSlug">
+              <div class="mb-3">
+                <label class="form-label">Who is this purchase for?</label>
+                <div class="form-check">
+                  <input class="form-check-input" type="radio" name="purchaseFor" id="purchaseForSelf" value="self" checked>
+                  <label class="form-check-label" for="purchaseForSelf">My account (<%= username %>)</label>
+                </div>
+                <div class="form-check">
+                  <input class="form-check-input" type="radio" name="purchaseFor" id="purchaseForGift" value="gift">
+                  <label class="form-check-label" for="purchaseForGift">Gift to another player</label>
+                </div>
+              </div>
+              <div class="mb-3" id="giftUsernameGroup" style="display: none;">
+                <label class="form-label">Minecraft username</label>
+                <input
+                  type="text"
+                  name="recipientUsername"
+                  id="giftUsernameInput"
+                  class="form-control"
+                  placeholder="Minecraft username"
+                  maxlength="16"
+                  list="giftUsernameList"
+                >
+                <datalist id="giftUsernameList">
+                  <% contacts.forEach(function(contact) { %>
+                    <option value="<%= contact %>"></option>
+                  <% }) %>
+                </datalist>
+                <small class="text-muted">Start typing to autofill recent players.</small>
+              </div>
+            </div>
+            <div class="modal-footer">
+              <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+              <button type="submit" class="btn btn-primary" id="purchaseModalSubmit">Continue</button>
+            </div>
+          </form>
+        </div>
+      </div>
+      <script>
+        const purchaseModal = document.getElementById("purchaseModal");
+        if (purchaseModal) {
+          purchaseModal.addEventListener("show.bs.modal", function (event) {
+            const button = event.relatedTarget;
+            const itemSlug = button?.getAttribute("data-item-slug") || "";
+            const itemName = button?.getAttribute("data-item-name") || "purchase";
+            const itemAction = button?.getAttribute("data-item-action") || "Continue";
+            document.getElementById("purchaseModalItemSlug").value = itemSlug;
+            document.getElementById("purchaseModalTitle").textContent = `Purchase ${itemName}`;
+            document.getElementById("purchaseModalSubmit").textContent = itemAction;
+            document.getElementById("purchaseForSelf").checked = true;
+            document.getElementById("giftUsernameGroup").style.display = "none";
+            document.getElementById("giftUsernameInput").value = "";
+          });
+
+          const giftToggle = document.getElementById("purchaseForGift");
+          const selfToggle = document.getElementById("purchaseForSelf");
+          const giftGroup = document.getElementById("giftUsernameGroup");
+          const giftInput = document.getElementById("giftUsernameInput");
+          [giftToggle, selfToggle].forEach((toggle) => {
+            toggle?.addEventListener("change", () => {
+              if (giftToggle?.checked) {
+                giftGroup.style.display = "block";
+                giftInput.setAttribute("required", "required");
+              } else {
+                giftGroup.style.display = "none";
+                giftInput.removeAttribute("required");
+                giftInput.value = "";
+              }
+            });
+          });
+        }
+      </script>
+    <% } %>
   </div>
 </section>
 

From 402f47b0bcec767f9ea7583629d03c37cc0d7864 Mon Sep 17 00:00:00 2001
From: Ben Robson <shadowolfbusiness@gmail.com>
Date: Thu, 1 Jan 2026 13:04:26 +1100
Subject: [PATCH 9/9] Improve webstore gifting flow and ticket permissions

---
 controllers/supportTicketController.js | 93 ++++++++++++++++----------
 controllers/webstoreController.js      | 52 ++++++++------
 migration/v1.9.0_v1.10.0.sql           |  2 +
 routes/webstoreRoutes.js               | 34 ++++++----
 views/webstore/index.ejs               | 87 ++++++++++++++++++++++--
 5 files changed, 189 insertions(+), 79 deletions(-)
 create mode 100644 migration/v1.9.0_v1.10.0.sql

diff --git a/controllers/supportTicketController.js b/controllers/supportTicketController.js
index 0824660e..73257d66 100644
--- a/controllers/supportTicketController.js
+++ b/controllers/supportTicketController.js
@@ -1139,48 +1139,67 @@ export async function applyTicketParticipantPermissions(client, ticketId) {
         return;
     }
 
-    const permissionUpdates = [];
-
     const isSnowflake = (value) => Boolean(value) && /^\d{5,}$/.test(String(value).trim());
 
-    participants.users
-        .map((user) => (user.discordId ? String(user.discordId).trim() : ""))
-        .filter((id) => isSnowflake(id))
-        .forEach((discordId) => {
-            permissionUpdates.push(
-                channel.permissionOverwrites.edit(discordId, {
-                    ViewChannel: true,
-                    SendMessages: true,
-                    AttachFiles: true,
-                    ReadMessageHistory: true,
-                }),
-            );
-        });
+    const guild = channel.guild;
+    if (!guild) {
+        console.warn("applyTicketParticipantPermissions: missing guild context", { ticketId });
+        return;
+    }
 
-    participants.groups
-        .map((group) => (group.roleId ? String(group.roleId).trim() : ""))
-        .filter((roleId) => {
-            const valid = isSnowflake(roleId);
-            if (!valid) {
-                console.warn("applyTicketParticipantPermissions: skipping invalid role id", { ticketId, roleId });
+    for (const user of participants.users) {
+        const discordId = user.discordId ? String(user.discordId).trim() : "";
+        if (!isSnowflake(discordId)) {
+            continue;
+        }
+
+        try {
+            const member = await guild.members.fetch(discordId);
+            if (!member) {
+                continue;
             }
-            return valid;
-        })
-        .forEach((roleId) => {
-            permissionUpdates.push(
-                channel.permissionOverwrites.edit(roleId, {
-                    ViewChannel: true,
-                    SendMessages: true,
-                    AttachFiles: true,
-                    ReadMessageHistory: true,
-                }),
-            );
-        });
 
-    try {
-        await Promise.all(permissionUpdates);
-    } catch (error) {
-        console.error("applyTicketParticipantPermissions: failed to update channel permissions", error);
+            await channel.permissionOverwrites.edit(member, {
+                ViewChannel: true,
+                SendMessages: true,
+                AttachFiles: true,
+                ReadMessageHistory: true,
+            });
+        } catch (error) {
+            console.warn("applyTicketParticipantPermissions: unable to grant user permission", {
+                ticketId,
+                discordId,
+                error: error?.message ?? error,
+            });
+        }
+    }
+
+    for (const group of participants.groups) {
+        const roleId = group.roleId ? String(group.roleId).trim() : "";
+        if (!isSnowflake(roleId)) {
+            console.warn("applyTicketParticipantPermissions: skipping invalid role id", { ticketId, roleId });
+            continue;
+        }
+
+        try {
+            const role = await guild.roles.fetch(roleId);
+            if (!role) {
+                continue;
+            }
+
+            await channel.permissionOverwrites.edit(role, {
+                ViewChannel: true,
+                SendMessages: true,
+                AttachFiles: true,
+                ReadMessageHistory: true,
+            });
+        } catch (error) {
+            console.warn("applyTicketParticipantPermissions: unable to grant role permission", {
+                ticketId,
+                roleId,
+                error: error?.message ?? error,
+            });
+        }
     }
 }
 
diff --git a/controllers/webstoreController.js b/controllers/webstoreController.js
index 5dd525e0..b02784fe 100644
--- a/controllers/webstoreController.js
+++ b/controllers/webstoreController.js
@@ -52,21 +52,38 @@ async function fetchStripePrices() {
   return prices;
 }
 
-async function loadStripeItems() {
+function resolveStripePriceAmount(price, preferredCurrency) {
+  if (!preferredCurrency) {
+    return { amount: price.unit_amount || 0, currency: price.currency || "usd" };
+  }
+
+  const currencyKey = preferredCurrency.toLowerCase();
+  const currencyOption = price.currency_options?.[currencyKey];
+  if (currencyOption?.unit_amount) {
+    return { amount: currencyOption.unit_amount, currency: currencyKey };
+  }
+
+  return { amount: price.unit_amount || 0, currency: price.currency || "usd" };
+}
+
+async function loadStripeItems(preferredCurrency = null) {
   const prices = await fetchStripePrices();
 
   return prices
     .filter((price) => price.active && price.product && price.product.active)
-    .map((price) => ({
-      slug: price.id,
-      stripePriceId: price.id,
-      displayName: price.product?.name || price.nickname || price.id,
-      description: price.product?.description || "",
-      imageUrl: price.product?.images?.[0] || null,
-      priceCents: price.unit_amount || 0,
-      currency: price.currency || "usd",
-      purchaseType: price.type === "recurring" || price.recurring ? "subscription" : "one_time",
-    }))
+    .map((price) => {
+      const resolved = resolveStripePriceAmount(price, preferredCurrency);
+      return {
+        slug: price.id,
+        stripePriceId: price.id,
+        displayName: price.product?.name || price.nickname || price.id,
+        description: price.product?.description || "",
+        imageUrl: price.product?.images?.[0] || null,
+        priceCents: resolved.amount,
+        currency: resolved.currency,
+        purchaseType: price.type === "recurring" || price.recurring ? "subscription" : "one_time",
+      };
+    })
     .sort((a, b) => a.displayName.localeCompare(b.displayName));
 }
 
@@ -281,10 +298,10 @@ export async function getPurchaseBySessionId(stripeSessionId) {
   return rows[0] || null;
 }
 
-export async function getWebstoreItems() {
+export async function getWebstoreItems(preferredCurrency = null) {
   await ensureWebstoreTables();
 
-  const items = await loadStripeItems();
+  const items = await loadStripeItems(preferredCurrency);
   if (!items.length) return [];
 
   const priceIds = items.map((item) => item.stripePriceId);
@@ -427,15 +444,6 @@ export async function getPurchasesNeedingFulfillment() {
   );
 }
 
-export async function getWebstoreContacts(userId, limit = 10) {
-  await ensureWebstoreTables();
-
-  return query(
-    "SELECT minecraftUsername FROM webstoreContacts WHERE userId = ? ORDER BY lastTransactionAt DESC LIMIT ?",
-    [userId, limit]
-  );
-}
-
 export async function createTransactionsForPurchase({
   purchaseId,
   payerUserId,
diff --git a/migration/v1.9.0_v1.10.0.sql b/migration/v1.9.0_v1.10.0.sql
new file mode 100644
index 00000000..25844c38
--- /dev/null
+++ b/migration/v1.9.0_v1.10.0.sql
@@ -0,0 +1,2 @@
+ALTER TABLE supportTicketMessages CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+ALTER TABLE supportTicketMessages MODIFY message TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL;
diff --git a/routes/webstoreRoutes.js b/routes/webstoreRoutes.js
index 975a9f61..f2a92997 100644
--- a/routes/webstoreRoutes.js
+++ b/routes/webstoreRoutes.js
@@ -5,11 +5,27 @@ import {
   createPendingPurchase,
   findWebstoreItem,
   formatPrice,
-  getWebstoreContacts,
   getWebstoreItems,
   getMonthlyPurchaseTotals,
 } from "../controllers/webstoreController.js";
 
+function getPreferredCurrency(locale) {
+  if (!locale) return null;
+  const region = locale.split("-")[1] || locale.split("_")[1];
+  if (!region) return null;
+
+  const regionMap = {
+    AU: "aud",
+    US: "usd",
+    GB: "gbp",
+    CA: "cad",
+    NZ: "nzd",
+    EU: "eur",
+  };
+
+  return regionMap[region.toUpperCase()] || null;
+}
+
 async function createStripeCheckoutSession({
   item,
   userId,
@@ -66,6 +82,7 @@ export default function webstoreRoutes(app, config, features) {
       typeof req.headers["accept-language"] === "string"
         ? req.headers["accept-language"].split(",")[0]
         : "en-US";
+    const preferredCurrency = getPreferredCurrency(locale);
 
     if (loggedIn && !req.session?.user?.username) {
       setBannerCookie(
@@ -78,27 +95,17 @@ export default function webstoreRoutes(app, config, features) {
 
     let items = [];
     try {
-      items = (await getWebstoreItems()).map((item) => ({
+      items = (await getWebstoreItems(preferredCurrency)).map((item) => ({
         ...item,
         priceDisplay: formatPrice(item.priceCents, item.currency, locale),
         purchaseLabel:
-          item.purchaseType === "subscription" ? "Subscribe" : "Buy once",
+          item.purchaseType === "subscription" ? "Subscribe" : "Buy",
       }));
     } catch (error) {
       console.error("Failed to load webstore items", error);
       setBannerCookie("warning", "Webstore items are unavailable right now.", res);
     }
 
-    let contacts = [];
-    if (loggedIn && req.session?.user?.userId) {
-      try {
-        const rows = await getWebstoreContacts(req.session.user.userId, 10);
-        contacts = rows.map((row) => row.minecraftUsername);
-      } catch (error) {
-        console.error("Failed to load webstore contacts", error);
-      }
-    }
-
     return res.view("webstore/index", {
       pageTitle: "Webstore",
       config,
@@ -109,7 +116,6 @@ export default function webstoreRoutes(app, config, features) {
       items,
       username: loggedIn ? req.session.user.username : null,
       loggedIn,
-      contacts,
     });
   });
 
diff --git a/views/webstore/index.ejs b/views/webstore/index.ejs
index e1b4d3ea..f2db27b5 100644
--- a/views/webstore/index.ejs
+++ b/views/webstore/index.ejs
@@ -96,13 +96,9 @@
                   class="form-control"
                   placeholder="Minecraft username"
                   maxlength="16"
-                  list="giftUsernameList"
+                  autocomplete="off"
                 >
-                <datalist id="giftUsernameList">
-                  <% contacts.forEach(function(contact) { %>
-                    <option value="<%= contact %>"></option>
-                  <% }) %>
-                </datalist>
+                <div id="giftUserSuggestions" class="list-group mt-2"></div>
                 <small class="text-muted">Start typing to autofill recent players.</small>
               </div>
             </div>
@@ -133,6 +129,74 @@
           const selfToggle = document.getElementById("purchaseForSelf");
           const giftGroup = document.getElementById("giftUsernameGroup");
           const giftInput = document.getElementById("giftUsernameInput");
+          const giftSuggestions = document.getElementById("giftUserSuggestions");
+
+          const clearGiftSuggestions = () => {
+            if (giftSuggestions) {
+              giftSuggestions.innerHTML = "";
+            }
+          };
+
+          const renderGiftSuggestions = (results = []) => {
+            clearGiftSuggestions();
+            if (!results.length || !giftSuggestions) return;
+
+            results.forEach((user) => {
+              const item = document.createElement("button");
+              item.type = "button";
+              item.className = "list-group-item list-group-item-action d-flex align-items-center gap-2";
+              item.dataset.username = user.username;
+
+              if (user.avatarUrl) {
+                const img = document.createElement("img");
+                img.src = user.avatarUrl;
+                img.alt = `${user.username} avatar`;
+                img.width = 32;
+                img.height = 32;
+                img.className = "rounded";
+                item.appendChild(img);
+              } else {
+                const placeholder = document.createElement("div");
+                placeholder.className = "rounded bg-secondary";
+                placeholder.style.width = "32px";
+                placeholder.style.height = "32px";
+                item.appendChild(placeholder);
+              }
+
+              const label = document.createElement("span");
+              label.textContent = user.username;
+              label.className = "flex-fill text-start";
+              item.appendChild(label);
+
+              item.addEventListener("click", () => {
+                giftInput.value = user.username;
+                clearGiftSuggestions();
+              });
+
+              giftSuggestions.appendChild(item);
+            });
+          };
+
+          const searchGiftUsers = async (term) => {
+            if (!term || term.length < 2) {
+              clearGiftSuggestions();
+              return;
+            }
+
+            try {
+              const response = await fetch(`/support/users/search?q=${encodeURIComponent(term)}`);
+              if (!response.ok) {
+                clearGiftSuggestions();
+                return;
+              }
+
+              const data = await response.json();
+              renderGiftSuggestions(data.results || []);
+            } catch (error) {
+              console.error("Failed to search gift users", error);
+              clearGiftSuggestions();
+            }
+          };
           [giftToggle, selfToggle].forEach((toggle) => {
             toggle?.addEventListener("change", () => {
               if (giftToggle?.checked) {
@@ -142,9 +206,20 @@
                 giftGroup.style.display = "none";
                 giftInput.removeAttribute("required");
                 giftInput.value = "";
+                clearGiftSuggestions();
               }
             });
           });
+
+          if (giftInput) {
+            let giftSearchTimeout;
+            giftInput.addEventListener("input", (event) => {
+              clearTimeout(giftSearchTimeout);
+              giftSearchTimeout = setTimeout(() => {
+                searchGiftUsers((event.target.value || "").trim());
+              }, 250);
+            });
+          }
         }
       </script>
     <% } %>