In-Game Shop with Server Validation

--!strict
-- ShopCatalog.lua (ReplicatedStorage)

export type ShopItem = {
	id: string,
	name: string,
	description: string,
	price: number,
	unique: boolean, -- if true, player can only own one
}

local Catalog: { [string]: ShopItem } = {
	wood_sword = {
		id = "wood_sword",
		name = "Wooden Sword",
		description = "Better than nothing.",
		price = 50,
		unique = true,
	},
	iron_sword = {
		id = "iron_sword",
		name = "Iron Sword",
		description = "A reliable blade.",
		price = 250,
		unique = true,
	},
	health_potion = {
		id = "health_potion",
		name = "Health Potion",
		description = "Heals 50 HP.",
		price = 25,
		unique = false,
	},
}

return Catalog

--!strict
-- ShopService.lua
local Players = game:GetService("Players")
local ReplicatedStorage = game:GetService("ReplicatedStorage")

local Catalog = require(ReplicatedStorage:WaitForChild("ShopCatalog"))

-- Server-only inventory store. Never replicate this directly to clients —
-- send a sanitized snapshot via RemoteEvent if the UI needs it.
local inventories: { [Player]: { [string]: number } } = {}

Players.PlayerAdded:Connect(function(player)
	inventories[player] = {}
end)

Players.PlayerRemoving:Connect(function(player)
	inventories[player] = nil
end)

local PurchaseRemote = Instance.new("RemoteFunction")
PurchaseRemote.Name = "PurchaseRemote"
PurchaseRemote.Parent = ReplicatedStorage

type PurchaseResult = {
	ok: boolean,
	error: string?,
	newBalance: number?,
}

local function getCoins(player: Player): IntValue?
	local leaderstats = player:FindFirstChild("leaderstats")
	if not leaderstats then return nil end
	local coins = leaderstats:FindFirstChild("Coins")
	if coins and coins:IsA("IntValue") then
		return coins
	end
	return nil
end

PurchaseRemote.OnServerInvoke = function(player: Player, itemId: any): PurchaseResult
	-- 1. Validate input shape (the client could send anything)
	if type(itemId) ~= "string" then
		return { ok = false, error = "INVALID_INPUT" }
	end

	-- 2. Validate item exists
	local item = Catalog[itemId]
	if not item then
		return { ok = false, error = "UNKNOWN_ITEM" }
	end

	-- 3. Validate uniqueness rule
	local inv = inventories[player]
	if not inv then
		return { ok = false, error = "NO_INVENTORY" }
	end
	if item.unique and (inv[itemId] or 0) > 0 then
		return { ok = false, error = "ALREADY_OWNED" }
	end

	-- 4. Validate balance
	local coins = getCoins(player)
	if not coins then
		return { ok = false, error = "NO_BALANCE" }
	end
	if coins.Value < item.price then
		return { ok = false, error = "INSUFFICIENT_COINS" }
	end

	-- 5. All checks passed — commit
	coins.Value -= item.price
	inv[itemId] = (inv[itemId] or 0) + 1

	return { ok = true, newBalance = coins.Value }
end