Investment Trading Simulator

1. Technology Stack

Composer Dependencies

Note: No third-party packages are used for authentication, password hashing, sorting, searching, or graph traversal — all implemented from scratch.

2. High-Level Architecture

The application follows MVC (Model-View-Controller) augmented with a Service Layer and a custom Support layer for data structures and algorithms.

Data Flow: A Typical Trade

Data Flow: Market Tick (Price Simulation)

3. Directory Structure

investment-trading-simulator/
├── app/
│   ├── Http/
│   │   ├── Controllers/        (10 controller files)
│   │   └── Middleware/         ManualAuthenticate.php, EnsureUserHasRole.php
│   ├── Models/             (8 Eloquent model files)
│   ├── Providers/          AppServiceProvider.php
│   ├── Services/           PriceEngine.php, MarketState.php,
│   │                       SimulationSessionManager.php, PasswordHasher.php
│   └── Support/
│       ├── Algorithms/         BinarySearch.php, MergeSort.php
│       ├── Collections/        SimpleList.php, SimpleQueue.php, SimpleStack.php
│       └── Graphs/             TutorialGraph.php
├── config/             app, auth, cache, database, logging...
├── database/
│   ├── migrations/         (11 migration files)
│   ├── seeders/            AssetSeeder.php, DatabaseSeeder.php
│   └── database.sqlite     SQLite database file
├── public/             Web root: index.php, compiled CSS/JS
├── resources/
│   ├── views/
│       ├── admin/          users.blade.php, assets/index.blade.php
│       ├── auth/           login.blade.php, register.blade.php
│       ├── dashboard/      user, admin, portfolio, session-summary
│       ├── layouts/        app.blade.php (master layout)
│       ├── market/         live, charts, chart, history
│       ├── partials/       sidebar.blade.php
│       └── tutorial/       index.blade.php, step.blade.php
├── routes/web.php      All application routes
├── tests/              Feature/ and Unit/ stubs
├── .env.example
├── composer.json
└── vite.config.js

4. Installation & Setup Guide

Prerequisites

PHP 8.2+ with: pdo, pdo_sqlite, mbstring, xml, openssl, tokenizer  •  Composer  •  Node.js 18+ & npm  •  Git

git clone <repository-url> investment-trading-simulator
cd investment-trading-simulator

composer run setup

php artisan db:seed

composer run dev

php artisan tinker
>>> $h = (new App\Services\PasswordHasher)->hash('password');
>>> App\Models\User::create([
...   'name' => 'Admin', 'email' => 'admin@example.com',
...   'password' => $h['hash'], 'password_salt' => $h['salt'],
...   'role' => 'admin', 'initial_balance' => 1000, 'current_balance' => 1000
... ]);

Key Environment Variables

5. Database Design

Entity-Relationship Overview

USER
 ├── has one  ──► PORTFOLIO
 ├── has many ──► HOLDING ──► belongs to ──► ASSET
 ├── has many ──► TRADE   ──► belongs to ──► ASSET
 │                └───────── belongs to ──► SIMULATION_SESSION
 ├── has many ──► SIMULATION_SESSION
 └── has many ──► TUTORIAL_PROGRESS

ASSET
 └── has many ──► CANDLE

Table: users

Table: assets

Table: candles

Table: trades

Table: holdings

Table: simulation_sessions

Table: tutorial_progress

6. Routing Map

Guest Routes

Authenticated Routes (middleware: auth.manual)

Admin Routes (middleware: auth.manual + role:admin)

7. Controllers

8. Models & Relationships

9. Services

PriceEngine

Core simulation engine. One MarketState per active asset. Uses SimpleQueue (trade queue) and SimpleList (tick buffer).

tick() for each active asset:
  noise  = currentPrice * (mt_rand(-1000,1000)/1000 * volatility)
  impact = sum( direction * currentPrice * (qty/liquidity) ) per queued trade
  price  = current + noise + impact   (floor $0.01)
  append to currentCandleTicks (SimpleList)
  if ticks >= 5: closeCandle() -> OHLCV -> DB -> reset SimpleList

MarketState

Per-asset in-memory value object: asset, currentPrice, currentCandleTicks (SimpleList), recentCandles (SimpleList, max 200), nextTimeIndex.

SimulationSessionManager

PasswordHasher

hash(password):
  salt  = bin2hex(random_bytes(16))  // 32-char hex
  value = salt + "|" + password
  loop 1000x: value = sha256(value)
  return { hash: value, salt: salt }

verify(password, storedHash, salt):
  computed = runHashLoop(password, salt)
  status = 0
  for each char i: status |= ord(computed[i]) XOR ord(storedHash[i])
  return (status === 0)  // constant-time comparison

10. Custom Data Structures

11. Custom Algorithms

sortByKey(items, key, ascending):
  if count <= 1: return unchanged
  left  = items[0 .. mid-1]    right = items[mid .. end]
  left  = sortByKey(left)      right = sortByKey(right)
  return merge(left, right)

merge: two-pointer comparison, take smaller (asc) or larger (desc), append remainder

findIndexByKey(items, key, target):
  low=0, high=count-1
  mid = floor((low+high)/2)
  items[mid][key] == target  →  return mid
  items[mid][key] <  target  →  low  = mid+1
  items[mid][key] >  target  →  high = mid-1
  return -1 if not found

Graph: intro → candles → risk → practice

dfs(node, visited, order):
  if visited: return
  mark visited, append to order
  for each neighbor: dfs(neighbor)

depthFirstOrder('intro') = ['intro', 'candles', 'risk', 'practice']

value = salt + "|" + password
for i = 0 to 999: value = sha256(value)
1000 iterations makes brute-force 1000x slower per attempt.

12. Middleware & Security

ManualAuthenticate (alias: auth.manual)

Checks session()->has('user_id'). If missing: redirect to login. Applied to all authenticated routes.

EnsureUserHasRole (alias: role)

Usage: middleware(['auth.manual', 'role:admin']). Checks session('user_role') === $required. If mismatch: abort(403). Applied to all /admin/* routes.

Security Measures

• 1000-iteration SHA-256 + unique random salt per user (brute-force resistant).
• Constant-time XOR comparison in password verify (prevents timing attacks).
• CSRF tokens on all forms (Laravel default VerifyCsrfToken middleware).
• Eloquent parameterized queries throughout (no SQL injection).
• DB::transaction() in TradeController (atomic writes, no partial state).
• Full server-side input validation before any database writes.
• password and password_salt in User $hidden (excluded from JSON output).

13. Views / Frontend

14. Seeded Data

Run: php artisan db:seed — uses AssetSeeder with updateOrCreate (safe to re-run).

BLUE = lowest risk (1%). REIT = low-moderate (1.5%). TECH = medium-high (3.5%). BTC = highest risk (7%) — demonstrates crypto volatility to beginners.

15. Glossary