> For the complete documentation index, see [llms.txt](https://code-after-sex.gitbook.io/script-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://code-after-sex.gitbook.io/script-documentation/cas-advanced-inventory/security.md).

# Duplication protection and logs

How CAS Advanced Inventory prevents item duplication on RedM servers, its Discord logs for give, drop, trade, search, stash and suspicious actions, and the /invadmin commands.

## How items stay safe

* **The server owns every item.** The satchel on screen only says "this slot, this many". Nothing it sends is trusted beyond that, and every request is checked against the player's real inventory.
* **Check first, then change.** Every change is fully validated before anything moves. Then it is applied to memory and written to the database in one ordered queue, so a later write can never overtake an earlier one. A move between two inventories is a single transaction: it happens on both sides or not at all.
* **Gives and trades move nothing until the very end,** and everything is checked again at that moment. An item offered in a trade cannot leave the satchel while the trade is open.
* **Ground drops are claimed by the server:** two riders taking the same thing at the same moment get it once.
* **Stashes are used by one rider at a time** where it matters, so two people cannot empty the same chest at once.
* **Rate limits:** satchel actions per player per second are capped (`ServerConfig.MaxActionsPerSecond`), with a largest single amount (`ServerConfig.MaxTransfer`) and an item use cooldown (`ServerConfig.UseCooldownMs`).
* **Ammo** reports from the client may only ever lower the count.
* **Old syn windows** take one item at a time until the other script answers, and locked stacks cannot be handed to them.

The same core serves the satchel and every export other scripts call, so a script and a player can never see two different truths.

## Discord logs

Set a webhook per channel in `config/config_server.lua` (leave `''` to turn a channel off):

| Channel      | What is logged                                                                                        |
| ------------ | ----------------------------------------------------------------------------------------------------- |
| `give`       | Gives (items, cash and gold): who, to whom, what and how many                                         |
| `drop`       | Items and money dropped on the ground, money picked up                                                |
| `trade`      | Finished trades with both sides                                                                       |
| `search`     | Searches, robberies and confiscations                                                                 |
| `stash`      | Items stored in and taken from stashes (a stash registered with its own `webhook` logs there instead) |
| `admin`      | `/invadmin` commands                                                                                  |
| `suspicious` | Rate limit hits and impossible ammo reports                                                           |

## Admin commands

| Command                              | What it does                                         |
| ------------------------------------ | ---------------------------------------------------- |
| `/invadmin open <id>`                | Opens a player's satchel                             |
| `/invadmin give <id> <item> [count]` | Gives an item                                        |
| `/invadmin clear <id>`               | Empties a player's satchel                           |
| `/invadmin count <id> <item>`        | How many of an item a player has                     |
| `/invadmin reload`                   | Reloads item definitions added while the server runs |

Permission: the ace `cas_inventory.admin` or a framework group in `ServerConfig.AdminGroups` (admin, superadmin, god by default).

```
add_ace group.admin cas_inventory.admin allow
```

On RSG the usual `giveitem`, `clearinv`, `inventory` and `closeinv` commands keep working.