gouki
b8c439deac
- 微信登录改为真实 jscode2session，session_key 不再下发客户端 - 支付回调增加 HMAC 验签（X-Pay-Sign）与幂等处理，未配置密钥时拒绝回调 - 订单金额一律以服务端商品表定价，禁止客户端传入金额 - 付费许愿改为支付成功后创建，不再先许愿后付款 - 管理后台增加登录认证（ADMIN_PASSWORD + role=admin JWT + HttpOnly Cookie） - 订单详情/取消增加本人归属校验，修复越权访问 - 版本信息改为 ldflags 注入单一链路，GoVersion 用 runtime.Version() - 恢复 gin 默认访问日志（原 Logger 中间件输出为空） - 加载 HTML 模板修复后台页面 500；godotenv 加载 .env.local - CORS 支持 CORS_ORIGINS 白名单配置
90 lines
1.9 KiB
Go
90 lines
1.9 KiB
Go
package handler
|
|
|
|
import (
|
|
"net/http"
|
|
"strconv"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/gouki/lunar-server/internal/service"
|
|
)
|
|
|
|
// GetOrderList 获取订单列表
|
|
func GetOrderList(c *gin.Context) {
|
|
userID, exists := c.Get("userID")
|
|
if !exists {
|
|
c.JSON(http.StatusUnauthorized, gin.H{
|
|
"code": 401,
|
|
"msg": "未授权",
|
|
})
|
|
return
|
|
}
|
|
|
|
page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
|
|
pageSize, _ := strconv.Atoi(c.DefaultQuery("pageSize", "10"))
|
|
|
|
orderService := service.NewOrderService()
|
|
orders, total, err := orderService.GetOrderList(userID.(uint), page, pageSize)
|
|
if err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{
|
|
"code": 500,
|
|
"msg": "获取订单列表失败",
|
|
})
|
|
return
|
|
}
|
|
|
|
c.JSON(http.StatusOK, gin.H{
|
|
"code": 0,
|
|
"msg": "success",
|
|
"data": gin.H{
|
|
"list": orders,
|
|
"total": total,
|
|
"page": page,
|
|
},
|
|
})
|
|
}
|
|
|
|
// GetOrderDetail 获取订单详情（仅限本人订单）
|
|
func GetOrderDetail(c *gin.Context) {
|
|
userID, _ := c.Get("userID")
|
|
id := c.Param("id")
|
|
orderID, _ := strconv.Atoi(id)
|
|
|
|
orderService := service.NewOrderService()
|
|
order, err := orderService.GetOrderByID(uint(orderID))
|
|
if err != nil || order.UserID != userID.(uint) {
|
|
// 不存在与无权访问统一返回 404，避免枚举他人订单
|
|
c.JSON(http.StatusNotFound, gin.H{
|
|
"code": 404,
|
|
"msg": "订单不存在",
|
|
})
|
|
return
|
|
}
|
|
|
|
c.JSON(http.StatusOK, gin.H{
|
|
"code": 0,
|
|
"msg": "success",
|
|
"data": order,
|
|
})
|
|
}
|
|
|
|
// CancelOrder 取消订单（仅限本人待支付订单）
|
|
func CancelOrder(c *gin.Context) {
|
|
userID, _ := c.Get("userID")
|
|
id := c.Param("id")
|
|
orderID, _ := strconv.Atoi(id)
|
|
|
|
orderService := service.NewOrderService()
|
|
if err := orderService.CancelOrder(userID.(uint), uint(orderID)); err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{
|
|
"code": 400,
|
|
"msg": err.Error(),
|
|
})
|
|
return
|
|
}
|
|
|
|
c.JSON(http.StatusOK, gin.H{
|
|
"code": 0,
|
|
"msg": "success",
|
|
})
|
|
}
|