Files
lunar-mini/server/internal/service/order.go
T
gouki b8c439deac fix(server): 安全加固与版本链路修复
- 微信登录改为真实 jscode2session,session_key 不再下发客户端
- 支付回调增加 HMAC 验签(X-Pay-Sign)与幂等处理,未配置密钥时拒绝回调
- 订单金额一律以服务端商品表定价,禁止客户端传入金额
- 付费许愿改为支付成功后创建,不再先许愿后付款
- 管理后台增加登录认证(ADMIN_PASSWORD + role=admin JWT + HttpOnly Cookie)
- 订单详情/取消增加本人归属校验,修复越权访问
- 版本信息改为 ldflags 注入单一链路,GoVersion 用 runtime.Version()
- 恢复 gin 默认访问日志(原 Logger 中间件输出为空)
- 加载 HTML 模板修复后台页面 500;godotenv 加载 .env.local
- CORS 支持 CORS_ORIGINS 白名单配置
2026-08-09 00:09:24 +00:00

202 lines
5.2 KiB
Go

package service
import (
"crypto/md5"
"encoding/hex"
"errors"
"fmt"
"log"
"math/rand"
"time"
"github.com/gouki/lunar-server/internal/config"
"github.com/gouki/lunar-server/internal/model"
"gorm.io/gorm"
)
// OrderService 订单服务
type OrderService struct {
db *gorm.DB
}
// NewOrderService 创建订单服务
func NewOrderService() *OrderService {
return &OrderService{
db: config.GetDB(),
}
}
// CreateOrder 创建订单
func (s *OrderService) CreateOrder(order *model.Order) error {
// 生成订单号
order.OrderNo = s.generateOrderNo()
order.Status = "pending"
// 设置过期时间(30分钟)
expireTime := time.Now().Add(30 * time.Minute)
order.ExpireTime = &expireTime
return s.db.Create(order).Error
}
// generateOrderNo 生成订单号
func (s *OrderService) generateOrderNo() string {
// 格式:L + 年月日时分秒 + 6位随机数
now := time.Now()
random := rand.Intn(1000000)
return fmt.Sprintf("L%s%06d", now.Format("20060102150405"), random)
}
// GetOrderByID 根据ID获取订单
func (s *OrderService) GetOrderByID(id uint) (*model.Order, error) {
var order model.Order
if err := s.db.First(&order, id).Error; err != nil {
return nil, err
}
return &order, nil
}
// GetOrderByOrderNo 根据订单号获取订单
func (s *OrderService) GetOrderByOrderNo(orderNo string) (*model.Order, error) {
var order model.Order
if err := s.db.Where("order_no = ?", orderNo).First(&order).Error; err != nil {
return nil, err
}
return &order, nil
}
// GetOrderList 获取订单列表
func (s *OrderService) GetOrderList(userID uint, page, pageSize int) ([]*model.Order, int64, error) {
var orders []*model.Order
var total int64
query := s.db.Model(&model.Order{}).Where("user_id = ?", userID)
if err := query.Count(&total).Error; err != nil {
return nil, 0, err
}
if err := query.Order("created_at DESC").
Offset((page - 1) * pageSize).
Limit(pageSize).
Find(&orders).Error; err != nil {
return nil, 0, err
}
return orders, total, nil
}
// UpdateOrderStatus 更新订单状态
func (s *OrderService) UpdateOrderStatus(orderNo, status string) error {
updates := map[string]interface{}{
"status": status,
}
if status == "paid" {
now := time.Now()
updates["pay_time"] = &now
}
return s.db.Model(&model.Order{}).Where("order_no = ?", orderNo).Updates(updates).Error
}
// CancelOrder 取消订单(仅限本人且仅待支付状态可取消)
func (s *OrderService) CancelOrder(userID, id uint) error {
result := s.db.Model(&model.Order{}).
Where("id = ? AND user_id = ? AND status = ?", id, userID, "pending").
Update("status", "cancelled")
if result.Error != nil {
return result.Error
}
if result.RowsAffected == 0 {
return errors.New("订单不存在或当前状态不可取消")
}
return nil
}
// CheckOrderExpired 检查订单是否过期
func (s *OrderService) CheckOrderExpired(order *model.Order) bool {
if order.ExpireTime == nil {
return false
}
return time.Now().After(*order.ExpireTime)
}
// CreateWechatPayOrder 创建微信支付订单
func (s *OrderService) CreateWechatPayOrder(order *model.Order, openID string) (map[string]string, error) {
// TODO: 实现微信支付下单逻辑
// 这里返回模拟数据
payParams := map[string]string{
"timeStamp": fmt.Sprintf("%d", time.Now().Unix()),
"nonceStr": s.generateNonceStr(),
"package": fmt.Sprintf("prepay_id=wx%s", order.OrderNo),
"signType": "MD5",
"paySign": s.generatePaySign(order.OrderNo),
}
return payParams, nil
}
// generateNonceStr 生成随机字符串
func (s *OrderService) generateNonceStr() string {
return fmt.Sprintf("%d", time.Now().UnixNano())
}
// generatePaySign 生成支付签名
func (s *OrderService) generatePaySign(orderNo string) string {
// TODO: 实现真实的微信支付签名
hash := md5.Sum([]byte(orderNo + "secret"))
return hex.EncodeToString(hash[:])
}
// HandlePayNotify 处理支付回调(幂等:已支付订单不重复处理)
func (s *OrderService) HandlePayNotify(orderNo, transactionID string) error {
order, err := s.GetOrderByOrderNo(orderNo)
if err != nil {
return fmt.Errorf("order not found: %w", err)
}
// 幂等:已支付直接返回成功
if order.Status == "paid" {
return nil
}
if order.Status != "pending" {
return fmt.Errorf("order %s in unexpected status %s", orderNo, order.Status)
}
// 条件更新防止并发重复入账
updates := map[string]interface{}{
"status": "paid",
"pay_time": time.Now(),
"remark": order.Remark + " [tx:" + transactionID + "]",
}
result := s.db.Model(&model.Order{}).
Where("order_no = ? AND status = ?", orderNo, "pending").
Updates(updates)
if result.Error != nil {
return result.Error
}
if result.RowsAffected == 0 {
// 并发下已被其他回调处理,视为幂等成功
return nil
}
// 支付成功后才创建付费许愿
if order.Type == "wish" && order.Remark != "" {
wishService := NewWishService()
wish := &model.Wish{
UserID: order.UserID,
TreeID: 1, // 默认祈福树
Content: order.Remark,
Type: "paid",
Status: 1,
}
if err := wishService.CreateWish(wish); err != nil {
// 许愿创建失败不回滚支付状态,由后台补处理
log.Printf("create paid wish for order %s failed: %v", orderNo, err)
}
}
return nil
}