feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用
安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签 （ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
This commit is contained in:
yangwx committed
1 parent
1d49e6f5ee
commit
18101cf11a
636 files changed
+58517
-9519
No files matched your search
@@ -0,0 +1,125 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace addon\paycenter\controller\backend;
|
||||
|
||||
use addon\paycenter\library\Schema;
|
||||
use addon\paycenter\service\Payment;
|
||||
use think\facade\Db;
|
||||
use think\facade\View;
|
||||
|
||||
/**
|
||||
* 支付流水后台（交易流水 / 主动查单 / 发起退款）
|
||||
*/
|
||||
class Trade extends PaycenterBackend
|
||||
{
|
||||
/** 列表页 */
|
||||
public function index()
|
||||
{
|
||||
Schema::ensure();
|
||||
|
||||
return View::fetch('trade/index');
|
||||
}
|
||||
|
||||
/** 列表数据（layui table） */
|
||||
public function list()
|
||||
{
|
||||
Schema::ensure();
|
||||
|
||||
$page = max(1, (int) request()->param('page', 1));
|
||||
$limit = min(100, max(1, (int) request()->param('limit', 15)));
|
||||
$tradeNo = trim((string) request()->param('trade_no', ''));
|
||||
$channel = trim((string) request()->param('channel', ''));
|
||||
$status = request()->param('status', '');
|
||||
|
||||
$db = Db::name('paycenter_trade');
|
||||
if ($tradeNo !== '') {
|
||||
$db->where('trade_no', 'like', '%' . $tradeNo . '%');
|
||||
}
|
||||
if ($channel !== '') {
|
||||
$db->where('channel', $channel);
|
||||
}
|
||||
if ($status !== '' && $status !== null) {
|
||||
$db->where('status', (int) $status);
|
||||
}
|
||||
|
||||
$total = (int) $db->count();
|
||||
$rows = $db->order('id', 'desc')->page($page, $limit)->select()->toArray();
|
||||
foreach ($rows as &$row) {
|
||||
$row['status_text'] = [0 => '待支付', 1 => '已支付', 2 => '已退款'][(int) $row['status']] ?? '未知';
|
||||
$row['create_time'] = !empty($row['create_at']) ? date('Y-m-d H:i:s', (int) $row['create_at']) : '';
|
||||
$row['pay_time'] = !empty($row['pay_at']) ? date('Y-m-d H:i:s', (int) $row['pay_at']) : '';
|
||||
}
|
||||
|
||||
return json(['code' => 0, 'msg' => '', 'count' => $total, 'data' => $rows]);
|
||||
}
|
||||
|
||||
/** 详情 */
|
||||
public function detail()
|
||||
{
|
||||
Schema::ensure();
|
||||
|
||||
$tradeNo = trim((string) request()->param('trade_no', ''));
|
||||
$trade = $tradeNo !== '' ? (array) Db::name('paycenter_trade')->where('trade_no', $tradeNo)->find() : [];
|
||||
if (!$trade) {
|
||||
return $this->result->error('流水不存在');
|
||||
}
|
||||
|
||||
return $this->result->success('success', $trade);
|
||||
}
|
||||
|
||||
/**
|
||||
* 主动查单：回调到不了（内网 / 防火墙 / 网关重试失败）时，用网关结果补发货。
|
||||
*/
|
||||
public function query()
|
||||
{
|
||||
Schema::ensure();
|
||||
|
||||
$tradeNo = trim((string) request()->param('trade_no', ''));
|
||||
if ($tradeNo === '') {
|
||||
return $this->result->error('缺少订单号');
|
||||
}
|
||||
$trade = (array) Db::name('paycenter_trade')->where('trade_no', $tradeNo)->find();
|
||||
if (!$trade) {
|
||||
return $this->result->error('流水不存在：' . $tradeNo);
|
||||
}
|
||||
$result = Payment::query((string) $trade['channel'], $tradeNo);
|
||||
if (!empty($result['paid'])) {
|
||||
// 与回调同一条链路：触发 PayPaid，让业务监听器发货（幂等）
|
||||
\addon\paycenter\library\TradeLog::markPaid([
|
||||
'trade_no' => $tradeNo,
|
||||
'gateway_no' => (string) ($result['gateway_no'] ?? ''),
|
||||
]);
|
||||
\think\facade\Event::trigger(Payment::EVENT_PAID, [
|
||||
'trade_no' => $tradeNo,
|
||||
'channel' => (string) $trade['channel'],
|
||||
'amount' => (float) ($result['amount'] ?? 0),
|
||||
'gateway_no' => (string) ($result['gateway_no'] ?? ''),
|
||||
'biz' => (string) ($trade['biz'] ?? ''),
|
||||
'biz_id' => (int) ($trade['biz_id'] ?? 0),
|
||||
'attach' => $trade['attach'] ?? '',
|
||||
'scene' => (string) ($trade['scene'] ?? ''),
|
||||
'trade' => $trade,
|
||||
]);
|
||||
|
||||
return $this->result->success('网关已确认付款，并已触发发货');
|
||||
}
|
||||
|
||||
return $this->result->error('网关查询不到付款记录（可能尚未支付或查单失败）');
|
||||
}
|
||||
|
||||
/** 发起退款（网关退款 + 流水置已退款） */
|
||||
public function refund()
|
||||
{
|
||||
Schema::ensure();
|
||||
|
||||
$tradeNo = trim((string) request()->param('trade_no', ''));
|
||||
$amount = (float) request()->param('amount', 0);
|
||||
if ($tradeNo === '') {
|
||||
return $this->result->error('缺少订单号');
|
||||
}
|
||||
$result = Payment::refund($tradeNo, $amount > 0 ? $amount : null);
|
||||
|
||||
return $result['ok'] ? $this->result->success($result['message']) : $this->result->error($result['message']);
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user