fix: retire public payment verify and backfill trade no

frontend/src/api/__tests__/payment.spec.ts

@@ -0,0 +1,36 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { get, post } = vi.hoisted(() => ({
+  get: vi.fn(),
+  post: vi.fn(),
+}))
+
+vi.mock('@/api/client', () => ({
+  apiClient: {
+    get,
+    post,
+  },
+}))
+
+import { paymentAPI } from '@/api/payment'
+
+describe('payment api', () => {
+  beforeEach(() => {
+    get.mockReset()
+    post.mockReset()
+    get.mockResolvedValue({ data: {} })
+    post.mockResolvedValue({ data: {} })
+  })
+
+  it('does not expose anonymous public out_trade_no verification', () => {
+    expect(Object.prototype.hasOwnProperty.call(paymentAPI, 'verifyOrderPublic')).toBe(false)
+  })
+
+  it('keeps signed public resume-token resolve endpoint', async () => {
+    await paymentAPI.resolveOrderPublicByResumeToken('resume-token-123')
+
+    expect(post).toHaveBeenCalledWith('/payment/public/orders/resolve', {
+      resume_token: 'resume-token-123',
+    })
+  })
+})

frontend/src/api/payment.ts

@@ -67,11 +67,6 @@ export const paymentAPI = {
     return apiClient.post<PaymentOrder>('/payment/orders/verify', { out_trade_no: outTradeNo })
   },
 
-  /** Verify order payment status without auth (public endpoint for result page) */
-  verifyOrderPublic(outTradeNo: string) {
-    return apiClient.post<PaymentOrder>('/payment/public/orders/verify', { out_trade_no: outTradeNo })
-  },
-
   /** Resolve an order from a signed resume token without auth */
   resolveOrderPublicByResumeToken(resumeToken: string) {
     return apiClient.post<PaymentOrder>('/payment/public/orders/resolve', { resume_token: resumeToken })

frontend/src/views/user/__tests__/PaymentResultView.spec.ts

@@ -7,7 +7,6 @@ const routeState = vi.hoisted(() => ({
 
 const routerPush = vi.hoisted(() => vi.fn())
 const pollOrderStatus = vi.hoisted(() => vi.fn())
-const verifyOrderPublic = vi.hoisted(() => vi.fn())
 const verifyOrder = vi.hoisted(() => vi.fn())
 const resolveOrderPublicByResumeToken = vi.hoisted(() => vi.fn())
 
@@ -38,7 +37,6 @@ vi.mock('@/stores/payment', () => ({
 
 vi.mock('@/api/payment', () => ({
   paymentAPI: {
-    verifyOrderPublic,
     verifyOrder,
     resolveOrderPublicByResumeToken,
   },
@@ -67,7 +65,6 @@ describe('PaymentResultView', () => {
     routeState.query = {}
     routerPush.mockReset()
     pollOrderStatus.mockReset()
-    verifyOrderPublic.mockReset()
     verifyOrder.mockReset()
     resolveOrderPublicByResumeToken.mockReset()
     window.localStorage.clear()
@@ -110,7 +107,6 @@ describe('PaymentResultView', () => {
     await flushPromises()
 
     expect(pollOrderStatus).toHaveBeenCalledWith(42)
-    expect(verifyOrderPublic).not.toHaveBeenCalled()
     expect(wrapper.text()).toContain('payment.result.processing')
     expect(wrapper.text()).not.toContain('payment.result.success')
     expect(wrapper.text()).not.toContain('payment.result.failed')
@@ -221,7 +217,6 @@ describe('PaymentResultView', () => {
     await flushPromises()
 
     expect(resolveOrderPublicByResumeToken).toHaveBeenCalledWith('resume-fail')
-    expect(verifyOrderPublic).not.toHaveBeenCalled()
     expect(verifyOrder).not.toHaveBeenCalled()
   })
 
@@ -241,7 +236,6 @@ describe('PaymentResultView', () => {
 
     await flushPromises()
 
-    expect(verifyOrderPublic).not.toHaveBeenCalled()
     expect(verifyOrder).not.toHaveBeenCalled()
   })
 
@@ -260,7 +254,6 @@ describe('PaymentResultView', () => {
 
     await flushPromises()
 
-    expect(verifyOrderPublic).not.toHaveBeenCalled()
     expect(verifyOrder).not.toHaveBeenCalled()
   })
 
@@ -284,7 +277,6 @@ describe('PaymentResultView', () => {
 
     expect(resolveOrderPublicByResumeToken).toHaveBeenCalledWith('resume-77')
     expect(wrapper.text()).toContain('payment.result.success')
-    expect(verifyOrderPublic).not.toHaveBeenCalled()
   })
 
   it('normalizes aliased payment methods before rendering the label', async () => {