oadmin/sub2api
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(payment): restore public resume and result flows

Browse Source
This commit is contained in:
IanShaw027
2026-04-22 11:17:23 +08:00
parent c229f33e9e
commit dd314c41e3
15 changed files with 435 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
frontend/src/api/__tests__/payment.spec.ts
View File

@@ -22,8 +22,12 @@ describe('payment api', () => {
post.mockResolvedValue({ data: {} })
})
it('does not expose anonymous public out_trade_no verification', () => {
expect(Object.prototype.hasOwnProperty.call(paymentAPI, 'verifyOrderPublic')).toBe(false)
it('keeps legacy public out_trade_no verification for upgrade compatibility', async () => {
await paymentAPI.verifyOrderPublic('legacy-order-no')
expect(post).toHaveBeenCalledWith('/payment/public/orders/verify', {
out_trade_no: 'legacy-order-no',
})
})
it('keeps signed public resume-token resolve endpoint', async () => {

5
frontend/src/api/payment.ts
View File

@@ -67,6 +67,11 @@ export const paymentAPI = {
return apiClient.post<PaymentOrder>('/payment/orders/verify', { out_trade_no: outTradeNo })
},
/** Legacy-compatible public order lookup by out_trade_no */
verifyOrderPublic(outTradeNo: string) {
return apiClient.post<PaymentOrder>('/payment/public/orders/verify', { out_trade_no: outTradeNo })
},
/** Resolve an order from a signed resume token without auth */
resolveOrderPublicByResumeToken(resumeToken: string) {
return apiClient.post<PaymentOrder>('/payment/public/orders/resolve', { resume_token: resumeToken })

29
frontend/src/components/payment/__tests__/paymentFlow.spec.ts
View File

@@ -73,6 +73,7 @@ describe('decidePaymentLaunch', () => {
expect(decision.paymentState.paymentType).toBe('alipay')
expect(decision.stripeMethod).toBe('alipay')
expect(decision.recovery.resumeToken).toBe('resume-1')
expect(decision.recovery.outTradeNo).toBe('')
})
it('uses Stripe route flow for mobile WeChat client secret', () => {
@@ -94,6 +95,7 @@ describe('decidePaymentLaunch', () => {
pay_url: 'https://pay.example.com/session/abc',
payment_mode: 'popup',
resume_token: 'resume-2',
out_trade_no: 'sub2_abc',
}), {
visibleMethod: 'wxpay',
orderType: 'balance',
@@ -103,6 +105,7 @@ describe('decidePaymentLaunch', () => {
expect(decision.kind).toBe('redirect_waiting')
expect(decision.paymentState.payUrl).toBe('https://pay.example.com/session/abc')
expect(decision.recovery.paymentMode).toBe('popup')
expect(decision.recovery.outTradeNo).toBe('sub2_abc')
expect(decision.recovery.resumeToken).toBe('resume-2')
})
@@ -225,6 +228,7 @@ describe('readPaymentRecoverySnapshot', () => {
expiresAt: '2099-01-01T00:10:00.000Z',
paymentType: 'alipay',
payUrl: 'https://pay.example.com/session/33',
outTradeNo: 'sub2_33',
clientSecret: '',
payAmount: 18,
orderType: 'balance',
@@ -249,6 +253,7 @@ describe('readPaymentRecoverySnapshot', () => {
expiresAt: '2024-01-01T00:10:00.000Z',
paymentType: 'wxpay',
payUrl: 'https://pay.example.com/session/55',
outTradeNo: 'sub2_55',
clientSecret: '',
payAmount: 18,
orderType: 'balance',
@@ -264,10 +269,34 @@ describe('readPaymentRecoverySnapshot', () => {
expect(readPaymentRecoverySnapshot(JSON.stringify({
...expiredSnapshot,
outTradeNo: 'sub2_55',
expiresAt: '2099-01-01T00:10:00.000Z',
}), {
now: Date.UTC(2099, 0, 1, 0, 1, 0),
resumeToken: 'other-token',
})).toBeNull()
})
it('keeps backward compatibility with snapshots written before outTradeNo existed', () => {
const restored = readPaymentRecoverySnapshot(JSON.stringify({
orderId: 44,
amount: 18,
qrCode: '',
expiresAt: '2099-01-01T00:10:00.000Z',
paymentType: 'alipay',
payUrl: 'https://pay.example.com/session/44',
clientSecret: '',
payAmount: 18,
orderType: 'balance',
paymentMode: 'popup',
resumeToken: 'resume-44',
createdAt: Date.UTC(2099, 0, 1, 0, 0, 0),
}), {
now: Date.UTC(2099, 0, 1, 0, 1, 0),
resumeToken: 'resume-44',
})
expect(restored?.orderId).toBe(44)
expect(restored?.outTradeNo).toBe('')
})
})

6
frontend/src/components/payment/paymentFlow.ts
View File

@@ -34,6 +34,7 @@ export interface PaymentRecoverySnapshot {
expiresAt: string
paymentType: string
payUrl: string
outTradeNo: string
clientSecret: string
payAmount: number
orderType: OrderType | ''
@@ -132,6 +133,7 @@ export function decidePaymentLaunch(
expiresAt: result.expires_at || '',
paymentType: visibleMethod,
payUrl: result.pay_url || '',
outTradeNo: result.out_trade_no || '',
clientSecret: result.client_secret || '',
payAmount: result.pay_amount,
orderType: context.orderType,
@@ -227,6 +229,7 @@ export function readPaymentRecoverySnapshot(
|| typeof parsed.expiresAt !== 'string'
|| typeof parsed.paymentType !== 'string'
|| typeof parsed.payUrl !== 'string'
|| (parsed.outTradeNo != null && typeof parsed.outTradeNo !== 'string')
|| typeof parsed.clientSecret !== 'string'
|| typeof parsed.payAmount !== 'number'
|| typeof parsed.paymentMode !== 'string'
@@ -241,7 +244,7 @@ export function readPaymentRecoverySnapshot(
if (Number.isFinite(expiresAt) && expiresAt <= now) {
return null
}
if (options.resumeToken && parsed.resumeToken && parsed.resumeToken !== options.resumeToken) {
if (options.resumeToken && parsed.resumeToken !== options.resumeToken) {
return null
}
@@ -252,6 +255,7 @@ export function readPaymentRecoverySnapshot(
expiresAt: parsed.expiresAt,
paymentType: parsed.paymentType,
payUrl: parsed.payUrl,
outTradeNo: parsed.outTradeNo || '',
clientSecret: parsed.clientSecret,
payAmount: parsed.payAmount,
orderType: parsed.orderType === 'subscription' ? 'subscription' : 'balance',

44
frontend/src/views/user/PaymentResultView.vue
View File

@@ -190,6 +190,15 @@ async function resolveOrderFromResumeToken(resumeToken: string): Promise<Payment
}
}
async function resolveOrderFromOutTradeNo(outTradeNo: string): Promise<PaymentOrder | null> {
try {
const result = await paymentAPI.verifyOrderPublic(outTradeNo)
return result.data
} catch (_err: unknown) {
return null
}
}
function clearStatusRefreshTimer(): void {
if (statusRefreshTimer !== null) {
clearTimeout(statusRefreshTimer)
@@ -234,24 +243,19 @@ onMounted(async () => {
? route.query.resume_token
: ''
const routeOrderId = Number(route.query.order_id) || 0
const outTradeNo = String(route.query.out_trade_no || '')
let outTradeNo = String(route.query.out_trade_no || '')
let orderId = 0
if (resumeToken && typeof window !== 'undefined') {
if (typeof window !== 'undefined') {
const restored = readPaymentRecoverySnapshot(
window.localStorage.getItem(PAYMENT_RECOVERY_STORAGE_KEY),
{ resumeToken },
resumeToken ? { resumeToken } : {},
)
if (restored?.orderId) {
orderId = restored.orderId
}
}
if (!order.value && resumeToken && orderId) {
try {
order.value = await paymentStore.pollOrderStatus(orderId)
} catch (_err: unknown) {
// Fall through to signed resume-token recovery below.
if (!outTradeNo && restored?.outTradeNo) {
outTradeNo = restored.outTradeNo
}
}
@@ -269,6 +273,20 @@ onMounted(async () => {
orderId = routeOrderId
}
const hasLegacyFallbackContext = typeof route.query.trade_status === 'string'
&& route.query.trade_status.trim() !== ''
const shouldUsePublicOutTradeNo = !resumeToken && outTradeNo !== '' && (hasLegacyFallbackContext || routeOrderId > 0 || orderId > 0)
if (!order.value && shouldUsePublicOutTradeNo) {
const legacyOrder = await resolveOrderFromOutTradeNo(outTradeNo)
if (legacyOrder) {
order.value = legacyOrder
if (!orderId) {
orderId = legacyOrder.id
}
}
}
if (!order.value && !resumeToken && orderId) {
try {
order.value = await paymentStore.pollOrderStatus(orderId)
@@ -277,8 +295,6 @@ onMounted(async () => {
}
}
const hasLegacyFallbackContext = typeof route.query.trade_status === 'string'
&& route.query.trade_status.trim() !== ''
if (!order.value && !resumeToken && !orderId && outTradeNo && hasLegacyFallbackContext) {
returnInfo.value = {
outTradeNo,
@@ -293,6 +309,10 @@ onMounted(async () => {
return await resolveOrderFromResumeToken(resumeToken)
}
if (shouldUsePublicOutTradeNo) {
return await resolveOrderFromOutTradeNo(outTradeNo)
}
if (orderId) {
return await paymentStore.pollOrderStatus(orderId)
}

13
frontend/src/views/user/PaymentView.vue
View File

@@ -276,7 +276,7 @@ import PaymentStatusPanel from '@/components/payment/PaymentStatusPanel.vue'
import Icon from '@/components/icons/Icon.vue'
import type { PaymentMethodOption } from '@/components/payment/PaymentMethodSelector.vue'
import { buildPaymentErrorToastMessage, describePaymentScenarioError } from './paymentUx'
import { parseWechatResumeRoute, stripWechatResumeQuery } from './paymentWechatResume'
import { hasWechatResumeQuery, parseWechatResumeRoute, stripWechatResumeQuery } from './paymentWechatResume'
const { t } = useI18n()
const route = useRoute()
@@ -329,6 +329,7 @@ function emptyPaymentState(): PaymentRecoverySnapshot {
expiresAt: '',
paymentType: '',
payUrl: '',
outTradeNo: '',
clientSecret: '',
payAmount: 0,
orderType: '',
@@ -396,6 +397,9 @@ async function redirectToPaymentResult(state: PaymentRecoverySnapshot): Promise<
if (state.orderId > 0) {
query.order_id = String(state.orderId)
}
if (state.outTradeNo) {
query.out_trade_no = state.outTradeNo
}
if (state.resumeToken) {
query.resume_token = state.resumeToken
}
@@ -809,9 +813,14 @@ onMounted(async () => {
selectedMethod.value = sorted[0]
}
if (typeof window !== 'undefined') {
if (hasWechatResumeQuery(route.query)) {
removeRecoverySnapshot()
}
const routeResumeToken = typeof route.query.resume_token === 'string'
? route.query.resume_token
: undefined
: typeof route.query.wechat_resume_token === 'string'
? route.query.wechat_resume_token
: undefined
const restored = readPaymentRecoverySnapshot(
window.localStorage.getItem(PAYMENT_RECOVERY_STORAGE_KEY),
{ resumeToken: routeResumeToken },

40
frontend/src/views/user/__tests__/PaymentResultView.spec.ts
View File

@@ -7,7 +7,7 @@ const routeState = vi.hoisted(() => ({
const routerPush = vi.hoisted(() => vi.fn())
const pollOrderStatus = vi.hoisted(() => vi.fn())
const verifyOrder = vi.hoisted(() => vi.fn())
const verifyOrderPublic = vi.hoisted(() => vi.fn())
const resolveOrderPublicByResumeToken = vi.hoisted(() => vi.fn())
vi.mock('vue-router', async () => {
@@ -37,7 +37,7 @@ vi.mock('@/stores/payment', () => ({
vi.mock('@/api/payment', () => ({
paymentAPI: {
verifyOrder,
verifyOrderPublic,
resolveOrderPublicByResumeToken,
},
}))
@@ -67,6 +67,7 @@ const recoverySnapshotFactory = (resumeToken: string) => ({
expiresAt: '2099-01-01T00:10:00.000Z',
paymentType: 'alipay',
payUrl: 'https://pay.example.com/session/42',
outTradeNo: 'sub2_20260420abcd1234',
clientSecret: '',
payAmount: 88,
orderType: 'balance',
@@ -80,7 +81,7 @@ describe('PaymentResultView', () => {
routeState.query = {}
routerPush.mockReset()
pollOrderStatus.mockReset()
verifyOrder.mockReset()
verifyOrderPublic.mockReset()
resolveOrderPublicByResumeToken.mockReset()
window.localStorage.clear()
})
@@ -102,6 +103,7 @@ describe('PaymentResultView', () => {
expiresAt: '2099-01-01T00:10:00.000Z',
paymentType: 'alipay',
payUrl: 'https://pay.example.com/session/42',
outTradeNo: 'sub2_20260420abcd1234',
clientSecret: '',
payAmount: 88,
orderType: 'balance',
@@ -109,7 +111,9 @@ describe('PaymentResultView', () => {
resumeToken: 'resume-42',
createdAt: Date.UTC(2099, 0, 1, 0, 0, 0),
}))
pollOrderStatus.mockResolvedValue(orderFactory('PENDING'))
resolveOrderPublicByResumeToken.mockResolvedValue({
data: orderFactory('PENDING'),
})
const wrapper = mount(PaymentResultView, {
global: {
@@ -121,7 +125,8 @@ describe('PaymentResultView', () => {
await flushPromises()
expect(pollOrderStatus).toHaveBeenCalledWith(42)
expect(resolveOrderPublicByResumeToken).toHaveBeenCalledWith('resume-42')
expect(pollOrderStatus).not.toHaveBeenCalled()
expect(wrapper.text()).toContain('payment.result.processing')
expect(wrapper.text()).not.toContain('payment.result.success')
expect(wrapper.text()).not.toContain('payment.result.failed')
@@ -140,6 +145,7 @@ describe('PaymentResultView', () => {
expiresAt: '2099-01-01T00:10:00.000Z',
paymentType: 'alipay',
payUrl: 'https://pay.example.com/session/42',
outTradeNo: 'sub2_20260420abcd1234',
clientSecret: '',
payAmount: 88,
orderType: 'balance',
@@ -147,12 +153,6 @@ describe('PaymentResultView', () => {
resumeToken: 'resume-authoritative',
createdAt: Date.UTC(2099, 0, 1, 0, 0, 0),
}))
pollOrderStatus.mockResolvedValue({
...orderFactory('PENDING'),
amount: 88,
pay_amount: 88,
fee_rate: 0,
})
resolveOrderPublicByResumeToken.mockResolvedValue({
data: {
...orderFactory('PAID'),
@@ -172,7 +172,7 @@ describe('PaymentResultView', () => {
await flushPromises()
expect(pollOrderStatus).toHaveBeenCalledWith(42)
expect(pollOrderStatus).not.toHaveBeenCalled()
expect(resolveOrderPublicByResumeToken).toHaveBeenCalledWith('resume-authoritative')
expect(wrapper.text()).toContain('payment.result.success')
expect(wrapper.text()).toContain('103.00')
@@ -227,7 +227,6 @@ describe('PaymentResultView', () => {
trade_status: 'TRADE_SUCCESS',
}
resolveOrderPublicByResumeToken.mockRejectedValueOnce(new Error('resume failed'))
mount(PaymentResultView, {
global: {
stubs: {
@@ -239,16 +238,19 @@ describe('PaymentResultView', () => {
await flushPromises()
expect(resolveOrderPublicByResumeToken).toHaveBeenCalledWith('resume-fail')
expect(verifyOrder).not.toHaveBeenCalled()
expect(verifyOrderPublic).not.toHaveBeenCalled()
})
it('does not use anonymous out_trade_no verification when no signed resume context is available', async () => {
it('uses public out_trade_no verification when no signed resume context is available', async () => {
routeState.query = {
out_trade_no: 'legacy-123',
trade_status: 'TRADE_SUCCESS',
}
verifyOrderPublic.mockResolvedValue({
data: orderFactory('PAID'),
})
mount(PaymentResultView, {
const wrapper = mount(PaymentResultView, {
global: {
stubs: {
OrderStatusBadge: true,
@@ -258,7 +260,9 @@ describe('PaymentResultView', () => {
await flushPromises()
expect(verifyOrder).not.toHaveBeenCalled()
expect(verifyOrderPublic).toHaveBeenCalledWith('legacy-123')
expect(pollOrderStatus).not.toHaveBeenCalled()
expect(wrapper.text()).toContain('payment.result.success')
})
it('does not use public out_trade_no verification for bare order numbers without legacy return markers', async () => {
@@ -276,7 +280,7 @@ describe('PaymentResultView', () => {
await flushPromises()
expect(verifyOrder).not.toHaveBeenCalled()
expect(verifyOrderPublic).not.toHaveBeenCalled()
})
it('resolves order by resume token when local recovery snapshot is missing', async () => {

37
frontend/src/views/user/__tests__/PaymentView.spec.ts
View File

@@ -117,6 +117,7 @@ function jsapiOrderFixture(resumeToken: string) {
fee_rate: 0,
expires_at: '2099-01-01T00:10:00.000Z',
payment_type: 'wxpay',
out_trade_no: 'sub2_jsapi_123',
result_type: 'jsapi_ready' as const,
resume_token: resumeToken,
jsapi: {
@@ -175,6 +176,7 @@ describe('PaymentView WeChat JSAPI flow', () => {
path: '/payment/result',
query: {
order_id: '123',
out_trade_no: 'sub2_jsapi_123',
resume_token: 'resume-token-123',
},
})
@@ -202,4 +204,39 @@ describe('PaymentView WeChat JSAPI flow', () => {
expect(routerPush).not.toHaveBeenCalled()
expect(window.localStorage.getItem(PAYMENT_RECOVERY_STORAGE_KEY)).toBeNull()
})
it('clears a stale recovery snapshot before handling wechat resume callback params', async () => {
createOrder.mockRejectedValueOnce(new Error('resume failed'))
window.localStorage.setItem(PAYMENT_RECOVERY_STORAGE_KEY, JSON.stringify({
orderId: 999,
amount: 66,
qrCode: 'stale-qr',
expiresAt: '2099-01-01T00:10:00.000Z',
paymentType: 'alipay',
payUrl: 'https://pay.example.com/stale',
outTradeNo: 'stale-out-trade-no',
clientSecret: '',
payAmount: 66,
orderType: 'balance',
paymentMode: 'popup',
resumeToken: '',
createdAt: Date.UTC(2099, 0, 1, 0, 0, 0),
}))
shallowMount(PaymentView, {
global: {
stubs: {
Teleport: true,
Transition: false,
},
},
})
await flushPromises()
await flushPromises()
expect(createOrder).toHaveBeenCalledWith(expect.objectContaining({
wechat_resume_token: 'resume-token-123',
}))
expect(window.localStorage.getItem(PAYMENT_RECOVERY_STORAGE_KEY)).toBeNull()
})
})

10
frontend/src/views/user/paymentWechatResume.ts
View File

@@ -19,12 +19,20 @@ function readQueryString(query: LocationQuery, key: string): string {
return typeof value === 'string' ? value : ''
}
export function hasWechatResumeQuery(query: LocationQuery): boolean {
if (readQueryString(query, 'wechat_resume') === '1') {
return true
}
return readQueryString(query, 'wechat_resume_token') !== ''
|| readQueryString(query, 'openid') !== ''
}
export function parseWechatResumeRoute(
query: LocationQuery,
plans: SubscriptionPlan[],
fallbackBalanceAmount: number,
): ParsedWechatResumeRoute | null {
if (readQueryString(query, 'wechat_resume') !== '1') {
if (!hasWechatResumeQuery(query)) {
return null
}