erio
c738cfec93
fix(payment): critical audit fixes for security, idempotency and correctness
...
Backend fixes:
- #1 : doSub subscription idempotency via audit log check
- #2 : markFailed only when status=RECHARGING (prevents overwriting COMPLETED)
- #3 : ExpireTimedOutOrders checks upstream payment before expiring
- #4 : Public verify endpoint for payment result page (no auth required)
- #5 : EasyPay QueryOrder returns amount, confirmPayment handles zero amount
- #6 : WxPay notifyUrl priority: request-first, config-fallback
- #7 : EasyPay remove double URL decode in VerifyNotification
- #8 : checkPaid/cancelUpstreamPayment use order's provider instance
- #9 : Amount NaN/Inf/negative validation in order creation and refund
- #10 : Refund amount comparison uses tolerance instead of float64 ==
- #11 : Skip balance deduction on retry when previous rollback failed
- #12 : checkPaid logs fulfillment errors instead of silently ignoring
- #13 : WxPay certSerial added to required config fields
Frontend fixes:
- Payment result page no longer requires authentication
- Public verify API fallback for expired sessions
2026-04-14 09:19:33 +08:00
erio
56e4a9a914
fix: audit fixes - magic strings to constants, frontend any/catch, LB tests
...
Backend:
- Define OrderTypeBalance/Subscription, EntityStatusActive, DeductionType*,
NotificationStatus* constants in payment/types.go
- Replace all magic strings in payment_order, payment_fulfillment, payment_refund
- Add local constants in easypay.go (tradeStatusSuccess, signTypeMD5)
- Add 27 unit tests for load balancer (filterByLimits, pickLeastAmount,
getInstanceChannelLimits, startOfDay)
Frontend:
- Remove all `any` types in SettingsView.vue (18 catch blocks + 1 payload)
- Fix bare catch blocks in PaymentResultView, PaymentView
- Add `unknown` type annotation to all catch blocks
chore: bump version to 0.1.108.140
2026-04-14 09:18:58 +08:00
erio
7515590324
feat(payment): add H5/mobile payment support
...
Backend:
- Parse EasyPay `payurl2` field, prefer H5 link on mobile
- Add `device=mobile` to EasyPay submit.php (popup) mode
- Expand isMobile detection keywords (add ipad/ipod)
Frontend:
- Add `isMobileDevice()` utility (userAgentData + UA regex)
- Mobile + pay_url: direct redirect instead of QR/popup
- Popup blocked fallback: auto-redirect when window.open fails
- Stripe WeChat Pay: dynamic client param (mobile_web vs web)
2026-04-11 13:16:35 +08:00
erio
e3a000e0d4
refactor(payment): code standards fixes and regression repairs
...
Backend:
- Split payment_order.go (546→314 lines) into payment_order_lifecycle.go
- Replace magic strings with constants in factory, easypay, webhook handler
- Add rate limit/validity unit constants in payment_order_lifecycle, payment_service
- Fix critical regression: add PaymentEnabled to GetPublicSettings response
- Add missing migration 099_fix_migrated_purchase_menu_label_icon.sql
Frontend:
- Fix StripePopupView.vue: replace `as any` with typed interface, use extractApiErrorMessage
- Fix AdminOrderTable.vue: replace hardcoded column labels with i18n t() calls
- Fix SubscriptionsView.vue: replace hardcoded Today/Tomorrow with i18n
- Extract duplicate statusBadgeClass/canRefund/formatOrderDateTime to orderUtils.ts
- Add missing i18n keys: common.today, common.tomorrow, payment.orders.orderType/actions
- Remove dead PurchaseSubscriptionView.vue (replaced by PaymentView)
2026-04-11 13:16:35 +08:00
erio
63d1860dc0
feat(payment): add complete payment system with multi-provider support
...
Add a full payment and subscription system supporting EasyPay (Alipay/WeChat),
Stripe, and direct Alipay/WeChat Pay providers with multi-instance load balancing.
2026-04-11 13:16:35 +08:00
