wanwu/sub2apipay
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
168 Commits 1 Branch 27 Tags
33e4a811f3f1f0771a1b3e3dde843cfbd949a0a4
Commit Graph

5 Commits

Author SHA1 Message Date
erio
ac0772b0f4 fix: API 路由安全加固与架构优化 — 认证、错误处理、Registry 统一 
- /api/user 添加 token 认证，防止用户枚举
- Admin token 支持 Authorization header
- /api/orders/my 区分认证失败和服务端错误
- Admin orders userId/date 参数校验
- Decimal 字段统一 Number() 转换
- 抽取 handleApiError/extractHeaders 工具函数
- Webhook 路由改用 Registry 获取 Provider
- PaymentRegistry lazy init 自动初始化

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-07 04:15:54 +08:00
erio
c41933db70 security: 隐私接口全面加固，统一 token 鉴权 
- /api/orders/[id] 只返回 id/status/expiresAt，移除 user_name/pay_url 等隐私字段
- /api/orders/[id]/cancel 改为 token 鉴权，服务端验证用户身份后执行取消
- /api/orders (POST 响应) 过滤 userName/userBalance，不向客户端暴露
- /api/user 移除 username/email/balance，只返回 id/status 和 config
- /api/users/[id] 只返回 {id, exists}，不暴露任何隐私信息
- pay/page.tsx 恢复从服务端动态获取 config，无 token 时只显示用户 ID
- pay/orders/page.tsx 无 token 时不查询隐私接口，统一按钮样式
- PaymentQRCode 新增 token prop，无 token 时隐藏取消按钮
- 创建订单失败改为中文错误提示
 2026-03-01 19:25:14 +08:00
erio
5a315a8f08 refactor: unify cancel logic with cancelOrderCore and show blocked UI 
- Extract cancelOrderCore() shared by user cancel, admin cancel, and timeout expire
- Query payment platform before cancelling: if already paid, run confirmPayment
- Simplify timeout.ts to delegate to cancelOrderCore
- Cancel API returns already_paid outcome for frontend handling
- Show "订单已支付，无法取消" prompt with back button when cancel is blocked
 2026-03-01 18:44:49 +08:00
erio
d9ab65ecf2 feat: integrate Stripe payment with bugfixes and active timeout cancellation 
- Add Stripe payment provider with Checkout Session flow
- Payment provider abstraction layer (EasyPay + Stripe unified interface)
- Stripe webhook with proper raw body handling and signature verification
- Frontend: Stripe button with URL validation, anti-duplicate click, noopener
- Active timeout cancellation: query platform before expiring, recover paid orders
- Singleton Stripe client, idempotency keys, Math.round for amounts
- Handle async_payment events, return null for unknown webhook events
- Set Checkout Session expires_at aligned with order timeout
- Add cancelPayment to provider interface (Stripe: sessions.expire, EasyPay: no-op)
- Enable stripe in frontend payment type list
 2026-03-01 17:58:08 +08:00
erio
d5719bf213 feat: migrate payment provider to easy-pay, add order history and refund support 
- Replace zpay with easy-pay payment provider (new lib/easy-pay/ module)
- Add order history page for users (pay/orders)
- Add GET /api/orders/my endpoint to list user's own orders
- Add GET /api/users/[id] endpoint for sub2api user lookup
- Add order status tracking module (lib/order/status.ts)
- Update config to support easy-pay credentials (merchant ID, key, gateway)
- Update PaymentForm and PaymentQRCode components for easy-pay flow
- Update pay page and admin page with new order management UI
- Update order service to support easy-pay, cancellation, and refund
 2026-03-01 03:04:24 +08:00