Files
sub2apipay/src/lib/order/timeout.ts
erio 4ce3484179 fix: 全面安全审计修复 — 支付验签、IDOR、竞态、token过期等
- H1: 支付宝响应验签 (verifyResponseSign + bracket-matching 提取签名内容)
- H2/H3: EasyPay queryOrder 从 GET 改 POST,PKEY 不再暴露于 URL
- H5: users/[id] IDOR 修复,校验当前用户只能查询自身信息
- H6: 限额校验移入 prisma.$transaction() 防止 TOCTOU 竞态
- C1: access_token 增加 24h 过期、userId 绑定、派生密钥分离
- M1: EasyPay 回调增加 pid 校验防跨商户注入
- M4: 充值码增加 crypto.randomBytes 随机后缀
- M5: 过期订单批量处理增加 BATCH_SIZE 限制
- M6: 退款失败增加 [CRITICAL] 日志和余额补偿标记
- M7: admin channels PUT 增加 Zod schema 校验
- M8: admin subscriptions 分页参数增加上限
- M9: orders src_url 限制 HTTP/HTTPS 协议
- L1: 微信支付回调时间戳 NaN 检查
- L9: WXPAY_API_V3_KEY 长度校验
2026-03-14 04:36:33 +08:00

75 lines
1.8 KiB
TypeScript

import { prisma } from '@/lib/db';
import { ORDER_STATUS } from '@/lib/constants';
import { cancelOrderCore } from './service';
const INTERVAL_MS = 30_000; // 30 seconds
const BATCH_SIZE = 50;
let timer: ReturnType<typeof setInterval> | null = null;
export async function expireOrders(): Promise<number> {
// 查询到期订单(限制批次大小防止内存爆炸)
// cancelOrderCore 内部 WHERE status='PENDING' 的 CAS 保证多实例不会重复处理同一订单
const orders = await prisma.order.findMany({
where: {
status: ORDER_STATUS.PENDING,
expiresAt: { lt: new Date() },
},
select: {
id: true,
paymentTradeNo: true,
paymentType: true,
},
take: BATCH_SIZE,
orderBy: { expiresAt: 'asc' },
});
if (orders.length === 0) return 0;
let expiredCount = 0;
for (const order of orders) {
try {
const outcome = await cancelOrderCore({
orderId: order.id,
paymentTradeNo: order.paymentTradeNo,
paymentType: order.paymentType,
finalStatus: ORDER_STATUS.EXPIRED,
operator: 'timeout',
auditDetail: 'Order expired',
});
if (outcome === 'cancelled') expiredCount++;
} catch (err) {
console.error(`Error expiring order ${order.id}:`, err);
}
}
if (expiredCount > 0) {
console.log(`Expired ${expiredCount} orders`);
}
return expiredCount;
}
export function startTimeoutScheduler(): void {
if (timer) return;
// Run immediately on startup
expireOrders().catch(console.error);
// Then run every 30 seconds
timer = setInterval(() => {
expireOrders().catch(console.error);
}, INTERVAL_MS);
console.log('Order timeout scheduler started');
}
export function stopTimeoutScheduler(): void {
if (timer) {
clearInterval(timer);
timer = null;
console.log('Order timeout scheduler stopped');
}
}