- H1: 支付宝响应验签 (verifyResponseSign + bracket-matching 提取签名内容) - H2/H3: EasyPay queryOrder 从 GET 改 POST,PKEY 不再暴露于 URL - H5: users/[id] IDOR 修复,校验当前用户只能查询自身信息 - H6: 限额校验移入 prisma.$transaction() 防止 TOCTOU 竞态 - C1: access_token 增加 24h 过期、userId 绑定、派生密钥分离 - M1: EasyPay 回调增加 pid 校验防跨商户注入 - M4: 充值码增加 crypto.randomBytes 随机后缀 - M5: 过期订单批量处理增加 BATCH_SIZE 限制 - M6: 退款失败增加 [CRITICAL] 日志和余额补偿标记 - M7: admin channels PUT 增加 Zod schema 校验 - M8: admin subscriptions 分页参数增加上限 - M9: orders src_url 限制 HTTP/HTTPS 协议 - L1: 微信支付回调时间戳 NaN 检查 - L9: WXPAY_API_V3_KEY 长度校验
75 lines
1.8 KiB
TypeScript
75 lines
1.8 KiB
TypeScript
import { prisma } from '@/lib/db';
|
|
import { ORDER_STATUS } from '@/lib/constants';
|
|
import { cancelOrderCore } from './service';
|
|
|
|
const INTERVAL_MS = 30_000; // 30 seconds
|
|
const BATCH_SIZE = 50;
|
|
let timer: ReturnType<typeof setInterval> | null = null;
|
|
|
|
export async function expireOrders(): Promise<number> {
|
|
// 查询到期订单(限制批次大小防止内存爆炸)
|
|
// cancelOrderCore 内部 WHERE status='PENDING' 的 CAS 保证多实例不会重复处理同一订单
|
|
const orders = await prisma.order.findMany({
|
|
where: {
|
|
status: ORDER_STATUS.PENDING,
|
|
expiresAt: { lt: new Date() },
|
|
},
|
|
select: {
|
|
id: true,
|
|
paymentTradeNo: true,
|
|
paymentType: true,
|
|
},
|
|
take: BATCH_SIZE,
|
|
orderBy: { expiresAt: 'asc' },
|
|
});
|
|
|
|
if (orders.length === 0) return 0;
|
|
|
|
let expiredCount = 0;
|
|
|
|
for (const order of orders) {
|
|
try {
|
|
const outcome = await cancelOrderCore({
|
|
orderId: order.id,
|
|
paymentTradeNo: order.paymentTradeNo,
|
|
paymentType: order.paymentType,
|
|
finalStatus: ORDER_STATUS.EXPIRED,
|
|
operator: 'timeout',
|
|
auditDetail: 'Order expired',
|
|
});
|
|
|
|
if (outcome === 'cancelled') expiredCount++;
|
|
} catch (err) {
|
|
console.error(`Error expiring order ${order.id}:`, err);
|
|
}
|
|
}
|
|
|
|
if (expiredCount > 0) {
|
|
console.log(`Expired ${expiredCount} orders`);
|
|
}
|
|
|
|
return expiredCount;
|
|
}
|
|
|
|
export function startTimeoutScheduler(): void {
|
|
if (timer) return;
|
|
|
|
// Run immediately on startup
|
|
expireOrders().catch(console.error);
|
|
|
|
// Then run every 30 seconds
|
|
timer = setInterval(() => {
|
|
expireOrders().catch(console.error);
|
|
}, INTERVAL_MS);
|
|
|
|
console.log('Order timeout scheduler started');
|
|
}
|
|
|
|
export function stopTimeoutScheduler(): void {
|
|
if (timer) {
|
|
clearInterval(timer);
|
|
timer = null;
|
|
console.log('Order timeout scheduler stopped');
|
|
}
|
|
}
|