fix version 1

module/ec/order/internal/logic/summary/simulate_pay.go

@@ -9,9 +9,11 @@ import (
 	"bsm/full/module/ec/order/internal/models"
 	pb "bsm/full/module/ec/order/pb"
 
+	"git.apinb.com/bsm-sdk/core/env"
 	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/printer"
 	"git.apinb.com/bsm-sdk/core/service"
+	"gorm.io/gorm"
 )
 
 // 模拟支付
@@ -22,7 +24,20 @@ func SimulatePay(ctx context.Context, in *pb.SimulatePayRequest) (reply *pb.Orde
 		return nil, err
 	}
 
-	err = impl.DBService.Model(&models.OrderSummary{}).Where("identity in ?", in.Identity).Updates(models.OrderSummary{Status: 2, PayTime: time.Now(), PayType: 4, PayRemark: "支付备注", PayTradeNo: "Pay12371937812897", PayAmount: 10000000}).Error
+	// 模拟接口仅允许在 dev 模式使用，其它模式默认关闭，避免生产环境被用于伪造支付、推进订单状态。
+	if env.Runtime == nil || env.Runtime.Mode != "dev" {
+		return nil, errcode.ErrPermissionDenied
+	}
+
+	// 支付金额取订单实际应付金额，交易号与备注从环境变量读取，避免硬编码的固定金额导致账实不符。
+	err = impl.DBService.Model(&models.OrderSummary{}).Where("identity in ?", in.Identity).Updates(map[string]any{
+		"status":       2,
+		"pay_time":     time.Now(),
+		"pay_type":     4,
+		"pay_trade_no": env.GetEnvDefault("BSM_SimulatePayTradeNo", "SIMULATE"),
+		"pay_remark":   env.GetEnvDefault("BSM_SimulatePayRemark", "模拟支付"),
+		"pay_amount":   gorm.Expr("trans_price"),
+	}).Error
 	if err != nil {
 		printer.Error(err.Error())
 		if errors.Is(err, models.ErrNotFound) {