fix version 1

module/ec/order/internal/logic/summary/submit.go

@@ -3,7 +3,7 @@ package summary
 import (
 	"context"
 	"errors"
-	"log"
+	"strconv"
 	"strings"
 	"time"
 
@@ -33,12 +33,11 @@ func Submit(ctx context.Context, in *pb.SubmitRequest) (reply *pb.OrderStatusRep
 	}
 
 	var (
-		cart         = make([]*models.OrderCart, 0)
-		details      = make([]*models.OrderDetails, 0)
-		summary      = make([]*models.OrderSummary, 0)
-		keys         = make([]string, 0)
-		address      = models.OrderAddress{}
-		StoreId uint = 0
+		cart    = make([]*models.OrderCart, 0)
+		details = make([]*models.OrderDetails, 0)
+		summary = make([]*models.OrderSummary, 0)
+		keys    = make([]string, 0)
+		address = models.OrderAddress{}
 	)
 
 	// 获取购物车内数据信息
@@ -51,6 +50,26 @@ func Submit(ctx context.Context, in *pb.SubmitRequest) (reply *pb.OrderStatusRep
 		return nil, errcode.ErrDB
 	}
 
+	// 只处理请求中选中的购物车条目；未指定 id 时按整车处理，兼容旧调用方。
+	if ids := in.GetId(); len(ids) > 0 {
+		wanted := make(map[uint]struct{}, len(ids))
+		for _, id := range ids {
+			if v, e := strconv.ParseUint(id, 10, 64); e == nil {
+				wanted[uint(v)] = struct{}{}
+			}
+		}
+		selected := make([]*models.OrderCart, 0, len(ids))
+		for _, item := range cart {
+			if _, ok := wanted[item.ID]; ok {
+				selected = append(selected, item)
+			}
+		}
+		cart = selected
+	}
+	if len(cart) == 0 {
+		return nil, errcode.ErrInvalidArgument
+	}
+
 	// 获取地址信息
 	if in.GetAddress() != nil {
 		address = models.OrderAddress{
@@ -65,21 +84,25 @@ func Submit(ctx context.Context, in *pb.SubmitRequest) (reply *pb.OrderStatusRep
 			ZipCode:  in.Address.ZipCode,
 		}
 	} else {
-		err = impl.DBService.Table("address_library").Where("identity = ?", in.AddressIdentity).Find(&address).Error
+		// 地址库按归属过滤：仅允许使用属于当前登录者的收货地址，避免盗用他人地址下单。
+		err = impl.DBService.Table("address_library").
+			Where("identity = ? and owner_identity = ?", in.AddressIdentity, auth.Identity).
+			Take(&address).Error
 		if err != nil {
 			printer.Error(err.Error())
 			if errors.Is(err, models.ErrNotFound) {
-				return nil, errcode.ErrRecordNotFound
+				return nil, errcode.ErrPermissionDenied
 			}
 			return nil, errcode.ErrDB
 		}
 	}
 
-	// 按店铺分组购物车商品
+	// 按店铺分组购物车商品，并记录每个店铺对应的 store_id。
 	storeGroups := make(map[string][]*models.OrderCart)
-	for k, item := range cart {
+	storeIDs := make(map[string]uint)
+	for _, item := range cart {
 		product := models.Product{}
-		err = impl.DBService.Select("store_identity").Table("mall_product").Where("id = ?", item.ProductID).First(&product).Error
+		err = impl.DBService.Select("store_id,store_identity").Table("mall_product").Where("id = ?", item.ProductID).First(&product).Error
 		if err != nil {
 			printer.Error(err.Error())
 			if errors.Is(err, models.ErrNotFound) {
@@ -88,9 +111,7 @@ func Submit(ctx context.Context, in *pb.SubmitRequest) (reply *pb.OrderStatusRep
 			return nil, errcode.ErrDB
 		}
 
-		if k == 0 {
-			StoreId = product.StoreId
-		}
+		storeIDs[product.StoreIdentity] = product.StoreId
 		storeGroups[product.StoreIdentity] = append(storeGroups[product.StoreIdentity], item)
 	}
 
@@ -163,7 +184,7 @@ func Submit(ctx context.Context, in *pb.SubmitRequest) (reply *pb.OrderStatusRep
 			PartnerID:       in.PartnerId,
 			TransPrice:      storeTotal,
 			TotalPrice:      storeTotal,
-			StoreID:         StoreId,
+			StoreID:         storeIDs[StoreIdentity],
 			StoreIdentity:   StoreIdentity,
 			LogisticsFee:    0,
 			Remark:          "",
@@ -197,28 +218,29 @@ func Submit(ctx context.Context, in *pb.SubmitRequest) (reply *pb.OrderStatusRep
 			return err
 		}
 
-		// 3. 扣减库存
+		// 3. 扣减库存：按规格做原子条件更新，影响行数为 0 即视为库存不足并回滚整个下单事务，避免超卖。
 		for _, detail := range details {
 			if detail.Number > 0 {
-				var stock int32
-				result := tx.Table("mall_product_spec").Select("stock").Where("id = ?", detail.SpecID).Scan(&stock)
-				if result.Error != nil || stock < detail.Number {
-					log.Printf("Insufficient stock or spec does not exist: %v", result.Error)
-					return errors.New("库存不足或规格不存在")
-				}
-				updateErr := tx.Table("mall_product_spec").
+				result := tx.Table("mall_product_spec").
 					Where("id = ? AND stock >= ?", detail.SpecID, detail.Number).
-					UpdateColumn("stock", gorm.Expr("stock - ?", detail.Number)).
-					Error
-				if updateErr != nil {
-					printer.Error(updateErr.Error())
-					return updateErr
+					UpdateColumn("stock", gorm.Expr("stock - ?", detail.Number))
+				if result.Error != nil {
+					printer.Error(result.Error.Error())
+					return result.Error
+				}
+				if result.RowsAffected == 0 {
+					printer.Error("库存不足或规格不存在")
+					return errors.New("库存不足或规格不存在")
 				}
 			}
 		}
 
-		// 4. 清空购物车
-		if err := tx.Where("passport_identity = ?", auth.Identity).
+		// 4. 只删除本次已下单的购物车条目，保留用户未结算的其它条目。
+		cartIDs := make([]uint, 0, len(cart))
+		for _, item := range cart {
+			cartIDs = append(cartIDs, item.ID)
+		}
+		if err := tx.Where("id in ?", cartIDs).
 			Delete(&models.OrderCart{}).Error; err != nil {
 			printer.Error(err.Error())
 			return err