已完成用户APP首期功能开发

交付用户端首期页面、配套接口、后台资源及测试文档。用户APP构建、静态分析和三个管理后台构建通过；完整测试仍有2项失败，后端模型注释检查未通过，详见交付记录。

backend/api/internal/logic/common/wallet_bills_test.go

@@ -0,0 +1,64 @@
+// 功能描述：账单归属、分页、筛选和白名单测试；版本：1.0.0。
+package common
+
+import (
+	"fmt"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
+	"github.com/DATA-DOG/go-sqlmock"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+)
+
+// TestWalletBillsScopedPagination 将伪造归属参数与正常游标一起传入，SQL必须保持本人范围。
+func TestWalletBillsScopedPagination(t *testing.T) {
+	connection, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer connection.Close()
+	db, err := gorm.Open(postgres.New(postgres.Config{Conn: connection}), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	old := impl.DBService
+	impl.DBService = db
+	defer func() { impl.DBService = old }()
+	mock.ExpectQuery(`SELECT .* FROM "user_account".*identity = \$1 AND status = \$2`).WithArgs("alice", 1, 1).
+		WillReturnRows(sqlmock.NewRows([]string{"id", "identity", "phone"}).AddRow(7, "alice", "13800000001"))
+	mock.ExpectQuery(`SELECT .* FROM "wallet_basic".*owner_type = \$1 AND owner_identity = \$2`).WithArgs("user", "alice", 1).
+		WillReturnRows(sqlmock.NewRows([]string{"id", "identity"}).AddRow(9, "wallet"))
+	rows := sqlmock.NewRows([]string{"id", "identity", "created_at", "amount", "direction", "operator_identity", "request_no"})
+	for i := 99; i >= 49; i-- {
+		rows.AddRow(i, fmt.Sprint(i), time.Now(), 100, "in", "PRIVATE-OPERATOR", "PRIVATE-REQUEST")
+	}
+	mock.ExpectQuery(`SELECT .* FROM "wallet_record" WHERE wallet_basic_id = \$1 AND direction IN \(\$2,\$3\) AND id < \$4 AND "wallet_record"."deleted_at" IS NULL ORDER BY id desc LIMIT \$5`).
+		WithArgs(9, "income", "in", 100, 51).WillReturnRows(rows)
+	ctx, response := paymentTestContext("")
+	ctx.Request = httptest.NewRequest("GET", "/wallet/bills?direction=income&cursor=100&owner_identity=victim", nil)
+	ListWalletBills("user_app")(ctx)
+	body := response.Body.String()
+	if !strings.Contains(body, `"next_cursor":"50"`) || strings.Contains(body, "PRIVATE") || strings.Contains(body, `"identity":"49"`) || !strings.Contains(body, `"direction":"income"`) {
+		t.Fatal(body)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// TestWalletBillsInvalidFilter 无效参数在访问账户前拒绝，不放宽为全量查询。
+func TestWalletBillsInvalidFilter(t *testing.T) {
+	for _, query := range []string{"direction=other", "cursor=-1", "cursor=0", "cursor=x"} {
+		ctx, response := paymentTestContext("")
+		ctx.Request = httptest.NewRequest("GET", "/wallet/bills?"+query, nil)
+		ListWalletBills("user_app")(ctx)
+		if strings.Contains(response.Body.String(), `"code":0`) {
+			t.Fatal("错误接受无效筛选")
+		}
+	}
+}