fix(wallet): enforce consistent withdrawal accounting

backend/api/internal/logic/common/client_security_test.go

@@ -0,0 +1,43 @@
+package common
+
+import (
+	"testing"
+
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/config"
+)
+
+func TestClientValidPhone(t *testing.T) {
+	tests := map[string]bool{
+		"13800138000":  true,
+		"12800138000":  false,
+		"1380013800":   false,
+		"138001380000": false,
+		"":             false,
+	}
+	for phone, want := range tests {
+		if got := ValidPhone(phone); got != want {
+			t.Errorf("ValidPhone(%q) = %v, want %v", phone, got, want)
+		}
+	}
+}
+
+func TestProtectFieldUsesRandomCiphertextAndStableFingerprint(t *testing.T) {
+	original := config.Spec.Global.FieldEncryptionKey
+	config.Spec.Global.FieldEncryptionKey = "0123456789abcdef0123456789abcdef"
+	t.Cleanup(func() { config.Spec.Global.FieldEncryptionKey = original })
+
+	firstCipher, firstFingerprint, err := protectField("6222021234567890")
+	if err != nil {
+		t.Fatal(err)
+	}
+	secondCipher, secondFingerprint, err := protectField("6222021234567890")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if firstCipher == secondCipher {
+		t.Fatal("AES-GCM ciphertext must use a fresh nonce")
+	}
+	if firstFingerprint != secondFingerprint {
+		t.Fatal("the same card number must have a stable HMAC fingerprint")
+	}
+}