feat(api): add client app service endpoints
This commit is contained in:
david
143
backend/api/internal/logic/client/common/auth.go
Normal file
143
backend/api/internal/logic/client/common/auth.go
Normal file
@@ -0,0 +1,143 @@
|
||||
// Package common 提供两个客户端共用的鉴权、验证码和账户范围能力。
|
||||
package common
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"regexp"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"git.apinb.com/bsm-sdk/core/crypto/token"
|
||||
"git.apinb.com/bsm-sdk/core/env"
|
||||
"git.apinb.com/bsm-sdk/core/errcode"
|
||||
"git.apinb.com/bsm-sdk/core/infra"
|
||||
sdkmiddleware "git.apinb.com/bsm-sdk/core/middleware"
|
||||
"git.apinb.com/heqiapp/platforms/backend/api/internal/config"
|
||||
"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
|
||||
"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
var phonePattern = regexp.MustCompile(`^1[3-9]\d{9}$`)
|
||||
|
||||
var verificationPurposes = map[string]struct{}{
|
||||
"login": {}, "register": {}, "reset_login_password": {}, "set_payment_password": {},
|
||||
"reset_payment_password": {}, "bind_bank": {}, "unbind_bank": {},
|
||||
}
|
||||
|
||||
type verificationValue struct {
|
||||
Code string `json:"code"`
|
||||
Phone string `json:"phone"`
|
||||
Purpose string `json:"purpose"`
|
||||
Client string `json:"client"`
|
||||
}
|
||||
|
||||
// ValidPhone 判断手机号是否符合中国大陆手机号格式。
|
||||
func ValidPhone(phone string) bool { return phonePattern.MatchString(strings.TrimSpace(phone)) }
|
||||
|
||||
// SendVerificationCode 创建一次性验证码。Mock 模式的验证码只保存在 Redis，不返回给客户端。
|
||||
func SendVerificationCode(client string) gin.HandlerFunc {
|
||||
return func(ctx *gin.Context) {
|
||||
var request struct {
|
||||
Phone string `json:"phone" binding:"required"`
|
||||
Purpose string `json:"purpose" binding:"required"`
|
||||
}
|
||||
if ctx.ShouldBindJSON(&request) != nil || !ValidPhone(request.Phone) {
|
||||
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
||||
return
|
||||
}
|
||||
if _, ok := verificationPurposes[request.Purpose]; !ok {
|
||||
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
||||
return
|
||||
}
|
||||
phone := strings.TrimSpace(request.Phone)
|
||||
throttleKey := impl.RedisService.BuildKey("client-verification-throttle", client, phone)
|
||||
var sent bool
|
||||
if impl.RedisService.Get(throttleKey, &sent) == nil && sent {
|
||||
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
||||
return
|
||||
}
|
||||
requestIdentity := models.NewIdentity()
|
||||
value := verificationValue{Code: config.Spec.Global.MockVerificationCode, Phone: phone, Purpose: request.Purpose, Client: client}
|
||||
ttl := time.Duration(config.Spec.Global.VerificationTTLSeconds) * time.Second
|
||||
if err := impl.RedisService.Set(verificationKey(requestIdentity), value, ttl); err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
_ = impl.RedisService.Set(throttleKey, true, time.Duration(config.Spec.Global.VerificationSendIntervalSeconds)*time.Second)
|
||||
infra.Response.Success(ctx, gin.H{"request_identity": requestIdentity, "expires_in": config.Spec.Global.VerificationTTLSeconds})
|
||||
}
|
||||
}
|
||||
|
||||
// VerifyCode 校验并消费验证码。
|
||||
func VerifyCode(client, phone, purpose, requestIdentity, code string) bool {
|
||||
if !config.Spec.Global.MockVerificationEnabled || requestIdentity == "" || code == "" {
|
||||
return false
|
||||
}
|
||||
key := verificationKey(requestIdentity)
|
||||
var value verificationValue
|
||||
if impl.RedisService.Get(key, &value) != nil {
|
||||
return false
|
||||
}
|
||||
if value.Client != client || value.Phone != strings.TrimSpace(phone) || value.Purpose != purpose || value.Code != code {
|
||||
return false
|
||||
}
|
||||
return impl.RedisService.Delete(key) == nil
|
||||
}
|
||||
|
||||
func verificationKey(identity string) string {
|
||||
return impl.RedisService.BuildKey("client-verification", identity)
|
||||
}
|
||||
|
||||
// IssueToken 签发严格区分 user_app 和 service_app 的 JWT。
|
||||
func IssueToken(identity, client, role string, extend map[string]string) (string, error) {
|
||||
return token.New(env.Runtime.JwtSecretKey).GenerateJwt(0, identity, client, role, nil, extend)
|
||||
}
|
||||
|
||||
// RequireClient 验证客户端种类，阻止后台令牌跨端调用。
|
||||
func RequireClient(client string) gin.HandlerFunc {
|
||||
return func(ctx *gin.Context) {
|
||||
claims, err := sdkmiddleware.ParseAuth(ctx)
|
||||
if err != nil || claims.Client != client {
|
||||
infra.Response.Error(ctx, errcode.ErrPermissionDenied)
|
||||
ctx.Abort()
|
||||
return
|
||||
}
|
||||
ctx.Next()
|
||||
}
|
||||
}
|
||||
|
||||
// UserAccount 返回当前启用的用户账户。
|
||||
func UserAccount(ctx *gin.Context) (models.UserAccount, bool) {
|
||||
claims, err := sdkmiddleware.ParseAuth(ctx)
|
||||
if err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return models.UserAccount{}, false
|
||||
}
|
||||
var account models.UserAccount
|
||||
if impl.DBService.Where("identity = ? AND status = ?", claims.Identity, 1).First(&account).Error != nil {
|
||||
infra.Response.Error(ctx, errcode.ErrPermissionDenied)
|
||||
return models.UserAccount{}, false
|
||||
}
|
||||
return account, true
|
||||
}
|
||||
|
||||
// StaffAccount 返回当前启用的工作人员账户。
|
||||
func StaffAccount(ctx *gin.Context) (models.StaffAccount, bool) {
|
||||
claims, err := sdkmiddleware.ParseAuth(ctx)
|
||||
if err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return models.StaffAccount{}, false
|
||||
}
|
||||
var account models.StaffAccount
|
||||
if impl.DBService.Where("identity = ? AND status = ?", claims.Identity, 1).First(&account).Error != nil {
|
||||
infra.Response.Error(ctx, errcode.ErrPermissionDenied)
|
||||
return models.StaffAccount{}, false
|
||||
}
|
||||
return account, true
|
||||
}
|
||||
|
||||
// RecordNo 生成便于检索的业务流水号。
|
||||
func RecordNo(prefix string) string {
|
||||
return fmt.Sprintf("%s%d", prefix, time.Now().UnixNano())
|
||||
}
|
||||
43
backend/api/internal/logic/client/common/security_test.go
Normal file
43
backend/api/internal/logic/client/common/security_test.go
Normal file
@@ -0,0 +1,43 @@
|
||||
package common
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"git.apinb.com/heqiapp/platforms/backend/api/internal/config"
|
||||
)
|
||||
|
||||
func TestValidPhone(t *testing.T) {
|
||||
tests := map[string]bool{
|
||||
"13800138000": true,
|
||||
"12800138000": false,
|
||||
"1380013800": false,
|
||||
"138001380000": false,
|
||||
"": false,
|
||||
}
|
||||
for phone, want := range tests {
|
||||
if got := ValidPhone(phone); got != want {
|
||||
t.Errorf("ValidPhone(%q) = %v, want %v", phone, got, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestProtectFieldUsesRandomCiphertextAndStableFingerprint(t *testing.T) {
|
||||
original := config.Spec.Global.FieldEncryptionKey
|
||||
config.Spec.Global.FieldEncryptionKey = "0123456789abcdef0123456789abcdef"
|
||||
t.Cleanup(func() { config.Spec.Global.FieldEncryptionKey = original })
|
||||
|
||||
firstCipher, firstFingerprint, err := protectField("6222021234567890")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
secondCipher, secondFingerprint, err := protectField("6222021234567890")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if firstCipher == secondCipher {
|
||||
t.Fatal("AES-GCM ciphertext must use a fresh nonce")
|
||||
}
|
||||
if firstFingerprint != secondFingerprint {
|
||||
t.Fatal("the same card number must have a stable HMAC fingerprint")
|
||||
}
|
||||
}
|
||||
476
backend/api/internal/logic/client/common/wallet.go
Normal file
476
backend/api/internal/logic/client/common/wallet.go
Normal file
@@ -0,0 +1,476 @@
|
||||
package common
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"crypto/hmac"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"encoding/base64"
|
||||
"encoding/hex"
|
||||
"io"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"git.apinb.com/bsm-sdk/core/errcode"
|
||||
"git.apinb.com/bsm-sdk/core/infra"
|
||||
"git.apinb.com/heqiapp/platforms/backend/api/internal/config"
|
||||
"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
|
||||
base "git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
|
||||
"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
|
||||
"github.com/gin-gonic/gin"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
"golang.org/x/crypto/hkdf"
|
||||
"gorm.io/gorm"
|
||||
"gorm.io/gorm/clause"
|
||||
)
|
||||
|
||||
type walletOwner struct {
|
||||
Type, Identity, Phone string
|
||||
ID uint64
|
||||
}
|
||||
|
||||
func currentOwner(ctx *gin.Context, client string) (walletOwner, bool) {
|
||||
if client == "user_app" {
|
||||
account, ok := UserAccount(ctx)
|
||||
return walletOwner{Type: "user", Identity: account.Identity, Phone: account.Phone, ID: account.ID}, ok
|
||||
}
|
||||
account, ok := StaffAccount(ctx)
|
||||
return walletOwner{Type: "staff", Identity: account.Identity, Phone: account.Phone, ID: account.ID}, ok
|
||||
}
|
||||
|
||||
func ensureWallet(tx *gorm.DB, owner walletOwner) (models.WalletBasic, error) {
|
||||
var wallet models.WalletBasic
|
||||
err := tx.Where("owner_type = ? AND owner_identity = ?", owner.Type, owner.Identity).First(&wallet).Error
|
||||
if err == nil {
|
||||
return wallet, nil
|
||||
}
|
||||
if err != gorm.ErrRecordNotFound {
|
||||
return wallet, err
|
||||
}
|
||||
wallet = models.WalletBasic{
|
||||
Entity: base.NewEntity(base.StatusEnable), OwnerType: owner.Type, OwnerID: owner.ID, OwnerIdentity: owner.Identity,
|
||||
}
|
||||
if err := tx.Create(&wallet).Error; err != nil {
|
||||
return wallet, err
|
||||
}
|
||||
return wallet, nil
|
||||
}
|
||||
|
||||
// GetWallet 延迟创建并返回当前主体钱包。
|
||||
func GetWallet(client string) gin.HandlerFunc {
|
||||
return func(ctx *gin.Context) {
|
||||
owner, ok := currentOwner(ctx, client)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
wallet, err := ensureWallet(impl.DBService, owner)
|
||||
if err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
infra.Response.Success(ctx, gin.H{
|
||||
"identity": wallet.Identity, "balance": wallet.Balance,
|
||||
"withdrawal_balance": wallet.WithdrawalBalance, "payment_password_set": wallet.PayPasswordHash != "",
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// SetPaymentPassword 设置或重置六位数字支付密码。
|
||||
func SetPaymentPassword(client string) gin.HandlerFunc {
|
||||
return func(ctx *gin.Context) {
|
||||
owner, ok := currentOwner(ctx, client)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
var request struct {
|
||||
NewPassword string `json:"new_password" binding:"required,len=6,numeric"`
|
||||
CurrentPassword string `json:"current_password"`
|
||||
Code string `json:"code"`
|
||||
RequestIdentity string `json:"request_identity"`
|
||||
}
|
||||
if ctx.ShouldBindJSON(&request) != nil {
|
||||
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
||||
return
|
||||
}
|
||||
wallet, err := ensureWallet(impl.DBService, owner)
|
||||
if err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
valid := wallet.PayPasswordHash == "" && VerifyCode(client, owner.Phone, "set_payment_password", request.RequestIdentity, request.Code)
|
||||
if wallet.PayPasswordHash != "" {
|
||||
valid = bcrypt.CompareHashAndPassword([]byte(wallet.PayPasswordHash), []byte(request.CurrentPassword)) == nil ||
|
||||
VerifyCode(client, owner.Phone, "reset_payment_password", request.RequestIdentity, request.Code)
|
||||
}
|
||||
if !valid {
|
||||
infra.Response.Error(ctx, errcode.ErrPassword)
|
||||
return
|
||||
}
|
||||
hash, _ := bcrypt.GenerateFromPassword([]byte(request.NewPassword), bcrypt.DefaultCost)
|
||||
if err := impl.DBService.Model(&wallet).Update("pay_password_hash", string(hash)).Error; err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
infra.Response.Success(ctx, gin.H{"changed": true})
|
||||
}
|
||||
}
|
||||
|
||||
// CreateRecharge 创建待支付充值订单，不直接增加余额。
|
||||
func CreateRecharge(client string) gin.HandlerFunc {
|
||||
return func(ctx *gin.Context) {
|
||||
owner, ok := currentOwner(ctx, client)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
var request struct {
|
||||
Amount int64 `json:"amount" binding:"required,gt=0"`
|
||||
Channel string `json:"channel" binding:"required,oneof=mock wechat alipay"`
|
||||
RequestNo string `json:"request_no" binding:"required"`
|
||||
}
|
||||
if ctx.ShouldBindJSON(&request) != nil || request.Amount > config.Spec.Global.ManualRechargeMaxAmount ||
|
||||
(request.Channel == "mock" && !config.Spec.Global.MockPaymentEnabled) {
|
||||
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
||||
return
|
||||
}
|
||||
wallet, err := ensureWallet(impl.DBService, owner)
|
||||
if err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
order := models.WalletRechargeOrder{
|
||||
Entity: base.NewEntity(base.StatusEnable), RechargeStatus: 10, WalletBasicID: wallet.ID,
|
||||
RechargeNo: RecordNo("RC"), RequestNo: request.RequestNo, Amount: request.Amount,
|
||||
Channel: request.Channel, OwnerType: owner.Type, OwnerIdentity: owner.Identity,
|
||||
}
|
||||
if err := impl.DBService.Create(&order).Error; err != nil {
|
||||
var existing models.WalletRechargeOrder
|
||||
if impl.DBService.Where("request_no = ? AND owner_identity = ?", request.RequestNo, owner.Identity).First(&existing).Error != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
order = existing
|
||||
}
|
||||
infra.Response.Success(ctx, base.ResourceResponse(order))
|
||||
}
|
||||
}
|
||||
|
||||
// ConfirmMockRecharge 模拟支付回调，生产关闭；事务内只入账一次。
|
||||
func ConfirmMockRecharge(client string) gin.HandlerFunc {
|
||||
return func(ctx *gin.Context) {
|
||||
if !config.Spec.Global.MockPaymentEnabled {
|
||||
infra.Response.Error(ctx, errcode.ErrPermissionDenied)
|
||||
return
|
||||
}
|
||||
owner, ok := currentOwner(ctx, client)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
var response models.WalletRechargeOrder
|
||||
err := impl.DBService.Transaction(func(tx *gorm.DB) error {
|
||||
if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).
|
||||
Where("identity = ? AND owner_identity = ?", ctx.Param("identity"), owner.Identity).First(&response).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
if response.RechargeStatus == 23 {
|
||||
return nil
|
||||
}
|
||||
if response.RechargeStatus != 10 || response.Channel != "mock" {
|
||||
return gorm.ErrInvalidData
|
||||
}
|
||||
var wallet models.WalletBasic
|
||||
if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).First(&wallet, response.WalletBasicID).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
wallet.Balance += response.Amount
|
||||
if err := tx.Model(&wallet).Update("balance", wallet.Balance).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
now := time.Now()
|
||||
if err := tx.Model(&response).Updates(map[string]any{"recharge_status": 23, "completed_at": &now}).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
date := now.In(time.Local)
|
||||
return tx.Create(&models.WalletRecord{
|
||||
Entity: base.NewEntity(base.StatusEnable), WalletBasicID: wallet.ID, RecordNo: RecordNo("WR"),
|
||||
RequestNo: "recharge:" + response.Identity, Direction: "income", TradeType: "recharge",
|
||||
Amount: response.Amount, BalanceAfter: wallet.Balance, WithdrawalBalanceAfter: wallet.WithdrawalBalance,
|
||||
InTradeNo: response.RechargeNo, PayChannel: "mock", OperatorIdentity: owner.Identity,
|
||||
Ymd: int32(date.Year()*10000 + int(date.Month())*100 + date.Day()), Ym: int32(date.Year()*100 + int(date.Month())),
|
||||
}).Error
|
||||
})
|
||||
if err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
infra.Response.Success(ctx, gin.H{"confirmed": true})
|
||||
}
|
||||
}
|
||||
|
||||
// ListWalletRecords 返回当前钱包不可变流水。
|
||||
func ListWalletRecords(client string) gin.HandlerFunc {
|
||||
return func(ctx *gin.Context) {
|
||||
owner, ok := currentOwner(ctx, client)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
wallet, err := ensureWallet(impl.DBService, owner)
|
||||
if err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
var list []models.WalletRecord
|
||||
if err := impl.DBService.Where("wallet_basic_id = ?", wallet.ID).Order("created_at desc").Find(&list).Error; err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
infra.Response.Success(ctx, base.ResourceResponse(list))
|
||||
}
|
||||
}
|
||||
|
||||
// ListBanks 仅返回银行卡掩码和非敏感字段。
|
||||
func ListBanks(client string) gin.HandlerFunc {
|
||||
return func(ctx *gin.Context) {
|
||||
owner, ok := currentOwner(ctx, client)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
wallet, err := ensureWallet(impl.DBService, owner)
|
||||
if err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
var banks []models.WalletBank
|
||||
if err := impl.DBService.Where("wallet_basic_id = ? AND status <> ?", wallet.ID, base.StatusArchived).Find(&banks).Error; err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
list := make([]gin.H, 0, len(banks))
|
||||
for _, bank := range banks {
|
||||
list = append(list, gin.H{"identity": bank.Identity, "card_no_masked": "**** **** **** " + bank.CardNoLast4, "bank_name": bank.BankName, "card_owner": bank.CardOwner, "bank_type": bank.BankType})
|
||||
}
|
||||
infra.Response.Success(ctx, list)
|
||||
}
|
||||
}
|
||||
|
||||
// BindBank 加密保存银行卡；支付渠道绑定标识在首期保持为空。
|
||||
func BindBank(client string) gin.HandlerFunc {
|
||||
return func(ctx *gin.Context) {
|
||||
owner, ok := currentOwner(ctx, client)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
var request struct {
|
||||
CardNo string `json:"card_no" binding:"required,min=12,max=32"`
|
||||
BankName string `json:"bank_name" binding:"required,max=128"`
|
||||
CardOwner string `json:"card_owner" binding:"required,max=128"`
|
||||
IDCard string `json:"id_card" binding:"required"`
|
||||
Phone string `json:"phone" binding:"required"`
|
||||
BankType string `json:"bank_type"`
|
||||
Bank string `json:"bank"`
|
||||
PaymentPassword string `json:"payment_password"`
|
||||
Code string `json:"code"`
|
||||
RequestIdentity string `json:"request_identity"`
|
||||
}
|
||||
if ctx.ShouldBindJSON(&request) != nil || !ValidPhone(request.Phone) {
|
||||
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
||||
return
|
||||
}
|
||||
wallet, err := ensureWallet(impl.DBService, owner)
|
||||
if err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
if !walletProof(wallet, client, owner.Phone, "bind_bank", request.PaymentPassword, request.RequestIdentity, request.Code) {
|
||||
infra.Response.Error(ctx, errcode.ErrPassword)
|
||||
return
|
||||
}
|
||||
cardCipher, fingerprint, err := protectField(request.CardNo)
|
||||
if err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
idCipher, _, _ := protectField(request.IDCard)
|
||||
phoneCipher, _, _ := protectField(request.Phone)
|
||||
bank := models.WalletBank{
|
||||
Entity: base.NewEntity(base.StatusEnable), WalletBasicID: wallet.ID, CardNoCiphertext: cardCipher,
|
||||
CardFingerprint: fingerprint, CardNoLast4: request.CardNo[len(request.CardNo)-4:],
|
||||
BankName: request.BankName, CardOwner: request.CardOwner, IDCardCiphertext: idCipher,
|
||||
PhoneCiphertext: phoneCipher, BankType: request.BankType, Bank: request.Bank,
|
||||
}
|
||||
if err := impl.DBService.Create(&bank).Error; err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
infra.Response.Success(ctx, gin.H{"identity": bank.Identity, "card_no_masked": "**** **** **** " + bank.CardNoLast4})
|
||||
}
|
||||
}
|
||||
|
||||
// UnbindBank 归档银行卡；存在待处理提现时拒绝。
|
||||
func UnbindBank(client string) gin.HandlerFunc {
|
||||
return func(ctx *gin.Context) {
|
||||
owner, ok := currentOwner(ctx, client)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
var request struct {
|
||||
PaymentPassword string `json:"payment_password"`
|
||||
Code string `json:"code"`
|
||||
RequestIdentity string `json:"request_identity"`
|
||||
}
|
||||
if ctx.ShouldBindJSON(&request) != nil {
|
||||
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
||||
return
|
||||
}
|
||||
wallet, err := ensureWallet(impl.DBService, owner)
|
||||
if err != nil || !walletProof(wallet, client, owner.Phone, "unbind_bank", request.PaymentPassword, request.RequestIdentity, request.Code) {
|
||||
infra.Response.Error(ctx, errcode.ErrPassword)
|
||||
return
|
||||
}
|
||||
var bank models.WalletBank
|
||||
if impl.DBService.Where("identity = ? AND wallet_basic_id = ? AND status <> ?", ctx.Param("identity"), wallet.ID, base.StatusArchived).First(&bank).Error != nil {
|
||||
infra.Response.Error(ctx, errcode.ErrRecordNotFound)
|
||||
return
|
||||
}
|
||||
var count int64
|
||||
impl.DBService.Model(&models.WalletApplyCash{}).Where("wallet_bank_id = ? AND apply_status IN ?", bank.ID, []int{10, 18}).Count(&count)
|
||||
if count > 0 {
|
||||
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
||||
return
|
||||
}
|
||||
if err := impl.DBService.Model(&bank).Update("status", base.StatusArchived).Error; err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
infra.Response.Success(ctx, gin.H{"archived": true})
|
||||
}
|
||||
}
|
||||
|
||||
// CreateWithdrawal 创建提现申请并预扣可提现余额。
|
||||
func CreateWithdrawal(client string) gin.HandlerFunc {
|
||||
return func(ctx *gin.Context) {
|
||||
owner, ok := currentOwner(ctx, client)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
var request struct {
|
||||
BankIdentity string `json:"bank_identity" binding:"required"`
|
||||
Amount int64 `json:"amount" binding:"required,gt=0"`
|
||||
RequestNo string `json:"request_no" binding:"required"`
|
||||
PaymentPassword string `json:"payment_password" binding:"required"`
|
||||
Remark string `json:"remark"`
|
||||
}
|
||||
if ctx.ShouldBindJSON(&request) != nil {
|
||||
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
||||
return
|
||||
}
|
||||
wallet, err := ensureWallet(impl.DBService, owner)
|
||||
if err != nil || !VerifyPaymentPassword(owner.Identity, wallet, request.PaymentPassword) {
|
||||
infra.Response.Error(ctx, errcode.ErrPassword)
|
||||
return
|
||||
}
|
||||
var apply models.WalletApplyCash
|
||||
err = impl.DBService.Transaction(func(tx *gorm.DB) error {
|
||||
if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).First(&wallet, wallet.ID).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
if wallet.WithdrawalBalance < request.Amount {
|
||||
return gorm.ErrInvalidData
|
||||
}
|
||||
var bank models.WalletBank
|
||||
if err := tx.Where("identity = ? AND wallet_basic_id = ? AND status = ?", request.BankIdentity, wallet.ID, base.StatusEnable).First(&bank).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
apply = models.WalletApplyCash{
|
||||
Entity: base.NewEntity(base.StatusEnable), ApplyStatus: 10, WalletBasicID: wallet.ID,
|
||||
WalletBankID: bank.ID, CashNo: RecordNo("WD"), RequestNo: request.RequestNo,
|
||||
Amount: request.Amount, Channel: "bank", Remark: request.Remark,
|
||||
}
|
||||
if err := tx.Create(&apply).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
return tx.Model(&wallet).Update("withdrawal_balance", gorm.Expr("withdrawal_balance - ?", request.Amount)).Error
|
||||
})
|
||||
if err != nil {
|
||||
var existing models.WalletApplyCash
|
||||
if impl.DBService.Where("request_no = ? AND wallet_basic_id = ?", request.RequestNo, wallet.ID).First(&existing).Error != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
apply = existing
|
||||
}
|
||||
infra.Response.Success(ctx, base.ResourceResponse(apply))
|
||||
}
|
||||
}
|
||||
|
||||
// ListWithdrawals 返回当前钱包提现申请。
|
||||
func ListWithdrawals(client string) gin.HandlerFunc {
|
||||
return func(ctx *gin.Context) {
|
||||
owner, ok := currentOwner(ctx, client)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
wallet, err := ensureWallet(impl.DBService, owner)
|
||||
if err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
var list []models.WalletApplyCash
|
||||
if err := impl.DBService.Where("wallet_basic_id = ?", wallet.ID).Order("created_at desc").Find(&list).Error; err != nil {
|
||||
infra.Response.Error(ctx, err)
|
||||
return
|
||||
}
|
||||
infra.Response.Success(ctx, base.ResourceResponse(list))
|
||||
}
|
||||
}
|
||||
|
||||
func walletProof(wallet models.WalletBasic, client, phone, purpose, password, requestIdentity, code string) bool {
|
||||
return wallet.PayPasswordHash != "" && bcrypt.CompareHashAndPassword([]byte(wallet.PayPasswordHash), []byte(password)) == nil ||
|
||||
VerifyCode(client, phone, purpose, requestIdentity, code)
|
||||
}
|
||||
|
||||
// VerifyPaymentPassword 校验支付密码，并在 Redis 中累计失败次数、短时锁定。
|
||||
func VerifyPaymentPassword(ownerIdentity string, wallet models.WalletBasic, password string) bool {
|
||||
lockKey := impl.RedisService.BuildKey("payment-password-lock", ownerIdentity)
|
||||
var locked bool
|
||||
if impl.RedisService.Get(lockKey, &locked) == nil && locked {
|
||||
return false
|
||||
}
|
||||
if wallet.PayPasswordHash != "" && bcrypt.CompareHashAndPassword([]byte(wallet.PayPasswordHash), []byte(password)) == nil {
|
||||
_ = impl.RedisService.Delete(impl.RedisService.BuildKey("payment-password-failures", ownerIdentity))
|
||||
return true
|
||||
}
|
||||
failureKey := impl.RedisService.BuildKey("payment-password-failures", ownerIdentity)
|
||||
var failures int
|
||||
_ = impl.RedisService.Get(failureKey, &failures)
|
||||
failures++
|
||||
_ = impl.RedisService.Set(failureKey, failures, 15*time.Minute)
|
||||
if failures >= 5 {
|
||||
_ = impl.RedisService.Set(lockKey, true, 15*time.Minute)
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func protectField(value string) (string, string, error) {
|
||||
reader := hkdf.New(sha256.New, []byte(config.Spec.Global.FieldEncryptionKey), nil, []byte("heqi-wallet-field-v1"))
|
||||
key := make([]byte, 64)
|
||||
if _, err := io.ReadFull(reader, key); err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
block, err := aes.NewCipher(key[:32])
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
nonce := make([]byte, gcm.NonceSize())
|
||||
if _, err := rand.Read(nonce); err != nil {
|
||||
return "", "", err
|
||||
}
|
||||
sealed := gcm.Seal(nil, nonce, []byte(strings.TrimSpace(value)), nil)
|
||||
mac := hmac.New(sha256.New, key[32:])
|
||||
_, _ = mac.Write([]byte(strings.TrimSpace(value)))
|
||||
return base64.RawStdEncoding.EncodeToString(append(nonce, sealed...)), hex.EncodeToString(mac.Sum(nil)), nil
|
||||
}
|
||||
Reference in New Issue
Block a user