audit full project flows and harden backend

backend/api/internal/logic/payment/callback.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"net/http"
 	"strconv"
+	"strings"
 	"time"
 
 	"git.apinb.com/heqiapp/platforms/backend/api/internal/config"
@@ -80,12 +81,18 @@ func complete(paymentNo, tradeNo string, amount int64, channel, callbackDigest s
 		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("payment_no = ?", paymentNo).First(&order).Error; err != nil {
 			return err
 		}
-		if order.PaymentStatus == StatusPaid {
-			return nil
-		}
 		if order.Channel != channel || order.Amount != amount {
 			return errors.New("payment identity or amount mismatch")
 		}
+		if strings.TrimSpace(tradeNo) == "" {
+			return errors.New("channel trade number is required")
+		}
+		if order.PaymentStatus == StatusPaid {
+			if order.ChannelTradeNo != tradeNo {
+				return errors.New("duplicate callback trade number mismatch")
+			}
+			return nil
+		}
 		if time.Now().After(order.ExpiresAt) {
 			return tx.Model(&order).Updates(map[string]any{"payment_status": 50, "channel_trade_no": tradeNo, "callback_digest": callbackDigest, "failure_code": "PAID_AFTER_EXPIRED"}).Error
 		}
@@ -95,9 +102,10 @@ func complete(paymentNo, tradeNo string, amount int64, channel, callbackDigest s
 		}
 		switch order.BusinessType {
 		case "ec_order":
-			return tx.Model(&models.EcOrder{}).Where("identity = ? AND order_status = ?", order.BusinessIdentity, 16).Updates(map[string]any{"order_status": 18, "paid_at": &now}).Error
+			result := tx.Model(&models.EcOrder{}).Where("identity = ? AND order_status = ?", order.BusinessIdentity, 16).Updates(map[string]any{"order_status": 18, "paid_at": &now})
+			return requireSingleBusinessUpdate(result)
 		case "gasorder":
-			return tx.Model(&models.GasorderBasic{}).Where("identity = ? AND order_status IN ?", order.BusinessIdentity, []int{16, 18}).Update("order_status", 35).Error
+			return requireSingleBusinessUpdate(tx.Model(&models.GasorderBasic{}).Where("identity = ? AND order_status IN ?", order.BusinessIdentity, []int{16, 18}).Update("order_status", 35))
 		case "recharge":
 			return completeRecharge(tx, order, now)
 		}
@@ -105,6 +113,16 @@ func complete(paymentNo, tradeNo string, amount int64, channel, callbackDigest s
 	})
 }
 
+func requireSingleBusinessUpdate(result *gorm.DB) error {
+	if result.Error != nil {
+		return result.Error
+	}
+	if result.RowsAffected != 1 {
+		return errors.New("payment business state conflict")
+	}
+	return nil
+}
+
 func completeRecharge(tx *gorm.DB, payment models.PaymentOrder, now time.Time) error {
 	var recharge models.WalletRechargeOrder
 	if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("identity = ? AND recharge_status = ?", payment.BusinessIdentity, 10).First(&recharge).Error; err != nil {