feat:【pay 支付】增加 userid、usertype,并额外支持权限校验

This commit is contained in:
YunaiV
2025-07-27 19:18:04 +08:00
parent ae9e35f184
commit 8ffe9272e8
20 changed files with 143 additions and 27 deletions

View File

@ -43,7 +43,7 @@ public interface AfterSaleConvert {
@Mapping(source = "afterSale.id", target = "merchantRefundId"),
@Mapping(source = "afterSale.applyReason", target = "reason"),
@Mapping(source = "afterSale.refundPrice", target = "price"),
@Mapping(source = "orderProperties.payAppKey", target = "appKey")
@Mapping(source = "orderProperties.payAppKey", target = "appKey"),
})
PayRefundCreateReqDTO convert(String userIp, AfterSaleDO afterSale, TradeOrderProperties orderProperties);

View File

@ -2,6 +2,7 @@ package cn.iocoder.yudao.module.trade.convert.order;
import cn.hutool.core.util.BooleanUtil;
import cn.hutool.core.util.StrUtil;
import cn.iocoder.yudao.framework.common.enums.UserTypeEnum;
import cn.iocoder.yudao.framework.common.pojo.PageResult;
import cn.iocoder.yudao.framework.common.util.collection.CollectionUtils;
import cn.iocoder.yudao.framework.common.util.string.StrUtils;
@ -101,7 +102,8 @@ public interface TradeOrderConvert {
default PayOrderCreateReqDTO convert(TradeOrderDO order, List<TradeOrderItemDO> orderItems,
TradeOrderProperties orderProperties) {
PayOrderCreateReqDTO createReqDTO = new PayOrderCreateReqDTO()
.setAppKey(orderProperties.getPayAppKey()).setUserIp(order.getUserIp());
.setAppKey(orderProperties.getPayAppKey()).setUserIp(order.getUserIp())
.setUserId(order.getUserId()).setUserType(UserTypeEnum.MEMBER.getValue());
// 商户相关字段
createReqDTO.setMerchantOrderId(String.valueOf(order.getId()));
String subject = orderItems.get(0).getSpuName();

View File

@ -3,6 +3,7 @@ package cn.iocoder.yudao.module.trade.service.aftersale;
import cn.hutool.core.map.MapUtil;
import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import cn.iocoder.yudao.framework.common.enums.UserTypeEnum;
import cn.iocoder.yudao.framework.common.pojo.PageResult;
import cn.iocoder.yudao.framework.common.util.object.ObjectUtils;
import cn.iocoder.yudao.module.pay.api.refund.PayRefundApi;
@ -362,6 +363,7 @@ public class AfterSaleServiceImpl implements AfterSaleService {
private void createPayRefund(String userIp, AfterSaleDO afterSale) {
// 创建退款单
PayRefundCreateReqDTO createReqDTO = AfterSaleConvert.INSTANCE.convert(userIp, afterSale, tradeOrderProperties)
.setUserId(afterSale.getUserId()).setUserType(UserTypeEnum.MEMBER.getValue())
.setReason(StrUtil.format("退款【{}】", afterSale.getSpuName()));
Long payRefundId = payRefundApi.createRefund(createReqDTO);

View File

@ -151,6 +151,7 @@ public class BrokerageWithdrawServiceImpl implements BrokerageWithdrawService {
.setAppKey(tradeOrderProperties.getPayAppKey()).setChannelCode(channelCode)
.setMerchantTransferId(withdraw.getId().toString()).setSubject("佣金提现").setPrice(withdraw.getPrice())
.setUserAccount(userAccount).setUserName(userName).setUserIp(getClientIP())
.setUserId(withdraw.getUserId()).setUserType(UserTypeEnum.MEMBER.getValue()) // 用户信息
.setChannelExtras(channelExtras);
// 1.3 发起请求
PayTransferCreateRespDTO transferRespDTO = payTransferApi.createTransfer(transferReqDTO);

View File

@ -952,6 +952,7 @@ public class TradeOrderUpdateServiceImpl implements TradeOrderUpdateService {
payRefundApi.createRefund(new PayRefundCreateReqDTO()
.setAppKey(tradeOrderProperties.getPayAppKey()) // 支付应用
.setUserIp(NetUtil.getLocalhostStr()) // 使用本机 IP因为是服务器发起退款的
.setUserId(order.getUserId()).setUserType(UserTypeEnum.MEMBER.getValue()) // 用户信息
.setMerchantOrderId(String.valueOf(order.getId())) // 支付单号
// 特殊:因为订单支持 AfterSale 单个售后退款,也支持整单退款,所以需要通过 order- 进行下区分
// 具体可见 AfterSaleController 的 updateAfterSaleRefunded 方法

View File

@ -1,5 +1,7 @@
package cn.iocoder.yudao.module.pay.api.order.dto;
import cn.iocoder.yudao.framework.common.enums.UserTypeEnum;
import cn.iocoder.yudao.framework.common.validation.InEnum;
import jakarta.validation.constraints.DecimalMin;
import jakarta.validation.constraints.NotEmpty;
import jakarta.validation.constraints.NotNull;
@ -22,12 +24,23 @@ public class PayOrderCreateReqDTO implements Serializable {
*/
@NotNull(message = "应用标识不能为空")
private String appKey;
/**
* 用户 IP
*/
@NotEmpty(message = "用户 IP 不能为空")
private String userIp;
/**
* 用户编号
*/
private Long userId;
/**
* 用户类型
*/
@InEnum(UserTypeEnum.class)
private Integer userType;
// ========== 商户相关字段 ==========
/**

View File

@ -1,5 +1,7 @@
package cn.iocoder.yudao.module.pay.api.refund.dto;
import cn.iocoder.yudao.framework.common.enums.UserTypeEnum;
import cn.iocoder.yudao.framework.common.validation.InEnum;
import jakarta.validation.constraints.Min;
import jakarta.validation.constraints.NotEmpty;
import jakarta.validation.constraints.NotNull;
@ -19,12 +21,23 @@ public class PayRefundCreateReqDTO {
*/
@NotNull(message = "应用标识不能为空")
private String appKey;
/**
* 用户 IP
*/
@NotEmpty(message = "用户 IP 不能为空")
private String userIp;
/**
* 用户编号
*/
private Long userId;
/**
* 用户类型
*/
@InEnum(UserTypeEnum.class)
private Integer userType;
// ========== 商户相关字段 ==========
/**
* 商户订单编号

View File

@ -1,7 +1,9 @@
package cn.iocoder.yudao.module.pay.api.transfer.dto;
import cn.hutool.core.util.StrUtil;
import cn.iocoder.yudao.framework.common.enums.UserTypeEnum;
import cn.iocoder.yudao.framework.common.util.json.JsonUtils;
import cn.iocoder.yudao.framework.common.validation.InEnum;
import jakarta.validation.constraints.Min;
import jakarta.validation.constraints.NotEmpty;
import jakarta.validation.constraints.NotNull;
@ -26,23 +28,23 @@ public class PayTransferCreateReqDTO {
@NotNull(message = "应用标识不能为空")
private String appKey;
/**
* 转账渠道
*/
@NotEmpty(message = "转账渠道不能为空")
private String channelCode;
/**
* 转账渠道的额外参数
*/
private Map<String, String> channelExtras;
/**
* 用户 IP
*/
@NotEmpty(message = "用户 IP 不能为空")
private String userIp;
/**
* 用户编号
*/
private Long userId;
/**
* 用户类型
*/
@InEnum(UserTypeEnum.class)
private Integer userType;
// ========== 商户相关字段 ==========
/**
* 商户转账单编号
*/
@ -75,6 +77,17 @@ public class PayTransferCreateReqDTO {
*/
private String userName;
/**
* 转账渠道
*/
@NotEmpty(message = "转账渠道不能为空")
private String channelCode;
/**
* 转账渠道的额外参数
*/
private Map<String, String> channelExtras;
/**
* 【微信】现金营销场景
*

View File

@ -19,6 +19,7 @@ import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.*;
import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success;
import static cn.iocoder.yudao.framework.security.core.util.SecurityFrameworkUtils.getLoginUserId;
@Tag(name = "管理后台 - 示例提现订单") // 目的:演示转账功能
@RestController
@ -40,7 +41,7 @@ public class PayDemoWithdrawController {
@Operation(summary = "提现单转账")
@Parameter(name = "id", required = true, description = "提现单编号", example = "1024")
public CommonResult<Long> transferDemoWithdraw(@RequestParam("id") Long id) {
Long payTransferId = demoWithdrawService.transferDemoWithdraw(id);
Long payTransferId = demoWithdrawService.transferDemoWithdraw(id, getLoginUserId());
return success(payTransferId);
}

View File

@ -1,12 +1,12 @@
package cn.iocoder.yudao.module.pay.controller.app.order;
import cn.hutool.core.util.ObjUtil;
import cn.iocoder.yudao.framework.common.pojo.CommonResult;
import cn.iocoder.yudao.framework.common.util.object.BeanUtils;
import cn.iocoder.yudao.module.pay.controller.admin.order.vo.PayOrderRespVO;
import cn.iocoder.yudao.module.pay.controller.admin.order.vo.PayOrderSubmitRespVO;
import cn.iocoder.yudao.module.pay.controller.app.order.vo.AppPayOrderSubmitReqVO;
import cn.iocoder.yudao.module.pay.controller.app.order.vo.AppPayOrderSubmitRespVO;
import cn.iocoder.yudao.module.pay.convert.order.PayOrderConvert;
import cn.iocoder.yudao.module.pay.dal.dataobject.order.PayOrderDO;
import cn.iocoder.yudao.module.pay.dal.dataobject.wallet.PayWalletDO;
import cn.iocoder.yudao.module.pay.enums.PayChannelEnum;
@ -52,6 +52,15 @@ public class AppPayOrderController {
public CommonResult<PayOrderRespVO> getOrder(@RequestParam("id") Long id,
@RequestParam(value = "sync", required = false) Boolean sync) {
PayOrderDO order = payOrderService.getOrder(id);
if (order== null) {
return success(null);
}
// 重要:校验订单是否是当前用户,避免越权
if (order.getUserId() != null // 特殊:早期订单未存储 userId所以忽略
&& ObjUtil.notEqual(order.getUserId(), getLoginUserId())) {
return success(null);
}
// sync 仅在等待支付
if (Boolean.TRUE.equals(sync) && PayOrderStatusEnum.isWaiting(order.getStatus())) {
payOrderService.syncOrderQuietly(order.getId());
@ -75,7 +84,7 @@ public class AppPayOrderController {
// 2. 提交支付
PayOrderSubmitRespVO respVO = payOrderService.submitOrder(reqVO, getClientIP());
return success(PayOrderConvert.INSTANCE.convert3(respVO));
return success(BeanUtils.toBean(respVO, AppPayOrderSubmitRespVO.class));
}
}

View File

@ -3,14 +3,13 @@ package cn.iocoder.yudao.module.pay.convert.order;
import cn.iocoder.yudao.framework.common.pojo.PageResult;
import cn.iocoder.yudao.framework.common.util.collection.CollectionUtils;
import cn.iocoder.yudao.framework.common.util.collection.MapUtils;
import cn.iocoder.yudao.module.pay.framework.pay.core.client.dto.order.PayOrderUnifiedReqDTO;
import cn.iocoder.yudao.module.pay.api.order.dto.PayOrderCreateReqDTO;
import cn.iocoder.yudao.module.pay.api.order.dto.PayOrderRespDTO;
import cn.iocoder.yudao.module.pay.controller.admin.order.vo.*;
import cn.iocoder.yudao.module.pay.controller.app.order.vo.AppPayOrderSubmitRespVO;
import cn.iocoder.yudao.module.pay.dal.dataobject.app.PayAppDO;
import cn.iocoder.yudao.module.pay.dal.dataobject.order.PayOrderDO;
import cn.iocoder.yudao.module.pay.dal.dataobject.order.PayOrderExtensionDO;
import cn.iocoder.yudao.module.pay.framework.pay.core.client.dto.order.PayOrderUnifiedReqDTO;
import org.mapstruct.Mapper;
import org.mapstruct.Mapping;
import org.mapstruct.factory.Mappers;
@ -69,6 +68,4 @@ public interface PayOrderConvert {
@Mapping(source = "order.status", target = "status")
PayOrderSubmitRespVO convert(PayOrderDO order, cn.iocoder.yudao.module.pay.framework.pay.core.client.dto.order.PayOrderRespDTO respDTO);
AppPayOrderSubmitRespVO convert3(PayOrderSubmitRespVO bean);
}

View File

@ -49,6 +49,15 @@ public class PayOrderDO extends BaseDO {
*/
private String channelCode;
/**
* 用户编号
*/
private Long userId;
/**
* 用户类型
*/
private Integer userType;
// ========== 商户相关字段 ==========
/**

View File

@ -77,6 +77,15 @@ public class PayRefundDO extends BaseDO {
*/
private String orderNo;
/**
* 用户编号
*/
private Long userId;
/**
* 用户类型
*/
private Integer userType;
// ========== 商户相关字段 ==========
/**
* 商户订单编号

View File

@ -30,7 +30,6 @@ public class PayTransferDO extends BaseDO {
*/
@TableId
private Long id;
/**
* 转账单号
*/
@ -42,14 +41,12 @@ public class PayTransferDO extends BaseDO {
* 关联 {@link PayAppDO#getId()}
*/
private Long appId;
/**
* 转账渠道编号
*
* 关联 {@link PayChannelDO#getId()}
*/
private Long channelId;
/**
* 转账渠道编码
*
@ -57,6 +54,15 @@ public class PayTransferDO extends BaseDO {
*/
private String channelCode;
/**
* 用户编号
*/
private Long userId;
/**
* 用户类型
*/
private Integer userType;
// ========== 商户相关字段 ==========
/**
* 商户转账单编号

View File

@ -3,6 +3,7 @@ package cn.iocoder.yudao.module.pay.service.demo;
import cn.hutool.core.lang.Assert;
import cn.hutool.core.util.ObjUtil;
import cn.hutool.core.util.ObjectUtil;
import cn.iocoder.yudao.framework.common.enums.UserTypeEnum;
import cn.iocoder.yudao.framework.common.pojo.PageParam;
import cn.iocoder.yudao.framework.common.pojo.PageResult;
import cn.iocoder.yudao.module.pay.api.order.PayOrderApi;
@ -90,6 +91,7 @@ public class PayDemoOrderServiceImpl implements PayDemoOrderService {
// 2.1 创建支付单
Long payOrderId = payOrderApi.createOrder(new PayOrderCreateReqDTO()
.setAppKey(PAY_APP_KEY).setUserIp(getClientIP()) // 支付应用
.setUserId(userId).setUserType(UserTypeEnum.ADMIN.getValue()) // 用户信息
.setMerchantOrderId(demoOrder.getId().toString()) // 业务的订单编号
.setSubject(spuName).setBody("").setPrice(price) // 价格信息
.setExpireTime(addTime(Duration.ofHours(2L)))); // 支付的过期时间
@ -189,6 +191,7 @@ public class PayDemoOrderServiceImpl implements PayDemoOrderService {
// 2.2 创建退款单
Long payRefundId = payRefundApi.createRefund(new PayRefundCreateReqDTO()
.setAppKey(PAY_APP_KEY).setUserIp(getClientIP()) // 支付应用
.setUserId(order.getUserId()).setUserType(UserTypeEnum.ADMIN.getValue()) // 用户信息
.setMerchantOrderId(String.valueOf(order.getId())) // 支付单号
.setMerchantRefundId(refundId)
.setReason("想退钱").setPrice(order.getPrice()));// 价格信息

View File

@ -26,9 +26,10 @@ public interface PayDemoWithdrawService {
* 提现单转账
*
* @param id 提现单编号
* @param userId 用户编号
* @return 转账编号
*/
Long transferDemoWithdraw(Long id);
Long transferDemoWithdraw(Long id, Long userId);
/**
* 获得示例提现单分页

View File

@ -2,6 +2,7 @@ package cn.iocoder.yudao.module.pay.service.demo;
import cn.hutool.core.lang.Assert;
import cn.hutool.core.util.ObjectUtil;
import cn.iocoder.yudao.framework.common.enums.UserTypeEnum;
import cn.iocoder.yudao.framework.common.pojo.PageParam;
import cn.iocoder.yudao.framework.common.pojo.PageResult;
import cn.iocoder.yudao.framework.common.util.json.JsonUtils;
@ -60,7 +61,7 @@ public class PayDemoWithdrawServiceImpl implements PayDemoWithdrawService {
}
@Override
public Long transferDemoWithdraw(Long id) {
public Long transferDemoWithdraw(Long id, Long userId) {
// 1.1 校验提现单
PayDemoWithdrawDO withdraw = validateDemoWithdrawCanTransfer(id);
// 1.2 特殊:如果是转账失败的情况,需要充值下
@ -76,6 +77,7 @@ public class PayDemoWithdrawServiceImpl implements PayDemoWithdrawService {
// 2.1 创建支付单
PayTransferCreateReqDTO transferReqDTO = new PayTransferCreateReqDTO()
.setAppKey(PAY_APP_KEY).setChannelCode(withdraw.getTransferChannelCode()).setUserIp(getClientIP()) // 支付应用
.setUserId(userId).setUserType(UserTypeEnum.ADMIN.getValue()) // 用户信息
.setMerchantTransferId(String.valueOf(withdraw.getId())) // 业务的订单编号
.setSubject(withdraw.getSubject()).setPrice(withdraw.getPrice()) // 价格信息
.setUserAccount(withdraw.getUserAccount()).setUserName(withdraw.getUserName()); // 收款信息

View File

@ -64,8 +64,6 @@ public class PayWalletRechargeServiceImpl implements PayWalletRechargeService {
private PayWalletService payWalletService;
@Resource
private PayOrderService payOrderService;
// @Resource
// private PayRefundService payRefundService;
@Resource
private PayWalletRechargePackageService payWalletRechargePackageService;
@ -99,6 +97,7 @@ public class PayWalletRechargeServiceImpl implements PayWalletRechargeService {
// 2.1 创建支付单
Long payOrderId = payOrderService.createOrder(new PayOrderCreateReqDTO()
.setAppKey(payProperties.getWalletPayAppKey()).setUserIp(userIp)
.setUserId(userId).setUserType(userType) // 用户信息
.setMerchantOrderId(recharge.getId().toString()) // 业务的订单编号
.setSubject(WALLET_RECHARGE_ORDER_SUBJECT).setBody("")
.setPrice(recharge.getPayPrice())
@ -209,6 +208,7 @@ public class PayWalletRechargeServiceImpl implements PayWalletRechargeService {
String refundId = walletRechargeId + "-refund";
Long payRefundId = payRefundApi.createRefund(new PayRefundCreateReqDTO()
.setAppKey(payProperties.getWalletPayAppKey()).setUserIp(userIp)
.setUserId(wallet.getUserId()).setUserType(wallet.getUserType()) // 用户信息
.setMerchantOrderId(walletRechargeId)
.setMerchantRefundId(refundId)
.setReason("想退钱").setPrice(walletRecharge.getPayPrice()));

View File

@ -3,5 +3,6 @@ DELETE FROM pay_channel;
DELETE FROM pay_order;
DELETE FROM pay_order_extension;
DELETE FROM pay_refund;
DELETE FROM pay_transfer;
DELETE FROM pay_notify_task;
DELETE FROM pay_notify_log;

View File

@ -45,6 +45,8 @@ CREATE TABLE IF NOT EXISTS `pay_order` (
`channel_fee_price` bigint(20) DEFAULT 0,
`status` tinyint(4) NOT NULL,
`user_ip` varchar(50) NOT NULL,
`user_id` bigint(20) DEFAULT NULL,
`user_type` tinyint(4) DEFAULT NULL,
`expire_time` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
`success_time` datetime(0) DEFAULT CURRENT_TIMESTAMP,
`notify_time` datetime(0) DEFAULT CURRENT_TIMESTAMP,
@ -97,6 +99,8 @@ CREATE TABLE IF NOT EXISTS `pay_refund` (
`refund_price` bigint(20) NOT NULL,
`reason` varchar(256) NOT NULL,
`user_ip` varchar(50) NULL DEFAULT NULL,
`user_id` bigint(20) NULL DEFAULT NULL,
`user_type` tinyint(4) NULL DEFAULT NULL,
`channel_order_no` varchar(64) NOT NULL,
`channel_refund_no` varchar(64) NULL DEFAULT NULL,
`success_time` datetime(0) NULL DEFAULT NULL,
@ -145,3 +149,32 @@ CREATE TABLE IF NOT EXISTS `pay_notify_log` (
`deleted` bit(1) NOT NULL DEFAULT FALSE,
PRIMARY KEY ("id")
) COMMENT = '支付通知日志';
CREATE TABLE IF NOT EXISTS `pay_transfer` (
"id" number NOT NULL GENERATED BY DEFAULT AS IDENTITY,
`no` varchar(64) NOT NULL,
`app_id` bigint(20) NOT NULL,
`channel_id` bigint(20) NOT NULL,
`channel_code` varchar(32) NOT NULL,
`user_id` bigint(20) NULL DEFAULT NULL,
`user_type` tinyint(4) NULL DEFAULT NULL,
`merchant_transfer_id` varchar(64) NOT NULL,
`price` bigint(20) NOT NULL,
`subject` varchar(256) NOT NULL,
`user_account` varchar(256) NOT NULL,
`user_name` varchar(64) NULL DEFAULT NULL,
`status` tinyint(4) NOT NULL,
`notify_url` varchar(1024) NULL DEFAULT NULL,
`channel_transfer_no` varchar(64) NULL DEFAULT NULL,
`success_time` datetime(0) NULL DEFAULT NULL,
`channel_error_code` varchar(128) NULL DEFAULT NULL,
`channel_error_msg` varchar(256) NULL DEFAULT NULL,
`channel_notify_data` varchar(1024) NULL DEFAULT NULL,
`channel_extras` varchar(1024) NULL DEFAULT NULL,
`creator` varchar(64) NULL DEFAULT '',
`create_time` datetime(0) NOT NULL DEFAULT CURRENT_TIMESTAMP,
`updater` varchar(64) NULL DEFAULT '',
`update_time` datetime(0) NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
`deleted` bit(1) NOT NULL DEFAULT FALSE,
PRIMARY KEY ("id")
) COMMENT = '转账单';