wlt/ai-dimension
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 退款原子化——先冻结星尘(findOneAndUpdate+原子扣减防并发)→再调微信→失败回滚星尘；修复语法残留

Browse Source
This commit is contained in:
txai-dev
2026-09-14 13:23:28 +08:00
parent f6d99aff3c
commit 2b00fa49c1
1 changed files with 29 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/src/routes/admin.js
+29 -16
View File
@@ -1240,6 +1240,7 @@ router.post('/vpay/orders/:id/refund', requirePermission('orders:write'), async
// ===== 退款风控（三层，防恶意充值→消费→退款循环） =====
// 第一层：余额必须够扣（星尘已消费 = 虚拟商品已使用，不支持退款）
// 注意：这里只做预检展示，真正的原子扣减在风控通过后执行
const currentBalance = user.vpayCoins || 0
if (currentBalance < coins) {
return ApiResponse.error(res,
@@ -1267,17 +1268,27 @@ router.post('/vpay/orders/:id/refund', requirePermission('orders:write'), async
409, { blocked: 'rate_limited', lastRefund: recentRefund.orderNo })
}
// 风控通过：先调微信退钱（钱是用户的）→ 成功后本地扣星尘
user.vpayCoins = currentBalance - coins
await user.save()
// ===== 冻结星尘（原子操作，防并发竞态） =====
// findOneAndUpdate + $gte 条件 = 原子扣减：
// 如果在预检和这里之间用户消费了星尘导致余额不足，此操作会失败（返回 null）
const frozen = await User.findOneAndUpdate(
{ _id: user._id, vpayCoins: { $gte: coins } }, // 条件：余额仍然够
{ $inc: { vpayCoins: -coins } }, // 原子扣减
{ new: true } // 返回更新后的文档
)
if (!frozen) {
return ApiResponse.error(res,
`退款失败：并发冲突，用户星尘在退款过程中被消费。余额已不足 ${coins}，请确认后再试。`,
409, { blocked: 'concurrent_spend' })
}
const balanceAfterFreeze = frozen.vpayCoins
// ===== 调用微信虚拟支付退款 API（真正退钱给用户） =====
// ===== 调用微信虚拟支付退款 API（星尘已冻结，现在退钱） =====
let wxRefundResult = 'not_called'
try {
const ENV = parseInt(process.env.VPAY_ENV || '1')
const APPKEY = ENV === 0 ? (process.env.VPAY_APPKEY_PROD || '') : (process.env.VPAY_APPKEY_SANDBOX || '')
const OFFER_ID = process.env.VPAY_OFFER_ID || ''
// 获取 access_token（小程序全局凭证）
const tokenUrl = `https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${process.env.WX_APPID}&secret=${process.env.WX_SECRET}`
const tokenRes = await fetch(tokenUrl).then(r => r.json())
const accessToken = tokenRes.access_token
@@ -1285,36 +1296,38 @@ router.post('/vpay/orders/:id/refund', requirePermission('orders:write'), async
const refundBody = JSON.stringify({ offerId: OFFER_ID, outTradeNo: order.orderNo })
const paySig = require('crypto').createHmac('sha256', APPKEY).update('/xpay/refund_order&' + refundBody).digest('hex')
const wxRes = await fetch(`https://api.weixin.qq.com/xpay/refund_order?access_token=${accessToken}&pay_sig=${paySig}`, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: refundBody,
signal: AbortSignal.timeout(15000),
}).then(r => r.json())
if (wxRes.errcode === 0) {
wxRefundResult = 'success'
logger.info(`[vpay-refund] 微信退款成功: ${order.orderNo}`)
} else {
wxRefundResult = 'wx_error: ' + (wxRes.errmsg || wxRes.errcode)
logger.warn(`[vpay-refund] 微信退款返回异常: ${JSON.stringify(wxRes)}`)
// 微信退款失败时不继续本地退款
return ApiResponse.error(res, `微信退款失败: ${wxRefundResult}，请检查虚拟支付配置`, 500)
// 微信退款失败 → 回滚冻结的星尘（用户星尘恢复，钱也没退，两边一致）
await User.updateOne({ _id: user._id }, { $inc: { vpayCoins: coins } })
logger.warn(`[vpay-refund] 微信退款异常(已回滚星尘 +${coins}): ${JSON.stringify(wxRes)}`)
return ApiResponse.error(res, `微信退款失败: ${wxRes.errmsg}。星尘已恢复，订单状态未变。`, 500)
}
} catch (wxErr) {
wxRefundResult = 'error: ' + wxErr.message
logger.error('[vpay-refund] 微信退款调用失败:', wxErr.message)
return ApiResponse.error(res, `微信退款调用失败: ${wxErr.message}`, 500)
// 网络异常等 → 回滚冻结的星尘
await User.updateOne({ _id: user._id }, { $inc: { vpayCoins: coins } })
logger.error(`[vpay-refund] 微信退款调用异常(已回滚星尘 +${coins}):`, wxErr.message)
return ApiResponse.error(res, `微信退款调用失败: ${wxErr.message}。星尘已恢复，订单状态未变。`, 500)
}
// 微信退款成功 → 写订单状态 + 流水（星尘已在冻结时扣减）
await Order.updateOne({ _id: order._id }, { status: 'refunded', refundedAt: new Date() })
await CoinLedger.create({
openid: user.openid, userId: user._id, type: 'refund', amount: -coins,
balanceAfter: user.vpayCoins, description: `退款 ${order.orderNo}`,
balanceAfter: balanceAfterFreeze, description: `退款 ${order.orderNo}`,
orderNo: order.orderNo, adminName: req.admin.username,
})
return ApiResponse.success(res, { orderNo: order.orderNo, coinsDeducted: coins, balanceAfter: user.vpayCoins, wxRefund: wxRefundResult }, '退款成功')
return ApiResponse.success(res, { orderNo: order.orderNo, coinsDeducted: coins, balanceAfter: balanceAfterFreeze, wxRefund: wxRefundResult }, '退款成功')
} catch (error) {
logger.error('vpay refund 失败:', error)
return ApiResponse.serverError(res, '退款失败')