更新支付宝付款

router_wallet.py

@@ -175,18 +175,110 @@ async def purchase_item(req: PurchaseRequest, db: Session = Depends(get_db)):
     db.commit()
     return {"status": "success"}
 
-# =============== 以下为预留的充值/回调桩函数 ===============
+# =============== 以下为真实的支付宝充值与回调逻辑 ===============
+
 @router.post("/api/wallet/create_recharge_order")
 async def create_recharge_order(req: RechargeRequest, db: Session = Depends(get_db)):
+    if not alipay:
+        raise HTTPException(status_code=500, detail="支付宝支付组件未配置或秘钥加载失败")
+        
+    # 生成带时间戳和随机哈希的全局唯一订单号
     order_id = f"R_{int(time.time())}_{uuid.uuid4().hex[:6]}"
-    # 由于缺少完整的支付宝业务逻辑代码，在此仅构建基础结构以防 import 崩溃
-    # 实际项目中这里应通过 alipay.api_alipay_trade_precreate 返回二维码
-    return {"status": "success", "order_id": order_id, "qr_code_url": "mock_qr_url"}
+    
+    try:
+        # 调用支付宝当面付接口生成二维码链接 (1积分 = 1元)
+        result = alipay.api_alipay_trade_precreate(
+            subject=f"ComfyUI社区积分充值 - {req.account}",
+            out_trade_no=order_id,
+            total_amount=str(req.amount), 
+        )
+        
+        if result.get("code") == "10000":
+            return {"status": "success", "order_id": order_id, "qr_code_url": result.get("qr_code")}
+        else:
+            raise HTTPException(status_code=400, detail=result.get("msg", "创建支付宝订单失败"))
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"支付网关异常: {str(e)}")
 
 @router.get("/api/wallet/check_order/{order_id}")
 async def check_order(order_id: str, db: Session = Depends(get_db)):
+    """前端轮询查单接口：主动向支付宝查询订单状态，防止异步回调延迟或丢失"""
+    if not alipay:
+        return {"status": "PENDING"}
+        
+    try:
+        # 主动向支付宝发起查单请求
+        result = alipay.api_alipay_trade_query(out_trade_no=order_id)
+        if result.get("code") == "10000" and result.get("trade_status") == "TRADE_SUCCESS":
+            
+            # 查单发现已支付，检查数据库防重复加钱
+            existing_tx = db.query(Transaction).filter(Transaction.tx_id == order_id).first()
+            if not existing_tx:
+                # 提取金额并加锁更新账户
+                amount = int(float(result.get("total_amount", 0)))
+                account = result.get("subject", "").split(" - ")[-1]
+                
+                wallet = db.query(Wallet).filter(Wallet.account == account).with_for_update().first()
+                if not wallet:
+                    wallet = Wallet(account=account)
+                    db.add(wallet)
+                
+                wallet.balance += amount
+                
+                # 手动记录一条流水，tx_id 强制绑定为支付宝的 order_id 防止重复处理
+                last_tx = db.query(Transaction).filter(Transaction.account == account).order_by(Transaction.created_at.desc()).first()
+                prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
+                tx_hash = calculate_tx_hash(order_id, account, "RECHARGE", amount, prev_hash)
+                
+                new_tx = Transaction(
+                    tx_id=order_id, account=account, tx_type="RECHARGE", amount=amount,
+                    prev_hash=prev_hash, tx_hash=tx_hash
+                )
+                db.add(new_tx)
+                db.commit()
+                
+            return {"status": "SUCCESS"}
+    except Exception:
+        pass
+        
     return {"status": "PENDING"}
 
 @router.post("/api/wallet/alipay_notify")
 async def alipay_notify(request: Request, db: Session = Depends(get_db)):
-    return {"status": "success"}
+    """支付宝异步回调 Webhook (最高优先级的到账通知)"""
+    data = dict(await request.form())
+    signature = data.pop("sign", None)
+    
+    # 核心风控：验证签名是否真的是支付宝发来的
+    if not alipay or not alipay.verify(data, signature):
+        return Response(content="fail", media_type="text/plain")
+        
+    if data.get("trade_status") in ("TRADE_SUCCESS", "TRADE_FINISHED"):
+        order_id = data.get("out_trade_no")
+        
+        # 检查是否已经被轮询查单处理过了
+        existing_tx = db.query(Transaction).filter(Transaction.tx_id == order_id).first()
+        if not existing_tx:
+            amount = int(float(data.get("total_amount", 0)))
+            account = data.get("subject", "").split(" - ")[-1]
+            
+            wallet = db.query(Wallet).filter(Wallet.account == account).with_for_update().first()
+            if not wallet:
+                wallet = Wallet(account=account)
+                db.add(wallet)
+            
+            wallet.balance += amount
+            
+            last_tx = db.query(Transaction).filter(Transaction.account == account).order_by(Transaction.created_at.desc()).first()
+            prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
+            tx_hash = calculate_tx_hash(order_id, account, "RECHARGE", amount, prev_hash)
+            
+            new_tx = Transaction(
+                tx_id=order_id, account=account, tx_type="RECHARGE", amount=amount,
+                prev_hash=prev_hash, tx_hash=tx_hash
+            )
+            db.add(new_tx)
+            db.commit()
+            
+    # 必须向支付宝返回 success，否则支付宝会按阶梯间隔持续重发请求
+    return Response(content="success", media_type="text/plain")