fix: accept legacy Huihui callback path for org orders

digital-avatar-app/backend/routers/tokens.py

@@ -847,6 +847,10 @@ async def huihui_org_payment_notify(request: Request, db: Session = Depends(get_
     payload = await _signed_huihui_notice(
         request, secret_name="HUIHUI_ORG_CALLBACK_SECRET", minimum_length=16,
     )
+    return _process_huihui_org_notice(payload, db)
+
+
+def _process_huihui_org_notice(payload: dict, db: Session):
     order_no = str(payload.get("orderNo") or "").strip()
     payment_no = str(payload.get("paymentNo") or "").strip()
     status = str(payload.get("status") or "").upper()
@@ -926,6 +930,16 @@ async def huihui_org_payment_notify(request: Request, db: Session = Depends(get_
 @router.post("/token/payment/huihui/virtual/notify")
 async def huihui_virtual_payment_notify(request: Request, db: Session = Depends(get_db)):
     """Server-to-server virtual-payment notice using the Huihui HMAC contract."""
+    # Older Huihui integrations still post organization recharge notices to this
+    # path.  Only use the organization key when no virtual-payment key exists;
+    # the organization handler independently checks the order's provider.
+    if len(os.getenv("HUIHUI_VIRTUAL_CALLBACK_SECRET", "").strip()) < 32 and len(
+        os.getenv("HUIHUI_ORG_CALLBACK_SECRET", "").strip()
+    ) >= 16:
+        payload = await _signed_huihui_notice(
+            request, secret_name="HUIHUI_ORG_CALLBACK_SECRET", minimum_length=16,
+        )
+        return _process_huihui_org_notice(payload, db)
     payload = await _signed_huihui_notice(
         request, secret_name="HUIHUI_VIRTUAL_CALLBACK_SECRET", minimum_length=32,
     )