Verify Huihui organization payment callbacks against paid orders

2026-10-20 11:04:27 +08:00
parent 643abd13ea
commit ce18df29b7
4 changed files with 176 additions and 18 deletions
@@ -78,6 +78,74 @@ def test_huihui_virtual_callback_requires_signature_and_exact_order_details(auth
        db.close()


+def test_huihui_org_callback_verifies_provider_before_granting_points(authorization_context):
+    seed()
+    context = authorization_context
+    provider_no = "26102010414409000001"
+    payment_no = f"WV-{context['suffix']}"
+    order_no = f"AV-{context['suffix']}"
+    db = SessionLocal()
+    try:
+        user = db.query(User).filter(User.id == context["owner"].id).one()
+        user.huihui_token = "test-huihui-token"
+        db.add(TokenPaymentOrder(
+            order_no=order_no, provider_order_no=provider_no,
+            user_id=user.id, plan_id="Basic", payment_method="wechat",
+            pay_type="WECHAT", pay_way="LITE", provider="huihui_org",
+            points_amount=2_000_000, price_cents=100, status="pending",
+        ))
+        db.commit()
+    finally:
+        db.close()
+
+    secret = "abcdefghijklmnop"
+    path = "/api/token/payment/huihui/org/notify"
+    payload = {
+        "orderNo": provider_no, "paymentNo": payment_no,
+        "status": "SUCCESS", "amountCents": 100,
+        "productId": "Basic",
+    }
+    provider_data = {
+        "orderNo": provider_no, "paymentNo": payment_no,
+        "payStatus": 1, "chargeType": 9, "chargeAmount": 1,
+        "productId": "Basic", "userId": context["owner"].huihui_user_id,
+    }
+
+    def send(body_payload, *, signature=True):
+        body = json.dumps(body_payload, separators=(",", ":")).encode()
+        headers = _huihui_virtual_headers(secret, body) if signature else {"X-Huihui-Signature": "bad"}
+        return client.post(path, content=body, headers=headers)
+
+    with patch.dict(os.environ, {"HUIHUI_ORG_CALLBACK_SECRET": secret}), patch(
+        "routers.tokens.HuihuiOrgPaymentClient"
+    ) as client_factory:
+        provider = client_factory.return_value
+        provider.get_order.return_value = provider_data
+        assert send(payload, signature=False).status_code == 401
+        assert send({**payload, "amountCents": 99}).status_code == 422
+        assert send(payload).status_code == 409
+        provider.get_order.return_value = {**provider_data, "payStatus": 2}
+        assert send({**payload, "paymentNo": "wrong"}).status_code == 422
+        provider.get_order.return_value = {**provider_data, "payStatus": 2, "chargeAmount": 2}
+        assert send(payload).status_code == 422
+        provider.get_order.return_value = {**provider_data, "payStatus": 2}
+        first = send(payload)
+        second = send(payload)
+
+    assert first.status_code == 200
+    assert first.json()["data"] == {"received": True, "paid": True}
+    assert second.json()["data"] == {"received": True, "duplicate": True}
+    db = SessionLocal()
+    try:
+        order = db.query(TokenPaymentOrder).filter(TokenPaymentOrder.order_no == order_no).one()
+        account = db.query(TokenAccount).filter(TokenAccount.user_id == context["owner"].id).one()
+        assert order.status == "paid"
+        assert account.balance == DEFAULT_TOKEN_GRANT + 2_000_000
+        assert provider.get_order.call_count >= 3
+    finally:
+        db.close()
+
+
 def _signature(token, timestamp, nonce):
    return hashlib.sha1("".join(sorted([token, timestamp, nonce])).encode()).hexdigest()