@seasonkoh/webaz 0.1.24 → 0.1.26

package/dist/pwa/routes/arbitrator.js

@@ -1,4 +1,7 @@
+import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerArbitratorRoutes(app, deps) {
+    // 只读/单写站点走 RFC-016 异步 seam;db 保留:apply/withdraw/approve/reject 是
+    // stake 资金路径,状态翻转 + 钱包扣/退必须原子(db.transaction + CAS),Phase 3 迁 pg 行锁。
     const { db, generateId, auth, requireArbitrationAdmin, checkArbitratorEligibility, getArbitratorState, errorRes, logAdminAction, ARB_STAKE_REQUIRED, ARB_APP_REJECT_COOLDOWN_DAYS, } = deps;
     app.get('/api/arbitrator/eligibility', (req, res) => {
         const user = auth(req, res);
@@ -12,7 +15,7 @@ export function registerArbitratorRoutes(app, deps) {
             return;
         res.json(getArbitratorState(user.id));
     });
-    app.post('/api/arbitrator/apply', (req, res) => {
+    app.post('/api/arbitrator/apply', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -20,13 +23,13 @@ export function registerArbitratorRoutes(app, deps) {
             return void errorRes(res, 403, 'ROLE_NOT_BUYER', '外部仲裁员仅 buyer 角色可申请（卖家 / 受信角色请联系管理员）');
         }
         const userId = user.id;
-        const wl = db.prepare("SELECT 1 FROM arbitrator_whitelist WHERE user_id = ?").get(userId);
+        const wl = await dbOne("SELECT 1 FROM arbitrator_whitelist WHERE user_id = ?", [userId]);
         if (wl)
             return void res.json({ error: '你已经是仲裁员，无需重新申请' });
-        const pending = db.prepare("SELECT 1 FROM arbitrator_applications WHERE user_id = ? AND status = 'pending'").get(userId);
+        const pending = await dbOne("SELECT 1 FROM arbitrator_applications WHERE user_id = ? AND status = 'pending'", [userId]);
         if (pending)
             return void res.json({ error: '你已有待审申请' });
-        const lastReject = db.prepare("SELECT reviewed_at FROM arbitrator_applications WHERE user_id = ? AND status = 'rejected' ORDER BY reviewed_at DESC LIMIT 1").get(userId);
+        const lastReject = await dbOne("SELECT reviewed_at FROM arbitrator_applications WHERE user_id = ? AND status = 'rejected' ORDER BY reviewed_at DESC LIMIT 1", [userId]);
         if (lastReject?.reviewed_at) {
             const cooldownEnd = new Date(new Date(lastReject.reviewed_at).getTime() + ARB_APP_REJECT_COOLDOWN_DAYS * 86400_000);
             if (cooldownEnd > new Date()) {
@@ -36,80 +39,143 @@ export function registerArbitratorRoutes(app, deps) {
         const elig = checkArbitratorEligibility(userId);
         if (!elig.eligible)
             return void res.json({ error: '信誉指标未达标', eligibility: elig });
+        // 友好预检查(读):真正的守恒门在事务内(WHERE balance >= stake)。
         if (ARB_STAKE_REQUIRED > 0) {
-            const wallet = db.prepare("SELECT balance, staked FROM wallets WHERE user_id = ?").get(userId);
+            const wallet = await dbOne("SELECT balance FROM wallets WHERE user_id = ?", [userId]);
             if (!wallet || wallet.balance < ARB_STAKE_REQUIRED) {
                 return void res.json({ error: `质押需 ${ARB_STAKE_REQUIRED} WAZ，钱包余额不足` });
             }
-            db.prepare("UPDATE wallets SET balance = balance - ?, staked = staked + ? WHERE user_id = ?")
-                .run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, userId);
         }
-        db.prepare("INSERT INTO arbitrator_applications (id, user_id, status, snapshot) VALUES (?,?,?,?)")
-            .run(generateId('aapp'), userId, 'pending', JSON.stringify(elig.items));
+        const appId = generateId('aapp');
+        // stake 原子段:重检 whitelist/pending(防并发双申请双质押)+ 钱包扣减(守恒 guard)+ INSERT 申请
+        try {
+            db.transaction(() => {
+                if (db.prepare("SELECT 1 FROM arbitrator_whitelist WHERE user_id = ?").get(userId))
+                    throw new Error('ARB_ALREADY');
+                if (db.prepare("SELECT 1 FROM arbitrator_applications WHERE user_id = ? AND status = 'pending'").get(userId))
+                    throw new Error('ARB_PENDING');
+                if (ARB_STAKE_REQUIRED > 0) {
+                    const debit = db.prepare("UPDATE wallets SET balance = balance - ?, staked = staked + ? WHERE user_id = ? AND balance >= ?")
+                        .run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, userId, ARB_STAKE_REQUIRED);
+                    if (debit.changes === 0)
+                        throw new Error('ARB_INSUFFICIENT');
+                }
+                db.prepare("INSERT INTO arbitrator_applications (id, user_id, status, snapshot) VALUES (?,?,?,?)")
+                    .run(appId, userId, 'pending', JSON.stringify(elig.items));
+            })();
+        }
+        catch (e) {
+            const msg = e.message;
+            if (msg === 'ARB_ALREADY')
+                return void res.json({ error: '你已经是仲裁员，无需重新申请' });
+            if (msg === 'ARB_PENDING')
+                return void res.json({ error: '你已有待审申请' });
+            if (msg === 'ARB_INSUFFICIENT')
+                return void res.json({ error: `质押需 ${ARB_STAKE_REQUIRED} WAZ，钱包余额不足` });
+            console.error('[arbitrator apply tx]', msg);
+            return void res.status(500).json({ error: '申请失败,请重试' });
+        }
         res.json({ success: true, stake_locked: ARB_STAKE_REQUIRED });
     });
-    app.post('/api/arbitrator/withdraw-application', (req, res) => {
+    app.post('/api/arbitrator/withdraw-application', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const userId = user.id;
-        const pending = db.prepare("SELECT id FROM arbitrator_applications WHERE user_id = ? AND status = 'pending' LIMIT 1").get(userId);
+        const pending = await dbOne("SELECT id FROM arbitrator_applications WHERE user_id = ? AND status = 'pending' LIMIT 1", [userId]);
         if (!pending)
             return void res.json({ error: '没有待审申请' });
-        db.prepare("UPDATE arbitrator_applications SET status='withdrawn', reviewed_at=datetime('now') WHERE id = ?").run(pending.id);
-        if (ARB_STAKE_REQUIRED > 0) {
-            db.prepare("UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?")
-                .run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, userId);
+        // 原子段:CAS 翻转 pending→withdrawn(防并发/admin 抢跑双退)+ 退质押仅在本请求真翻转时
+        try {
+            db.transaction(() => {
+                const cas = db.prepare("UPDATE arbitrator_applications SET status='withdrawn', reviewed_at=datetime('now') WHERE id = ? AND status = 'pending'").run(pending.id);
+                if (cas.changes === 0)
+                    throw new Error('ARB_RACE');
+                if (ARB_STAKE_REQUIRED > 0) {
+                    db.prepare("UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?").run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, userId);
+                }
+            })();
+        }
+        catch (e) {
+            if (e.message === 'ARB_RACE')
+                return void res.status(409).json({ error: '申请状态已变化,请刷新' });
+            console.error('[arbitrator withdraw tx]', e.message);
+            return void res.status(500).json({ error: '撤回失败,请重试' });
         }
         res.json({ success: true });
     });
     // Admin
-    app.get('/api/admin/arbitrator-applications', (req, res) => {
+    app.get('/api/admin/arbitrator-applications', async (req, res) => {
         const admin = requireArbitrationAdmin(req, res);
         if (!admin)
             return;
         const status = String(req.query.status || 'pending');
-        const items = db.prepare(`
+        const items = await dbAll(`
       SELECT aa.*, u.name as user_name, u.handle, u.region
       FROM arbitrator_applications aa
       JOIN users u ON u.id = aa.user_id
       WHERE aa.status = ?
       ORDER BY aa.applied_at DESC LIMIT 100
-    `).all(status);
+    `, [status]);
         res.json({ items });
     });
-    app.post('/api/admin/arbitrator-applications/:id/approve', (req, res) => {
+    app.post('/api/admin/arbitrator-applications/:id/approve', async (req, res) => {
         const admin = requireArbitrationAdmin(req, res);
         if (!admin)
             return;
         const { note } = req.body;
-        const appRow = db.prepare("SELECT id, user_id, status FROM arbitrator_applications WHERE id = ?").get(req.params.id);
+        const appRow = await dbOne("SELECT id, user_id, status FROM arbitrator_applications WHERE id = ?", [req.params.id]);
         if (!appRow)
             return void res.json({ error: '申请不存在' });
         if (appRow.status !== 'pending')
             return void res.json({ error: '该申请不在待审状态' });
-        db.prepare("UPDATE arbitrator_applications SET status='approved', reviewed_at=datetime('now'), reviewed_by=?, decision_note=? WHERE id=?")
-            .run(admin.id, note || null, appRow.id);
-        db.prepare(`INSERT OR REPLACE INTO arbitrator_whitelist (user_id, note, is_system, granted_by, stake_amount) VALUES (?,?,0,?,?)`)
-            .run(appRow.user_id, note || '外部仲裁员批准', admin.id, ARB_STAKE_REQUIRED);
+        // 原子段:CAS 翻转 pending→approved + 入白名单仅在本请求真翻转时(防并发双批准)
+        try {
+            db.transaction(() => {
+                const cas = db.prepare("UPDATE arbitrator_applications SET status='approved', reviewed_at=datetime('now'), reviewed_by=?, decision_note=? WHERE id=? AND status='pending'")
+                    .run(admin.id, note || null, appRow.id);
+                if (cas.changes === 0)
+                    throw new Error('ARB_RACE');
+                db.prepare(`INSERT OR REPLACE INTO arbitrator_whitelist (user_id, note, is_system, granted_by, stake_amount) VALUES (?,?,0,?,?)`)
+                    .run(appRow.user_id, note || '外部仲裁员批准', admin.id, ARB_STAKE_REQUIRED);
+            })();
+        }
+        catch (e) {
+            if (e.message === 'ARB_RACE')
+                return void res.json({ error: '该申请不在待审状态' });
+            console.error('[arbitrator approve tx]', e.message);
+            return void res.status(500).json({ error: '批准失败,请重试' });
+        }
         logAdminAction(admin.id, 'approve_arbitrator', 'user', appRow.user_id, { note });
         res.json({ success: true });
     });
-    app.post('/api/admin/arbitrator-applications/:id/reject', (req, res) => {
+    app.post('/api/admin/arbitrator-applications/:id/reject', async (req, res) => {
         const admin = requireArbitrationAdmin(req, res);
         if (!admin)
             return;
         const { note } = req.body;
-        const appRow = db.prepare("SELECT id, user_id, status FROM arbitrator_applications WHERE id = ?").get(req.params.id);
+        const appRow = await dbOne("SELECT id, user_id, status FROM arbitrator_applications WHERE id = ?", [req.params.id]);
         if (!appRow)
             return void res.json({ error: '申请不存在' });
         if (appRow.status !== 'pending')
             return void res.json({ error: '该申请不在待审状态' });
-        db.prepare("UPDATE arbitrator_applications SET status='rejected', reviewed_at=datetime('now'), reviewed_by=?, decision_note=? WHERE id=?")
-            .run(admin.id, note || null, appRow.id);
-        if (ARB_STAKE_REQUIRED > 0) {
-            db.prepare("UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?")
-                .run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, appRow.user_id);
+        // 原子段:CAS 翻转 pending→rejected + 退质押仅在本请求真翻转时(防并发双拒双退)
+        try {
+            db.transaction(() => {
+                const cas = db.prepare("UPDATE arbitrator_applications SET status='rejected', reviewed_at=datetime('now'), reviewed_by=?, decision_note=? WHERE id=? AND status='pending'")
+                    .run(admin.id, note || null, appRow.id);
+                if (cas.changes === 0)
+                    throw new Error('ARB_RACE');
+                if (ARB_STAKE_REQUIRED > 0) {
+                    db.prepare("UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?").run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, appRow.user_id);
+                }
+            })();
+        }
+        catch (e) {
+            if (e.message === 'ARB_RACE')
+                return void res.json({ error: '该申请不在待审状态' });
+            console.error('[arbitrator reject tx]', e.message);
+            return void res.status(500).json({ error: '拒绝失败,请重试' });
         }
         logAdminAction(admin.id, 'reject_arbitrator', 'user', appRow.user_id, { note });
         res.json({ success: true });