trustbase-seller-backend 0.2.4 → 0.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/payments/wechat/profitsharing.js

@@ -14,6 +14,7 @@
  *           且 ≤ 交易金额本身; 护栏在 mock 模式同样生效 (先于一切网络调用)。
  */
 const agentPay = require("../../routes/agent-pay");
+const crypto = require("crypto");
 
 const MAX_SHARE_BP = 3000; // 单笔分账 ≤ 交易金额 30% (硬顶)
 
@@ -51,6 +52,8 @@ async function wxCall(method, urlPath, bodyObj) {
             "Accept": "application/json",
             // 微信 APIv3 拒 undici 默认 Accept-Language: * (2026-09-25 实测 PARAM_ERROR) — 与 agent-pay wxApiCall 对齐
             "Accept-Language": "zh-CN",
+            // 分账等接口要求微信支付公钥 ID/平台证书序列号头 (2026-09-26 实测 PARAM_ERROR); SP 模式用 SP 公钥 ID
+            "Wechatpay-Serial": process.env.WXPAY_SP_PUBLIC_KEY_ID || process.env.WXPAY_PUBLIC_KEY_ID || c.spSerial || c.serial || "",
             "User-Agent": "trustbase-seller-backend/1.0",
         },
         body: method === "GET" ? undefined : bodyStr,
@@ -78,7 +81,8 @@ function assertShareAmount(tradeAmount, shareAmount) {
 }
 
 /** 添加分账接收方 (服务商自己 mchid 或指定商户号)
- *  receivers: [{account, type?, name?, relation_type?, sub_mchid?}] */
+ *  receivers: [{account, type?, name?, relation_type?, sub_mchid?}]
+ *  2026-09-26 实测: name 是敏感字段, 真调必须微信支付公钥 RSA-OAEP 加密 (否则 PARAM_ERROR "是否为加密后的密文") */
 async function addReceivers(receivers) {
     const c = wxCfg();
     const list = Array.isArray(receivers) ? receivers : [receivers];
@@ -92,7 +96,7 @@ async function addReceivers(receivers) {
             account: String(rcv.account),
             relation_type: rcv.relation_type || "SERVICE_PROVIDER",
         };
-        if (rcv.name) body.name = String(rcv.name); // MERCHANT_ID 真调时微信要求 name
+        if (rcv.name) body.name = c.enabled ? encryptReceiverName(String(rcv.name)) : String(rcv.name); // MERCHANT_ID 真调时微信要求 name (加密)
         if (c.spMchid) {
             body.sp_mchid = c.spMchid;
             if (rcv.sub_mchid) body.sub_mchid = String(rcv.sub_mchid);
@@ -103,6 +107,17 @@ async function addReceivers(receivers) {
     return results.length === 1 ? results[0] : results;
 }
 
+/** 接收方名称加密: 微信支付公钥 RSA-OAEP-SHA256 → base64 (与进件敏感字段同口径) */
+function encryptReceiverName(name) {
+    const p = process.env.WXPAY_SP_PUBLIC_KEY_PATH || process.env.WXPAY_PUBLIC_KEY_PATH;
+    if (!p) throw new Error("WXPAY_(SP_)PUBLIC_KEY_PATH 未配置, 接收方名称无法加密");
+    const pem = require("fs").readFileSync(p, "utf8");
+    return crypto.publicEncrypt(
+        { key: pem, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
+        Buffer.from(name, "utf8")
+    ).toString("base64");
+}
+
 /** 请求分账
  *  params: {outTradeNo(分账单号 out_order_no, 幂等键), transactionId(微信支付单号),
  *           tradeAmount(交易金额分, 护栏基准), subMchid?, unfreezeUnsplit?,
@@ -169,13 +184,15 @@ async function registerDefaultReceivers(db) {
         console.warn("[profitsharing] 未配 WXPAY_SP_MCHID/WXPAY_MCHID, 跳过接收方注册");
         return { registered: false, reason: "no_mchid" };
     }
-    const row = db.prepare("SELECT account FROM sp_ps_receivers WHERE account = ?").get(account);
-    if (row) return { registered: false, reason: "already" };
+    const row = db.prepare("SELECT account, mock FROM sp_ps_receivers WHERE account = ?").get(account);
+    // mock 落行不挡真调: mock=1 且当前真调模式 → 重新真调注册 (2026-09-26 实测: mock 期落的行把真调永久挡死)
+    const realMode = /^(1|true|yes|on)$/i.test(process.env.WXPAY_PROFITSHARING_ENABLED || "");
+    if (row && !(row.mock && realMode)) return { registered: false, reason: "already" };
     const r = await addReceivers([{ account, type: "MERCHANT_ID", name: process.env.SP_NAME || "服务商" }]);
     const one = Array.isArray(r) ? r[0] : r;
     const ok = !!(one && (one.mock || one.status === 200));
     if (ok) {
-        db.prepare("INSERT OR IGNORE INTO sp_ps_receivers (account, registered_at, mock) VALUES (?,?,?)")
+        db.prepare("INSERT INTO sp_ps_receivers (account, registered_at, mock) VALUES (?,?,?) ON CONFLICT(account) DO UPDATE SET registered_at=excluded.registered_at, mock=excluded.mock")
             .run(account, Math.floor(Date.now() / 1000), one.mock ? 1 : 0);
         console.log(`[profitsharing] 分账接收方已注册 account=${account} mock=${!!one.mock}`);
         return { registered: true, mock: !!one.mock };

package/routes/agent-pay.js

@@ -5,8 +5,14 @@
  * 职责:
  *   POST /api/agent/pay/session        E1 支付会话 (幂等/服务端报价/软持有/双token/PSP下单)
  *   POST /api/agent/pay/notify/wechat  E2 微信回调 (APIv3 验签+AES-GCM 解密+查重+金额核对+落账链)
+ *                                      M4: TRANSACTION.REFUND 退款事件 → REFUNDED
  *   POST /api/agent/pay/mock-pay       mock 沙箱 (仅 AGENT_PAY_MODE=mock, 模拟PSP回调)
- *   GET  /api/agent/order/status       状态查询 (session权威 + 链事实镜像)
+ *   GET  /api/agent/order/status       状态查询 (session权威 + 链事实镜像; M4: DISPUTED/REFUNDED 不再误映射 PAID, rail 真实值)
+ *   POST /api/agent/order/confirm      M4 买家确认收货 (DELIVERED→CONFIRMED, status_token 即买家凭证)
+ *   POST /api/agent/internal/logistics M4 物流推送 (HMAC 共享密钥头 x-logistics-key 鉴权, env LOGISTICS_HMAC_KEY;
+ *                                      状态机单向 PAID/ON_CHAIN→SHIPPED→DELIVERED, timeline 追加不覆盖)
+ *   M4 状态机: ON_CHAIN 由 markOrderOnChain() 回写 (链上建单需买家 tct1, 匿名法币单留 PAID 不强上链);
+ *   status_token 丢失暂无法自助找回 (🔵 后续), 需人工。
  *   对账轮询 E3: reconcileSweep() 由外层定时调用
  *
  * 设计依据: prd-docs/开发文档/trustbase-agent-commerce-协议方案-2026-09-20.md
@@ -384,7 +390,9 @@ function createAgentPayRouter(deps) {
         const acceptExpired = prevState === "EXPIRED" && (Date.now() / 1000) < sessionRow.expires_at + GRACE_AFTER_EXPIRY_MS / 1000;
         db.prepare("UPDATE agent_pay_sessions SET state='PAID', psp_txn_id=?, updated_at=? WHERE id=?").run(txnId, now, sessionRow.id);
         console.log(`[agent-pay] PAID ${sessionRow.order_ref} txn=${txnId} rail=${rail}${acceptExpired ? " (expired+grace accepted)" : ""}`);
-        // 触发既有链同步与 C5 申报 → 由插件 hook 侧/后续 E6 接线; 此处先置状态。
+        // M4: PAID → ON_CHAIN 占位 — 链上建单需买家 tct1 地址, 匿名法币单不强上链
+        // (链上订单是增强不是阻塞)。当前会话不存买家地址 (agent_addr 是归因哈希),
+        // 链上建单接线后由 markOrderOnChain(db, orderRef, chainOrderId) 回写 state/chain_order_id。
         return { ok: true, state: "PAID", grace: acceptExpired };
     }
 
@@ -427,6 +435,21 @@ function createAgentPayRouter(deps) {
                 return res.status(400).json({ code: "FAIL", message: "no resource" });
             }
             const plain = wxDecryptNotifyResource(resource);
+            // M4: 退款事件 (TRANSACTION.REFUND) — resource 是退款单 (refund_status), 不是支付单
+            if (body.event_type === "TRANSACTION.REFUND") {
+                const outRef = plain.out_trade_no;
+                const rRow = outRef && db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref = ?").get(outRef);
+                if (!rRow) return res.status(404).json({ code: "FAIL", message: "NOT_FOUND" });
+                if (plain.refund_status === "SUCCESS") {
+                    if (rRow.state !== "REFUNDED") {
+                        db.prepare("UPDATE agent_pay_sessions SET state='REFUNDED', updated_at=? WHERE id=?").run(nowSec(), rRow.id);
+                        console.log(`[agent-pay] REFUNDED ${outRef} refund_id=${plain.refund_id || ""}`);
+                    }
+                    return res.status(200).json({ code: "SUCCESS", refunded: true });
+                }
+                // 退款处理中/异常: 确认收到不改状态
+                return res.status(200).json({ code: "SUCCESS", ignored: plain.refund_status || "REFUND_PROCESSING" });
+            }
             const out = plain.out_trade_no;
             const row = out && db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref = ?").get(out);
             if (!row) return res.status(404).json({ code: "FAIL", message: "NOT_FOUND" });
@@ -454,7 +477,9 @@ function createAgentPayRouter(deps) {
         res.json(r.error ? r : { ok: true, state: r.state, grace: !!r.grace });
     });
 
-    /** 状态查询 (E4 后端部分: session 权威 + 链事实镜像) */
+    /** 状态查询 (E4 后端部分: session 权威 + 链事实镜像)
+     *  M4 修正: payment.state 不再把 DISPUTED/REFUNDED 误映射成 PAID; rail 取真实支付轨
+     *  (psp_txns 最新一条的 rail, 未支付回落 MODE)。 */
     router.get("/order/status", (req, res) => {
         const q = req.query || {};
         const row = db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref = ?").get(q.order_ref);
@@ -463,10 +488,16 @@ function createAgentPayRouter(deps) {
         const chain = row.chain_order_id
             ? db.prepare("SELECT txhash FROM chain_write_log WHERE order_id = ?").get(row.chain_order_id)
             : null;
+        // payment.state 映射: 已支付族 → PAID; 其余原样 (UNPAID/DISPUTED/REFUNDED/CLOSED)
+        const PAID_STATES = ["PAID", "ON_CHAIN", "SHIPPED", "DELIVERED", "CONFIRMED"];
+        const payState = PAID_STATES.includes(row.state) ? "PAID"
+            : (row.state === "CREATED" || row.state === "EXPIRED" ? "UNPAID" : row.state);
+        // rail 真实值: psp_txns 最新一条; 未支付 → 当前 MODE
+        const txn = db.prepare("SELECT rail FROM psp_txns WHERE session_id = ? ORDER BY created_at DESC LIMIT 1").get(row.id);
         res.json({
             order_ref: row.order_ref, chain_order_id: row.chain_order_id || null,
             state: row.state,
-            payment: { state: row.state === "CREATED" || row.state === "EXPIRED" ? "UNPAID" : "PAID", rail: "mock", txn_id: row.psp_txn_id || null },
+            payment: { state: payState, rail: txn ? txn.rail : MODE, txn_id: row.psp_txn_id || null },
             amount: { currency: row.currency, total: row.amount_total },
             agent_addr: row.agent_addr || null,
             chain_tx: chain ? chain.txhash : null,
@@ -481,28 +512,72 @@ function createAgentPayRouter(deps) {
         res.json({ ok: !r.error, ...r });
     });
 
-    /** E4': 物流推送接收 (ShopXO 发货 hook → 这里; PoC LAN 无鉴权, order_ref 为主键) */
+    /** E4': 物流推送接收 (ShopXO 发货 hook → 这里)
+     *  M4 (2026-10-03): ① 鉴权修复 — env LOGISTICS_HMAC_KEY 共享密钥头 (x-logistics-key)
+     *  比对, 未配置 env 全拒 (PoC 裸奔是审查 🔴); ② 状态机单向 — PAID/ON_CHAIN→SHIPPED,
+     *  SHIPPED→SHIPPED(更新)/DELIVERED, DELIVERED→DELIVERED(幂等), 回退 409;
+     *  ③ timeline 追加不覆盖。 */
+    function logisticsAuthed(req) {
+        const key = process.env.LOGISTICS_HMAC_KEY || "";
+        if (!key) return false; // 未配置 = 全拒 (宁可全拒不留后门)
+        const got = String(req.headers["x-logistics-key"] || "");
+        if (!got || got.length !== key.length) return false;
+        return crypto.timingSafeEqual(Buffer.from(got), Buffer.from(key));
+    }
     router.post("/internal/logistics", (req, res) => {
         try {
+            if (!logisticsAuthed(req)) {
+                return err(res, 401, "LOGISTICS_UNAUTHORIZED", { hint: "x-logistics-key 头缺失或错误 (env LOGISTICS_HMAC_KEY)" });
+            }
             const b = req.body || {};
             if (!b.order_ref) return err(res, 400, "order_ref 必填 (E6 后自动写入 ShopXO 订单备注, 当前由插件穿参)");
             const row = db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref = ?").get(b.order_ref);
             if (!row) return err(res, 404, "NOT_FOUND");
             const now = nowSec();
-            // 状态机: 仅 PAID/ON_CHAIN 可转 SHIPPED
-            if (!["PAID", "ON_CHAIN", "SHIPPED", "DELIVERED"].includes(row.state)) {
-                return err(res, 409, "STATE_INVALID", { current: row.state });
+            const cur = row.state;
+            const target = String(b.logistics_state || "SHIPPED") === "DELIVERED" ? "DELIVERED" : "SHIPPED";
+            // 单向状态机 (回退拒):
+            const allowed =
+                ((cur === "PAID" || cur === "ON_CHAIN") && target === "SHIPPED") ||
+                (cur === "SHIPPED" && (target === "SHIPPED" || target === "DELIVERED")) ||
+                (cur === "DELIVERED" && target === "DELIVERED");
+            if (!allowed) {
+                return err(res, 409, "STATE_INVALID", { current: cur, target, hint: "状态机单向: PAID/ON_CHAIN→SHIPPED→DELIVERED, 不允许回退" });
             }
-            db.prepare("UPDATE agent_pay_sessions SET state='SHIPPED', carrier=?, tracking_no=?, logistics_state=?, timeline=?, shopxo_order_no_ref=?, updated_at=? WHERE id=?")
-                .run(String(b.carrier || ""), String(b.tracking_no || ""), String(b.logistics_state || "SHIPPED"), JSON.stringify(b.timeline || []), String(b.shopxo_order_no || ""), now, row.id);
-            console.log(`[agent-pay] SHIPPED ${b.order_ref} carrier=${b.carrier} tracking=${b.tracking_no}`);
-            res.json({ ok: true, state: "SHIPPED" });
+            // timeline 追加不覆盖 (M4 修复: 旧实现整体覆盖丢历史)
+            const timeline = JSON.parse(row.timeline || "[]").concat(Array.isArray(b.timeline) ? b.timeline : []);
+            db.prepare("UPDATE agent_pay_sessions SET state=?, carrier=?, tracking_no=?, logistics_state=?, timeline=?, shopxo_order_no_ref=?, updated_at=? WHERE id=?")
+                .run(target, String(b.carrier || row.carrier || ""), String(b.tracking_no || row.tracking_no || ""),
+                    target, JSON.stringify(timeline), String(b.shopxo_order_no || row.shopxo_order_no_ref || ""), now, row.id);
+            console.log(`[agent-pay] ${target} ${b.order_ref} carrier=${b.carrier} tracking=${b.tracking_no}`);
+            res.json({ ok: true, state: target });
         } catch (e) {
             console.error("[agent-pay] logistics error:", e && e.message);
             err(res, 500, "internal");
         }
     });
 
+    /** M4: 买家确认收货 (DELIVERED → CONFIRMED) — status_token 即买家凭证 (买家在卖家后端
+     *  无账号体系, status_token 是签收时签发的唯一凭证; 丢失暂无法自助找回, 需人工 (🔵 后续)) */
+    router.post("/order/confirm", (req, res) => {
+        try {
+            const b = req.body || {};
+            const row = db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref = ?").get(b.order_ref);
+            if (!row) return err(res, 404, "NOT_FOUND");
+            if (sha256(String(b.token || "")) !== row.status_token_hash) return err(res, 401, "TOKEN_INVALID");
+            if (row.state === "CONFIRMED") return res.json({ ok: true, state: "CONFIRMED", idempotent: true });
+            if (row.state !== "DELIVERED") {
+                return err(res, 409, "STATE_INVALID", { current: row.state, expect: "DELIVERED", hint: "买家确认收货仅允许 DELIVERED → CONFIRMED" });
+            }
+            db.prepare("UPDATE agent_pay_sessions SET state='CONFIRMED', updated_at=? WHERE id=?").run(nowSec(), row.id);
+            console.log(`[agent-pay] CONFIRMED ${row.order_ref} (买家确认收货)`);
+            res.json({ ok: true, state: "CONFIRMED" });
+        } catch (e) {
+            console.error("[agent-pay] confirm error:", e && e.message);
+            err(res, 500, "internal");
+        }
+    });
+
     /** E-ONBOARD: 商家入驻提交 */
     router.post("/onboard/submit", (req, res) => {
         try {
@@ -563,4 +638,15 @@ function startReconcile(db) {
     return timer;
 }
 
-module.exports = { createAgentPayRouter, startReconcile, runReconcileOnce, wxSignAuth, wxAesGcmDecrypt, wxVerifyNotifySignature, wxDecryptNotifyResource, wxNativeOrder, wxQueryOrder, refreshPlatformCerts };
+/** M4: PAID → ON_CHAIN 回写 (链上建单成功后由后续批次调用; 仅 PAID 可转, 幂等键 chain_order_id) */
+function markOrderOnChain(db, orderRef, chainOrderId) {
+    const row = db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref = ?").get(orderRef);
+    if (!row) return { ok: false, error: "NOT_FOUND" };
+    if (row.state === "ON_CHAIN") return { ok: true, state: "ON_CHAIN", idempotent: true };
+    if (row.state !== "PAID") return { ok: false, error: "STATE_INVALID", current: row.state };
+    db.prepare("UPDATE agent_pay_sessions SET state='ON_CHAIN', chain_order_id=?, updated_at=? WHERE id=?")
+        .run(String(chainOrderId), nowSec(), row.id);
+    return { ok: true, state: "ON_CHAIN" };
+}
+
+module.exports = { createAgentPayRouter, startReconcile, runReconcileOnce, markOrderOnChain, wxSignAuth, wxAesGcmDecrypt, wxVerifyNotifySignature, wxDecryptNotifyResource, wxNativeOrder, wxQueryOrder, refreshPlatformCerts };

package/routes/order.js

@@ -219,18 +219,11 @@ function createOrderRoutes(authPlugin, deps) {
     /**
      * 获取订单详情
      * GET /api/order/:orderId
+     * M4 (2026-10-03): 公开只读 — 纯 LCD 链上数据透传 (订单内容本就链上公开),
+     * 买家在卖家后端无凭证, 之前 401 是误伤。写操作 (confirm/cancel/dispute) 鉴权不变。
      */
     router.get('/:orderId', async (req, res) => {
         try {
-            const authHeader = req.headers.authorization;
-            if (!authHeader || !authHeader.startsWith('Bearer ')) {
-                return res.status(401).json({ error: 'Missing authorization header' });
-            }
-            const token = authHeader.substring(7);
-            const tokenData = await authPlugin.verifyToken(token);
-            if (!tokenData) {
-                return res.status(401).json({ error: 'Invalid token' });
-            }
             const { orderId } = req.params;
             const response = await fetch(`${lcdUrl}/oxiaom/trustchain/order/v1/orders/${orderId}`);
             if (!response.ok) {
@@ -247,18 +240,10 @@ function createOrderRoutes(authPlugin, deps) {
     /**
      * 获取买家订单列表
      * GET /api/order/buyer/:address
+     * M4: 公开只读 (链上公开数据透传, 无卖家敏感信息)
      */
     router.get('/buyer/:address', async (req, res) => {
         try {
-            const authHeader = req.headers.authorization;
-            if (!authHeader || !authHeader.startsWith('Bearer ')) {
-                return res.status(401).json({ error: 'Missing authorization header' });
-            }
-            const token = authHeader.substring(7);
-            const tokenData = await authPlugin.verifyToken(token);
-            if (!tokenData) {
-                return res.status(401).json({ error: 'Invalid token' });
-            }
             const { address } = req.params;
             const response = await fetch(`${lcdUrl}/oxiaom/trustchain/order/v1/buyers/${address}/orders`);
             if (!response.ok) {

package/test-agent-pay-lifecycle.js

@@ -0,0 +1,186 @@
+"use strict";
+/**
+ * test-agent-pay-lifecycle.js — M4 买家维度: agent-pay 状态机断头路修复 + order.js 买家只读面公开化
+ * node --test test-agent-pay-lifecycle.js
+ *
+ * 覆盖:
+ *   状态机全链 PAID→SHIPPED→DELIVERED→CONFIRMED (logistics HMAC + confirm status_token)
+ *   回退拒 (DELIVERED→SHIPPED 409) + timeline 追加不覆盖 + logistics 无 key/错 key 401
+ *   状态查询: rail 真实值 (psp_txns) + DISPUTED/REFUNDED 不再误映射 PAID
+ *   markOrderOnChain: PAID→ON_CHAIN 回写 chain_order_id (占位函数, 后续批次触发)
+ *   order.js: 买家只读面 (单查/买家列表) 无 token 200; 写操作 (confirm/cancel/dispute) 仍 401
+ * 不碰真微信/真链 (打桩 LCD)。
+ */
+const test = require("node:test");
+const assert = require("node:assert");
+const crypto = require("crypto");
+const http = require("http");
+const express = require("express");
+const Database = require("better-sqlite3");
+
+const agentPay = require("./routes/agent-pay");
+const { createOrderRoutes } = require("./routes/order");
+
+function nowSec() { return Math.floor(Date.now() / 1000); }
+function sha256(s) { return crypto.createHash("sha256").update(String(s)).digest("hex"); }
+
+/** 起 agent-pay 服务 (mock 模式) */
+async function startAgentPay() {
+    const db = new Database(":memory:");
+    const app = express();
+    app.use(express.json());
+    app.use("/api/agent", agentPay.createAgentPayRouter({ db }));
+    const srv = app.listen(0);
+    await new Promise((r) => srv.once("listening", r));
+    return { db, srv, base: `http://127.0.0.1:${srv.address().port}/api/agent` };
+}
+
+function insertPaidSession(db, orderRef, statusToken) {
+    db.prepare(`INSERT INTO agent_pay_sessions
+ (client_session_id, sku_id, qty, amount_total, currency, agent_addr, order_ref, pay_token_hash, status_token_hash, state, psp_code_url, callback_url, expires_at, created_at, updated_at)
+ VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`)
+        .run("cs-" + orderRef, "sku-1", 1, 100, "CNY", "", orderRef, sha256("pt-" + orderRef), sha256(statusToken), "PAID", "", "", nowSec() + 900, nowSec(), nowSec());
+}
+
+const LKEY = "test-logistics-hmac-key";
+
+test("M4 状态机全链: PAID→SHIPPED→DELIVERED→CONFIRMED + 回退拒 + timeline 追加 + HMAC 鉴权", async () => {
+    process.env.LOGISTICS_HMAC_KEY = LKEY;
+    const { db, srv, base } = await startAgentPay();
+    try {
+        insertPaidSession(db, "tb-lc-1", "st-lc-1");
+        const H = { "Content-Type": "application/json", "x-logistics-key": LKEY };
+        // 无 key → 401; 错 key → 401
+        let r = await fetch(base + "/internal/logistics", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ order_ref: "tb-lc-1" }) });
+        assert.strictEqual(r.status, 401, "无 key 拒");
+        r = await fetch(base + "/internal/logistics", { method: "POST", headers: { "Content-Type": "application/json", "x-logistics-key": "wrong" }, body: JSON.stringify({ order_ref: "tb-lc-1" }) });
+        assert.strictEqual(r.status, 401, "错 key 拒");
+        // PAID → SHIPPED
+        r = await fetch(base + "/internal/logistics", { method: "POST", headers: H, body: JSON.stringify({ order_ref: "tb-lc-1", carrier: "顺丰", tracking_no: "SF123", timeline: [{ t: "揽收" }] }) });
+        assert.strictEqual((await r.json()).state, "SHIPPED");
+        // SHIPPED → SHIPPED 更新, timeline 追加不覆盖
+        r = await fetch(base + "/internal/logistics", { method: "POST", headers: H, body: JSON.stringify({ order_ref: "tb-lc-1", timeline: [{ t: "运输中" }] }) });
+        assert.strictEqual((await r.json()).state, "SHIPPED");
+        let row = db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref='tb-lc-1'").get();
+        assert.strictEqual(JSON.parse(row.timeline).length, 2, "timeline 追加不覆盖");
+        assert.strictEqual(row.carrier, "顺丰", "carrier 保留 (未传不清空)");
+        // SHIPPED → DELIVERED
+        r = await fetch(base + "/internal/logistics", { method: "POST", headers: H, body: JSON.stringify({ order_ref: "tb-lc-1", logistics_state: "DELIVERED", timeline: [{ t: "签收" }] }) });
+        assert.strictEqual((await r.json()).state, "DELIVERED");
+        // 回退 DELIVERED → SHIPPED → 409
+        r = await fetch(base + "/internal/logistics", { method: "POST", headers: H, body: JSON.stringify({ order_ref: "tb-lc-1", logistics_state: "SHIPPED" }) });
+        assert.strictEqual(r.status, 409);
+        let ej = await r.json();
+        assert.strictEqual(ej.current, "DELIVERED", "回退被拒 (STATE_INVALID 详情带 current)");
+        assert.strictEqual(ej.target, "SHIPPED");
+        // DELIVERED → CONFIRMED (买家确认收货, status_token 凭证)
+        r = await fetch(base + "/order/confirm", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ order_ref: "tb-lc-1", token: "wrong-token" }) });
+        assert.strictEqual(r.status, 401, "错 status_token 拒");
+        r = await fetch(base + "/order/confirm", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ order_ref: "tb-lc-1", token: "st-lc-1" }) });
+        assert.strictEqual((await r.json()).state, "CONFIRMED");
+        // 幂等
+        r = await fetch(base + "/order/confirm", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ order_ref: "tb-lc-1", token: "st-lc-1" }) });
+        assert.strictEqual((await r.json()).idempotent, true);
+        // 终态后物流回退仍拒
+        r = await fetch(base + "/internal/logistics", { method: "POST", headers: H, body: JSON.stringify({ order_ref: "tb-lc-1", logistics_state: "SHIPPED" }) });
+        assert.strictEqual(r.status, 409);
+        // 状态查询: 全链后 payment.state=PAID + rail 真实
+        const st = await (await fetch(base + "/order/status?order_ref=tb-lc-1&token=st-lc-1")).json();
+        assert.strictEqual(st.state, "CONFIRMED");
+        assert.strictEqual(st.payment.state, "PAID");
+        assert.strictEqual(st.logistics.state, "DELIVERED");
+        assert.strictEqual(st.logistics.timeline.length, 3);
+    } finally { srv.close(); delete process.env.LOGISTICS_HMAC_KEY; }
+});
+
+test("M4: logistics 未配置 LOGISTICS_HMAC_KEY → 全拒 401 (宁可全拒不留后门)", async () => {
+    delete process.env.LOGISTICS_HMAC_KEY;
+    const { srv, base } = await startAgentPay();
+    try {
+        const r = await fetch(base + "/internal/logistics", { method: "POST", headers: { "Content-Type": "application/json", "x-logistics-key": "any" }, body: JSON.stringify({ order_ref: "x" }) });
+        assert.strictEqual(r.status, 401);
+    } finally { srv.close(); }
+});
+
+test("M4: 状态查询 payment.state 映射修正 (DISPUTED/REFUNDED 不再是 PAID) + rail 真实值", async () => {
+    const { db, srv, base } = await startAgentPay();
+    try {
+        // DISPUTED (金额不一致落账队列)
+        insertPaidSession(db, "tb-st-1", "st-1");
+        db.prepare("UPDATE agent_pay_sessions SET state='DISPUTED' WHERE order_ref='tb-st-1'").run();
+        db.prepare("INSERT INTO psp_txns (txn_id, session_id, rail, amount, raw, created_at) VALUES ('tx-st-1', (SELECT id FROM agent_pay_sessions WHERE order_ref='tb-st-1'), 'wechat_native', 100, '', ?)").run(nowSec());
+        let st = await (await fetch(base + "/order/status?order_ref=tb-st-1&token=st-1")).json();
+        assert.strictEqual(st.payment.state, "DISPUTED", "DISPUTED 不映射 PAID");
+        assert.strictEqual(st.payment.rail, "wechat_native", "rail 取 psp_txns 真实轨 (不是硬编码 mock)");
+        // REFUNDED
+        insertPaidSession(db, "tb-st-2", "st-2");
+        db.prepare("UPDATE agent_pay_sessions SET state='REFUNDED' WHERE order_ref='tb-st-2'").run();
+        st = await (await fetch(base + "/order/status?order_ref=tb-st-2&token=st-2")).json();
+        assert.strictEqual(st.payment.state, "REFUNDED");
+        // CREATED → UNPAID, rail 回落 MODE (mock)
+        insertPaidSession(db, "tb-st-3", "st-3");
+        db.prepare("UPDATE agent_pay_sessions SET state='CREATED' WHERE order_ref='tb-st-3'").run();
+        st = await (await fetch(base + "/order/status?order_ref=tb-st-3&token=st-3")).json();
+        assert.strictEqual(st.payment.state, "UNPAID");
+        assert.strictEqual(st.payment.rail, "mock");
+    } finally { srv.close(); }
+});
+
+test("M4: markOrderOnChain — PAID→ON_CHAIN 回写 chain_order_id (占位函数, 后续批次触发)", async () => {
+    const { db, srv } = await startAgentPay();
+    try {
+        insertPaidSession(db, "tb-oc-1", "st-oc");
+        const r = agentPay.markOrderOnChain(db, "tb-oc-1", "chain-order-42");
+        assert.strictEqual(r.ok, true);
+        const row = db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref='tb-oc-1'").get();
+        assert.strictEqual(row.state, "ON_CHAIN");
+        assert.strictEqual(row.chain_order_id, "chain-order-42");
+        // 幂等 + 非法态
+        assert.strictEqual(agentPay.markOrderOnChain(db, "tb-oc-1", "chain-order-42").idempotent, true);
+        db.prepare("UPDATE agent_pay_sessions SET state='CONFIRMED' WHERE order_ref='tb-oc-1'").run();
+        assert.strictEqual(agentPay.markOrderOnChain(db, "tb-oc-1", "x").error, "STATE_INVALID");
+        assert.strictEqual(agentPay.markOrderOnChain(db, "tb-nope", "x").error, "NOT_FOUND");
+    } finally { srv.close(); }
+});
+
+test("M4: order.js 买家只读面公开 (单查/买家列表无 token 200), 写操作仍 401", async () => {
+    // 打桩 LCD (链上公开数据)
+    const stub = http.createServer((req, res) => {
+        res.setHeader("content-type", "application/json");
+        if (req.url.startsWith("/oxiaom/trustchain/order/v1/orders/")) {
+            return res.end(JSON.stringify({ order: { order_id: "7", buyer: "tct1buyer", seller: "tct1seller", status: "ORDER_STATUS_PAID" } }));
+        }
+        if (req.url.startsWith("/oxiaom/trustchain/order/v1/buyers/")) {
+            return res.end(JSON.stringify({ orders: [{ order_id: "7" }] }));
+        }
+        res.writeHead(404); res.end("{}");
+    });
+    await new Promise((r) => stub.listen(0, "127.0.0.1", r));
+    const savedLcd = process.env.LCD_URL;
+    process.env.LCD_URL = `http://127.0.0.1:${stub.address().port}`;
+    const db = new Database(":memory:");
+    const app = express();
+    app.use(express.json());
+    const authPlugin = { verifyToken: async () => null }; // 写操作鉴权桩: 任何 token 都无效 → 写操作恒 401
+    app.use("/api/order", createOrderRoutes(authPlugin, { db }));
+    const srv = app.listen(0);
+    await new Promise((r) => srv.once("listening", r));
+    const base = `http://127.0.0.1:${srv.address().port}/api/order`;
+    try {
+        // 买家只读面: 无 token 可查
+        let r = await fetch(base + "/7");
+        assert.strictEqual(r.status, 200, "单查公开");
+        assert.strictEqual((await r.json()).order.order_id, "7");
+        r = await fetch(base + "/buyer/tct1buyer");
+        assert.strictEqual(r.status, 200, "买家列表公开");
+        assert.strictEqual((await r.json()).orders.length, 1);
+        // 写操作仍 401 (无 token)
+        for (const p of ["/confirm", "/cancel", "/dispute"]) {
+            const w = await fetch(base + p, { method: "POST", headers: { "Content-Type": "application/json" }, body: "{}" });
+            assert.strictEqual(w.status, 401, p + " 写操作保持鉴权");
+        }
+    } finally {
+        srv.close(); stub.close();
+        if (savedLcd === undefined) delete process.env.LCD_URL; else process.env.LCD_URL = savedLcd;
+    }
+});

package/test-agent-pay-wechat.js

@@ -258,3 +258,34 @@ test("E3 回归 (2026-09-25 实测 bug): EXPIRED 单过期 <24h 仍被查单,
     assert.ok(!refs.includes("tb-rec-2"), "过期 25h 的 EXPIRED 单不进查单范围");
     delete process.env.AGENT_PAY_MODE;
 });
+
+test("M4: E2 退款事件 TRANSACTION.REFUND → REFUNDED (幂等 + 处理中忽略)", async () => {
+    const { db, srv, base } = await startServer();
+    try {
+        insertSession(db, "tb-refund-1", 100);
+        db.prepare("UPDATE agent_pay_sessions SET state='PAID' WHERE order_ref='tb-refund-1'").run();
+        const body = JSON.stringify({
+            id: "EV-R1", event_type: "TRANSACTION.REFUND", resource_type: "encrypt-resource",
+            resource: wxEncryptResource({ out_trade_no: "tb-refund-1", refund_status: "SUCCESS", refund_id: "RF-1" }),
+        });
+        const r = await fetch(base + "/pay/notify/wechat", { method: "POST", headers: wxSignHeaders(body), body });
+        assert.strictEqual(r.status, 200);
+        assert.strictEqual((await r.json()).refunded, true);
+        assert.strictEqual(db.prepare("SELECT state FROM agent_pay_sessions WHERE order_ref='tb-refund-1'").get().state, "REFUNDED");
+        // 重放幂等: 仍 200 refunded, 状态保持
+        const r2 = await fetch(base + "/pay/notify/wechat", { method: "POST", headers: wxSignHeaders(body), body });
+        assert.strictEqual(r2.status, 200);
+        assert.strictEqual(db.prepare("SELECT state FROM agent_pay_sessions WHERE order_ref='tb-refund-1'").get().state, "REFUNDED");
+        // 退款处理中 → ignored 不改状态
+        insertSession(db, "tb-refund-2", 100);
+        db.prepare("UPDATE agent_pay_sessions SET state='SHIPPED' WHERE order_ref='tb-refund-2'").run();
+        const body2 = JSON.stringify({
+            id: "EV-R2", event_type: "TRANSACTION.REFUND", resource_type: "encrypt-resource",
+            resource: wxEncryptResource({ out_trade_no: "tb-refund-2", refund_status: "PROCESSING", refund_id: "RF-2" }),
+        });
+        const r3 = await fetch(base + "/pay/notify/wechat", { method: "POST", headers: wxSignHeaders(body2), body: body2 });
+        assert.strictEqual(r3.status, 200);
+        assert.ok((await r3.json()).ignored, "处理中不落 REFUNDED");
+        assert.strictEqual(db.prepare("SELECT state FROM agent_pay_sessions WHERE order_ref='tb-refund-2'").get().state, "SHIPPED");
+    } finally { srv.close(); }
+});