trustbase-seller-backend 0.5.8 → 0.5.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.5.8",
+  "version": "0.5.9",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/payments/wechat/profitsharing.js

@@ -25,6 +25,10 @@ function wxCfg() {
         appid: process.env.WXPAY_APPID || "",
         mchid: process.env.WXPAY_MCHID || "",
         spMchid: process.env.WXPAY_SP_MCHID || "",
+        // SP 模式下单/分账必填: sp_appid (服务商公众号) + sub_mchid (特约商户)
+        // 2026-10-02 实测: 缺 sub_mchid → 微信 NO_AUTH "无分账权限"
+        spAppid: process.env.WXPAY_SP_APPID || "",
+        subMchid: process.env.WXPAY_SUB_MCHID || "",
         spSerial: process.env.WXPAY_SP_SERIAL || "",
         spKeyPath: process.env.WXPAY_SP_KEY_PATH || "",
         enabled: String(process.env.WXPAY_PROFITSHARING_ENABLED || "").toLowerCase() === "true",
@@ -90,17 +94,24 @@ async function addReceivers(receivers) {
     const results = [];
     for (const rcv of list) {
         if (!rcv || !rcv.account) throw new Error("receiver.account 必填");
-        const body = {
-            appid: c.appid,
-            type: rcv.type || "MERCHANT_ID",
-            account: String(rcv.account),
-            relation_type: rcv.relation_type || "SERVICE_PROVIDER",
-        };
+        // SP 模式: 微信该接口要 appid(服务商关联公众号) + sp_mchid + sub_mchid
+        // 2026-10-02 两次实测: 缺 sub_mchid → NO_AUTH; 用 sp_appid 替代 appid → PARAM_ERROR(/body/appid 必填)
+        const body = c.spMchid
+            ? {
+                appid: c.spAppid || c.appid,
+                sp_mchid: c.spMchid,
+                sub_mchid: String(rcv.sub_mchid || c.subMchid || ""),
+                type: rcv.type || "MERCHANT_ID",
+                account: String(rcv.account),
+                relation_type: rcv.relation_type || "SERVICE_PROVIDER",
+            }
+            : {
+                appid: c.appid,
+                type: rcv.type || "MERCHANT_ID",
+                account: String(rcv.account),
+                relation_type: rcv.relation_type || "SERVICE_PROVIDER",
+            };
         if (rcv.name) body.name = c.enabled ? encryptReceiverName(String(rcv.name)) : String(rcv.name); // MERCHANT_ID 真调时微信要求 name (加密)
-        if (c.spMchid) {
-            body.sp_mchid = c.spMchid;
-            if (rcv.sub_mchid) body.sub_mchid = String(rcv.sub_mchid);
-        }
         const r = await wxCall("POST", "/v3/profitsharing/receivers/add", body);
         results.push(r.mock ? { mock: true, account: body.account } : r);
     }
@@ -134,22 +145,35 @@ async function requestProfitsharing(params) {
         if (!rcv || !rcv.account) throw new Error("receiver.account 必填");
         assertShareAmount(p.tradeAmount, rcv.amount); // 护栏先于一切网络调用
     }
-    const body = {
-        appid: c.appid,
-        transaction_id: String(p.transactionId),
-        out_order_no: String(p.outTradeNo),
-        receivers: p.receivers.map((r) => ({
-            type: r.type || "MERCHANT_ID",
-            account: String(r.account),
-            amount: r.amount,
-            description: String(r.description || "服务商分账").slice(0, 80),
-        })),
-        unfreeze_unsplit: p.unfreezeUnsplit !== false,
-    };
-    if (c.spMchid) {
-        body.sp_mchid = c.spMchid;
-        if (p.subMchid) body.sub_mchid = String(p.subMchid);
-    }
+    // SP 模式: appid(服务商关联公众号) + sp_mchid + sub_mchid (与接收方注册同口径)
+    const body = c.spMchid
+        ? {
+            appid: c.spAppid || c.appid,
+            sp_mchid: c.spMchid,
+            sub_mchid: String(p.subMchid || c.subMchid || ""),
+            transaction_id: String(p.transactionId),
+            out_order_no: String(p.outTradeNo),
+            receivers: p.receivers.map((r) => ({
+                type: r.type || "MERCHANT_ID",
+                account: String(r.account),
+                amount: r.amount,
+                description: String(r.description || "服务商分账").slice(0, 80),
+            })),
+            unfreeze_unsplit: p.unfreezeUnsplit !== false,
+        }
+        : {
+            appid: c.appid,
+            transaction_id: String(p.transactionId),
+            out_order_no: String(p.outTradeNo),
+            receivers: p.receivers.map((r) => ({
+                type: r.type || "MERCHANT_ID",
+                account: String(r.account),
+                amount: r.amount,
+                description: String(r.description || "服务商分账").slice(0, 80),
+            })),
+            unfreeze_unsplit: p.unfreezeUnsplit !== false,
+        };
+    if (c.spMchid && p.subMchid) body.sub_mchid = String(p.subMchid);
     const r = await wxCall("POST", "/v3/profitsharing/orders", body);
     return r.mock ? { mock: true, out_order_no: body.out_order_no, receivers: body.receivers } : r;
 }

package/routes/agent-pay.js

@@ -94,6 +94,10 @@ const WX = {
     notifyUrl: process.env.WXPAY_NOTIFY_URL || "https://placeholder.invalid/tb-notify",
     // 服务商模式 (A 方案): SP 统一下单带 sub_mchid 参数
     spMchid: process.env.WXPAY_SP_MCHID || "",
+    // 服务商公众号ID: 微信 SP 模式下单必填 (2026-10-02 实测 PARAM_ERROR: /body/sp_appid 必填性校验失败)
+    spAppid: process.env.WXPAY_SP_APPID || "",
+    // 特约商户公众号ID: SP 模式下单必填 (与 appid 不同, 是商户进件时绑的那个)
+    subAppid: process.env.WXPAY_SUB_APPID || "",
     spSerial: process.env.WXPAY_SP_SERIAL || "",
     spKeyPath: process.env.WXPAY_SP_KEY_PATH || "",
     spApiv3Key: process.env.WXPAY_SP_APIV3_KEY || "",  // SP 模式回调/平台证书解密用服务商 APIv3 key (缺省回落 apiv3Key)
@@ -138,8 +142,11 @@ async function wxNativeOrder(outTradeNo, description, totalCents, expireSec, opt
     const isSp = !!(WX.spMchid && process.env.WXPAY_SUB_MCHID);
     const override = isSp ? { mchid: WX.spMchid, serial: WX.spSerial, keyPath: WX.spKeyPath } : undefined;
     const body = {
-        appid: WX.appid,
-        ...(isSp ? { sp_mchid: WX.spMchid, sub_mchid: process.env.WXPAY_SUB_MCHID } : { mchid: WX.mchid }), description: String(description).slice(0, 127),
+        // 直连模式: appid = 商户公众号; SP 模式: 微信不认 appid, 要 sp_appid(服务商) + sub_appid(特约商户)
+        ...(isSp
+            ? { sp_mchid: WX.spMchid, sp_appid: WX.spAppid, sub_mchid: process.env.WXPAY_SUB_MCHID, sub_appid: WX.subAppid || WX.appid }
+            : { appid: WX.appid, mchid: WX.mchid }),
+        description: String(description).slice(0, 127),
         out_trade_no: outTradeNo, time_expire: new Date(expireSec * 1000).toISOString(),
         // notify_url: 可选回调 (未配置=查单模式, 占位符即可下单成功)
         notify_url: WX.notifyUrl,

package/routes/buyer-shop.js

@@ -244,6 +244,25 @@ function createBuyerShopRouter(deps) {
         };
     }
 
+    /** GET /qr?text=weixin://wxpay/... — 服务端渲染支付二维码 (SVG)
+     *  2026-10-03: PWA 自带的 qrcode.min.js 在浏览器里没导出公共 API → 支付页二维码空白;
+     *  改由服务端渲染。只认 weixin://wxpay/ 前缀, 避免变成任意文本转二维码的公共服务。 */
+    router.get("/qr", async (req, res) => {
+        try {
+            const text = String(req.query.text || "").trim();
+            if (!/^weixin:\/\/wxpay\//.test(text)) {
+                return res.status(400).json({ error: "BAD_QR_TEXT", message: "仅支持 weixin://wxpay/ 链接" });
+            }
+            const QRCode = require("qrcode");
+            const svg = await QRCode.toString(text, { type: "svg", margin: 1, width: 220, errorCorrectionLevel: "M" });
+            res.set("Content-Type", "image/svg+xml; charset=utf-8");
+            res.set("Cache-Control", "no-store");
+            res.send(svg);
+        } catch (e) {
+            res.status(500).json({ error: "QR_RENDER_FAILED", message: String((e && e.message) || e).slice(0, 120) });
+        }
+    });
+
     /** GET /products — 商品列表 (公开只读, 只在架) */
     router.get("/products", (req, res) => {
         try {

package/routes/sp-notify.js

@@ -100,7 +100,9 @@ async function submitPaymentFactToChain(fact) {
 /** 补链清扫: 扫描 chain_txhash 为空的台账行重试上链 (定时器/手动调用)
  *  opts.sendTx 可注入 (测试); 返回 {scanned, retried, failed} */
 async function retryPending(db, opts) {
-    const rows = db.prepare("SELECT * FROM sp_payment_facts WHERE chain_txhash = '' LIMIT 20").all();
+    // 2026-10-03 修复: 链开关关闭期间写入的是 chain_txhash='disabled' (非空), 原条件 chain_txhash=''
+    // 永远扫不到 → 9/25-9/29 那批事实被永久漏在链外。disabled 与空串同义(都要补链), 一并扫。
+    const rows = db.prepare("SELECT * FROM sp_payment_facts WHERE chain_txhash IN ('','disabled') LIMIT 20").all();
     const injected = opts && opts.sendTx;
     let retried = 0, failed = 0;
     for (const row of rows) {
@@ -165,8 +167,22 @@ async function retryProfitsharingSweep(db, opts) {
                 }
                 // pending 且微信侧还在处理中: 保持 pending 下轮再扫
             } else {
-                failed++;
-                console.warn(`[sp-notify] 分账补扫查询未成功 out_order_no=${row.ps_out_order_no} status=${q && q.status}`);
+                // 查询失败/查不到 (微信 400 = 这张分账单根本不存在, 说明首次分账就没发出去)
+                // → 必须走重发路径, 否则这一笔永远补不回来。
+                // 2026-10-03 修复: 原实现只 failed++ 记日志, 从不重发 (10/3 首笔 ¥10 分账即踩中, 手工补发)
+                if (row.ps_status === "failed" || row.ps_status === "pending") {
+                    const r2 = await profitsharing.requestProfitsharing({
+                        outTradeNo: row.ps_out_order_no, transactionId: row.txn_id, tradeAmount: row.amount,
+                        subMchid: row.sub_mchid,
+                        receivers: [{ account: receiverAccount, amount: row.ps_amount, description: "服务商抽佣" }],
+                    });
+                    const ok2 = r2 && r2.status === 200;
+                    db.prepare("UPDATE sp_payment_facts SET ps_status=?, ps_at=? WHERE txn_id=?").run(ok2 ? "pending" : "failed", nowSec(), row.txn_id);
+                    if (ok2) retried++; else failed++;
+                } else {
+                    failed++;
+                }
+                console.warn(`[sp-notify] 分账补扫查询未成功 out_order_no=${row.ps_out_order_no} status=${q && q.status}${row.ps_status === "failed" ? " (已尝试重发)" : ""}`);
             }
         } catch (e) {
             failed++;