trustbase-seller-backend 0.6.0 → 0.6.1

package/middleware/api-key-auth.js

@@ -165,7 +165,10 @@ function isTunnelBuyerRequest(req, clientIP) {
     const fromLoopback = clientIP === '127.0.0.1' || clientIP === '::1' || /^127\./.test(clientIP);
     if (!fromLoopback) return false;
     if (String(req.headers['x-tb-tunnel'] || '') !== '1') return false;
-    return TUNNEL_BUYER_PATHS.some(p => req.path.startsWith(p));
+    // 注意: 本中间件挂在 '/api' 上, req.path 是挂载后路径 ('/products'), req.originalUrl 才带 '/api'
+    // → 两种前缀都要判, 否则放行条件恒为假 (2026-10-03 .211 实测 401 才发现)
+    const paths = [String(req.path || ''), String(req.originalUrl || '').split('?')[0]];
+    return TUNNEL_BUYER_PATHS.some(p => paths.some(x => x === p || x.startsWith(p + '/') || x.startsWith(p)));
 }
 
 function requireAPIKey(skipLAN = true, exemptPaths = []) {    return (req, res, next) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/routes/agent-pay.js

@@ -44,6 +44,7 @@ CREATE TABLE IF NOT EXISTS agent_pay_sessions (
   pay_token_hash TEXT NOT NULL,
   status_token_hash TEXT NOT NULL,
   state TEXT NOT NULL DEFAULT 'CREATED',  -- CREATED/PAID/ON_CHAIN/SHIPPED/DELIVERED/CONFIRMED/CLOSED/EXPIRED/REFUNDED/DISPUTED
+  sub_mchid TEXT DEFAULT '',              -- Lane C: 本单所属特约商户 (多商户; 查单/对账按它选 partner 端点)
   psp_code_url TEXT DEFAULT '',
   psp_txn_id TEXT DEFAULT '',
   shopxo_order_no TEXT DEFAULT '',
@@ -62,7 +63,13 @@ CREATE TABLE IF NOT EXISTS psp_txns (
   created_at INTEGER NOT NULL
 );
 CREATE INDEX IF NOT EXISTS idx_aps_state ON agent_pay_sessions(state);
-`);
+`);
+    // Lane C (2026-10-03): 旧库补列 — CREATE TABLE IF NOT EXISTS 不会给已有表加列
+    try {
+        const _c = db.prepare("PRAGMA table_info(agent_pay_sessions)").all().map((x) => x.name);
+        if (!_c.includes("sub_mchid")) db.exec("ALTER TABLE agent_pay_sessions ADD COLUMN sub_mchid TEXT DEFAULT ''");
+    } catch (_) {}
+
     // 2026-09-20 E4': 物流列 (老库兼容)
     for (const col of ["carrier TEXT DEFAULT ''", "tracking_no TEXT DEFAULT ''", "logistics_state TEXT DEFAULT ''", "timeline TEXT DEFAULT '[]'", "shopxo_order_no_ref TEXT DEFAULT ''"]) {
         try { db.exec("ALTER TABLE agent_pay_sessions ADD COLUMN " + col); } catch (e) { /* 已存在 */ }
@@ -138,13 +145,21 @@ async function wxApiCall(method, urlPath, bodyObj, override) {
 // opts.settleInfo (2026-10-06 U7): 可选, 如 { profit_sharing: true } — 微信规则: 订单下单时
 // 不带 settle_info.profit_sharing 的分账请求会被拒; 默认不带 (向后兼容, 直连模式不用传)
 async function wxNativeOrder(outTradeNo, description, totalCents, expireSec, opts) {
+    // Lane C (2026-10-03): sub_mchid 按本单商家传入 (多商户), 未传才回落全局 env (单商户旧部署)
+    const subMchid = String((opts && opts.subMchid) || process.env.WXPAY_SUB_MCHID || "");
+    if (opts && opts.subMchidSource && opts.subMchidSource !== "registry") {
+        console.warn(
+            `[agent-pay] 本单 sub_mchid 来源=${opts.subMchidSource} (非登记表), 使用 ${subMchid || "直连模式"}` +
+            (subMchid ? " — 多商户场景请核对该商户是否已进件登记" : "")
+        );
+    }
     // SP 模式: 用服务商身份签名 + 请求体带 sp_mchid + sub_mchid
-    const isSp = !!(WX.spMchid && process.env.WXPAY_SUB_MCHID);
+    const isSp = !!(WX.spMchid && subMchid);
     const override = isSp ? { mchid: WX.spMchid, serial: WX.spSerial, keyPath: WX.spKeyPath } : undefined;
     const body = {
         // 直连模式: appid = 商户公众号; SP 模式: 微信不认 appid, 要 sp_appid(服务商) + sub_appid(特约商户)
         ...(isSp
-            ? { sp_mchid: WX.spMchid, sp_appid: WX.spAppid, sub_mchid: process.env.WXPAY_SUB_MCHID, sub_appid: WX.subAppid || WX.appid }
+            ? { sp_mchid: WX.spMchid, sp_appid: WX.spAppid, sub_mchid: subMchid, sub_appid: WX.subAppid || WX.appid }
             : { appid: WX.appid, mchid: WX.mchid }),
         description: String(description).slice(0, 127),
         out_trade_no: outTradeNo, time_expire: new Date(expireSec * 1000).toISOString(),
@@ -161,11 +176,13 @@ async function wxNativeOrder(outTradeNo, description, totalCents, expireSec, opt
     return r.json.code_url;
 }
 // 查单: trade_state ∈ {SUCCESS, NOTPAY, CLOSED, ...} (SP 模式走 partner endpoint + 双 mchid 查询串)
-async function wxQueryOrder(outTradeNo) {
-    const isSp = !!(WX.spMchid && process.env.WXPAY_SUB_MCHID);
+async function wxQueryOrder(outTradeNo, opts) {
+    // Lane C: 本单商户号优先, 回落全局 env (多商户)
+    const qSubMchid = String((opts && opts.subMchid) || process.env.WXPAY_SUB_MCHID || "");
+    const isSp = !!(WX.spMchid && qSubMchid);
     const override = isSp ? { mchid: WX.spMchid, serial: WX.spSerial, keyPath: WX.spKeyPath } : undefined;
     const endpoint = isSp
-        ? `/v3/pay/partner/transactions/out-trade-no/${outTradeNo}?sp_mchid=${WX.spMchid}&sub_mchid=${process.env.WXPAY_SUB_MCHID}`
+        ? `/v3/pay/partner/transactions/out-trade-no/${outTradeNo}?sp_mchid=${WX.spMchid}&sub_mchid=${qSubMchid}`
         : `/v3/pay/transactions/out-trade-no/${outTradeNo}?mchid=${WX.mchid}`;
     const r = await wxApiCall("GET", endpoint, null, override);
     if (r.status !== 200) return { state: "UNKNOWN", raw: r.json };
@@ -210,7 +227,8 @@ function loadPlatformCertsFromDisk() {
 
 /** 拉取微信平台证书 (GET /v3/certificates, 密文用调用方 APIv3 key 解密) → 内存+磁盘缓存 */
 async function refreshPlatformCerts() {
-    const isSp = !!(WX.spMchid && process.env.WXPAY_SUB_MCHID);
+    // Lane C: SP 身份只判 sp_mchid 是否配置 — 不能依赖全局 sub_mchid (多商户部署常不设默认值)
+    const isSp = !!WX.spMchid;
     const override = isSp ? { mchid: WX.spMchid, serial: WX.spSerial, keyPath: WX.spKeyPath } : undefined;
     const r = await wxApiCall("GET", "/v3/certificates", null, override);
     if (r.status !== 200 || !Array.isArray(r.json && r.json.data)) {
@@ -260,7 +278,8 @@ function wxVerifyNotifySignature(serial, timestamp, nonce, rawBody, signature) {
 
 /** 回调资源解密 (SP 模式优先 sp APIv3 key) */
 function wxDecryptNotifyResource(resource) {
-    const isSp = !!(WX.spMchid && process.env.WXPAY_SUB_MCHID);
+    // Lane C: 回调是发给服务商的, 必须用服务商 apiv3 key — 不能依赖全局 sub_mchid
+    const isSp = !!WX.spMchid;
     const apiv3 = isSp && WX.spApiv3Key ? WX.spApiv3Key : WX.apiv3Key;
     const plain = wxAesGcmDecrypt(apiv3, resource.nonce, resource.associated_data, resource.ciphertext);
     return JSON.parse(plain.toString("utf8"));
@@ -624,7 +643,7 @@ async function runReconcileOnce(db) {
             scanned = pend.length;
             for (const row of pend) {
                 try {
-                    const q = await wxQueryOrder(row.order_ref);
+                    const q = await wxQueryOrder(row.order_ref, { subMchid: row.sub_mchid });
                     if (q.state === "SUCCESS") {
                         settlePayment(row, q.txnId || ("wxq-" + row.order_ref), "wechat_native", q.amount || row.amount_total, JSON.stringify(q.raw).slice(0, 2000));
                         settled++;

package/routes/buyer-shop.js

@@ -139,13 +139,14 @@ const RATE_CACHE_MS = 60 * 1000;        // U7: 费率网关查询 60s 内存缓
 function makeCommissionRateResolver(db, fetcher) {
     const cache = new Map(); // sub_mchid → {bp, expiresAt}
     const fetchFn = fetcher || globalThis.fetch;
-    return async function resolveRateBp() {
+    return async function resolveRateBp(subMchidArg) {
         // ① env 显式覆盖 (最高优先, 不调网关不读表)
         if (process.env.SP_COMMISSION_BP !== undefined && process.env.SP_COMMISSION_BP !== "") {
             const v = Number(process.env.SP_COMMISSION_BP);
             return Number.isInteger(v) && v >= 0 ? v : 0;
         }
-        const subMchid = String(process.env.WXPAY_SUB_MCHID || "");
+        // Lane C (2026-10-03): 按传入的商户号解析; 未传才回落全局 env (多商户)
+        const subMchid = String(subMchidArg || process.env.WXPAY_SUB_MCHID || "");
         if (!subMchid) return 0; // 直连模式不标记
         const hit = cache.get(subMchid);
         if (hit && Date.now() < hit.expiresAt) return hit.bp;
@@ -176,12 +177,48 @@ function makeCommissionRateResolver(db, fetcher) {
     };
 }
 
+/** Lane C (2026-10-03): 按「商品卖家地址」解析特约商户号 —— 多商户的核心
+ *  数据源: sp_sub_merchants.seller_address → sub_mchid (进件时写入, 网关与商家机各一份)
+ *  兜底: 全局 env WXPAY_SUB_MCHID (单商户旧部署) —— **必须显式告警**, 不静默错分
+ *  返回 { subMchid, source: registry | env-fallback | none } */
+function makeSubMchidResolver(db) {
+    const cache = new Map(); // seller_address → {subMchid, source}
+    return function resolveSubMchid(sellerAddress) {
+        const env = String(process.env.WXPAY_SUB_MCHID || "");
+        const key = String(sellerAddress || "");
+        if (!key) return { subMchid: env, source: env ? "env-fallback-no-seller" : "none" };
+        const hit = cache.get(key);
+        if (hit) return hit;
+        let out = { subMchid: env, source: env ? "env-fallback" : "none" };
+        try {
+            if (hasTable(db, "sp_sub_merchants")) {
+                const row = db.prepare(
+                    "SELECT sub_mchid FROM sp_sub_merchants WHERE seller_address = ? AND status = 'active'"
+                ).get(key);
+                if (row && row.sub_mchid) out = { subMchid: String(row.sub_mchid), source: "registry" };
+            }
+        } catch (_) { /* 表缺失/异常 → 走兜底 */ }
+        if (out.source !== "registry") {
+            console.warn(
+                `[buyer-shop] 卖家 ${key.slice(0, 14)}… 未在 sp_sub_merchants 登记 → ` +
+                (out.subMchid
+                    ? `回退全局 WXPAY_SUB_MCHID=${out.subMchid}（多商户场景可能分错商户！）`
+                    : "无 sub_mchid（按直连模式，本单不分账）")
+            );
+        }
+        cache.set(key, out);
+        return out;
+    };
+}
+
 function createBuyerShopRouter(deps) {
     const router = express.Router();
     const { db } = deps;
     ensureBuyerTables(db);
     const rateLimit = makeRateLimiter();
     const resolveRateBp = makeCommissionRateResolver(db, deps.fetcher);
+    // Lane C: 按商品卖家解析 sub_mchid (多商户); 表缺失时回落 env 并告警
+    const resolveSubMchid = makeSubMchidResolver(db);
 
     const MODE = process.env.AGENT_PAY_MODE || "mock"; // mock | wechat (同 agent-pay 口径)
     // 测试可注入假 wxNativeOrder; 生产默认 agent-pay 真实现 (SP 模式其内部自动切换)
@@ -338,9 +375,13 @@ function createBuyerShopRouter(deps) {
                 if (exist) return res.json(orderToJson(exist));
             }
 
+            // Lane C: 本单属于哪个特约商户 = 商品卖家的登记商户号 (不再是全局 env)
+            const sellerResolved = resolveSubMchid(product.seller_address);
+            const subMchid = sellerResolved.subMchid;
+
             // U7: rate>0 且 SP 模式 → 微信下单带 settle_info.profit_sharing (不带标记的订单分账被拒)
-            const rateBp = await resolveRateBp();
-            const psFlag = process.env.WXPAY_SUB_MCHID && rateBp > 0 ? 1 : 0;
+            const rateBp = await resolveRateBp(subMchid);
+            const psFlag = subMchid && rateBp > 0 ? 1 : 0;
 
             // 创建订单 (订单号 = order_ref, 对外 id)
             const orderRef = "tb-" + crypto.randomBytes(8).toString("hex");
@@ -353,8 +394,11 @@ function createBuyerShopRouter(deps) {
                 codeUrl = `weixin://mock-pay/${orderRef}`;
             } else {
                 try {
-                    codeUrl = await wxNativeOrder(orderRef, String(product.title || productId), totalFen, exp,
-                        psFlag ? { settleInfo: { profit_sharing: true } } : undefined);
+                    codeUrl = await wxNativeOrder(orderRef, String(product.title || productId), totalFen, exp, {
+                        subMchid,
+                        subMchidSource: sellerResolved.source,
+                        ...(psFlag ? { settleInfo: { profit_sharing: true } } : {}),
+                    });
                 } catch (e) {
                     console.error("[buyer-shop] wx order fail:", e && e.message);
                     return err("PAYMENT_UPSTREAM", 502, "支付通道暂时不可用，请稍后再试");
@@ -365,11 +409,11 @@ function createBuyerShopRouter(deps) {
             // 买家面无账号体系, 订单 id 即凭据 — 与 pwa-shop-demo 轮询模型一致)
             // U7: ps_flag 台账标注该单是否带分账标记 (运营台区分用)
             db.prepare(`INSERT INTO agent_pay_sessions
- (client_session_id, sku_id, qty, amount_total, currency, agent_addr, order_ref, pay_token_hash, status_token_hash, state, psp_code_url, callback_url, expires_at, created_at, updated_at, ps_flag)
- VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`)
+ (client_session_id, sku_id, qty, amount_total, currency, agent_addr, order_ref, pay_token_hash, status_token_hash, state, psp_code_url, callback_url, expires_at, created_at, updated_at, ps_flag, sub_mchid)
+ VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`)
                 .run(clientSessionId, productId, qty, totalFen, "CNY", "buyer:" + buyerCard, orderRef,
                     crypto.randomBytes(32).toString("hex"), crypto.randomBytes(32).toString("hex"),
-                    "CREATED", codeUrl, "", exp, now, now, psFlag);
+                    "CREATED", codeUrl, "", exp, now, now, psFlag, subMchid);
             console.log(`[buyer-shop] 下单 ${orderRef} product=${productId} qty=${qty} total=${totalFen}分 ps_flag=${psFlag}`);
             const row = db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref = ?").get(orderRef);
             res.json(orderToJson(row));

package/test-laneC.js

@@ -0,0 +1,85 @@
+/**
+ * Lane C 多商户路由 单测 (2026-10-03 kimi)
+ * 验证: ① 按商品卖家解析 sub_mchid  ② 兜底回退 env 且有告警语义  ③ 费率按商户号解析
+ * 跑法: node test-laneC.js
+ */
+const sqlite3 = require("better-sqlite3");
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = path.join(os.tmpdir(), "lanec-test-" + Date.now() + ".db");
+const db = new sqlite3(tmp);
+
+// 造最小 schema (与线上同结构)
+db.exec(`
+CREATE TABLE IF NOT EXISTS sp_sub_merchants (sub_mchid TEXT, seller_address TEXT, shop_name TEXT, webhook_url TEXT, status TEXT, created_at INTEGER);
+CREATE TABLE IF NOT EXISTS sp_commission_rates (sub_mchid TEXT, rate_bp INTEGER);
+CREATE TABLE IF NOT EXISTS store_products (id TEXT, seller_address TEXT, title TEXT, price_utct INTEGER, stock INTEGER, status TEXT);
+`);
+db.prepare("INSERT INTO sp_sub_merchants VALUES (?,?,?,?,?,?)").run("1118152327", "tct1v75dSellerA", "港思恒", "", "active", 1);
+db.prepare("INSERT INTO sp_sub_merchants VALUES (?,?,?,?,?,?)").run("1900000109", "tct1v75dSellerB", "第二商户", "", "active", 1);
+db.prepare("INSERT INTO sp_commission_rates VALUES (?,?)").run("1900000109", 100); // 第二商户 1%
+
+process.env.WXPAY_SUB_MCHID = "1118152327"; // 全局默认(单商户旧部署)
+delete process.env.SP_COMMISSION_BP;        // 走解析路径
+
+// 载入被测函数 (从 buyer-shop.js 里抠出来, 避免 require 整个应用)
+const src = fs.readFileSync(path.join(__dirname, "routes", "buyer-shop.js"), "utf8");
+function extract(name) {
+    const i = src.indexOf("function " + name);
+    if (i < 0) throw new Error("找不到函数 " + name);
+    // 找到函数体结束
+    let depth = 0, started = false, j = i;
+    for (; j < src.length; j++) {
+        if (src[j] === "{") { depth++; started = true; }
+        else if (src[j] === "}") { depth--; if (started && depth === 0) { j++; break; } }
+    }
+    return src.slice(i, j);
+}
+global.hasTable = eval("(" + extract("hasTable") + ")");
+const makeSubMchidResolver = eval("(" + extract("makeSubMchidResolver") + ")");
+const RATE_CACHE_MS = 60 * 1000; // 与 buyer-shop.js 同值
+const makeCommissionRateResolver = eval("(" + extract("makeCommissionRateResolver") + ")");
+
+const resolveSubMchid = makeSubMchidResolver(db);
+const resolveRateBp = makeCommissionRateResolver(db, null);
+
+let pass = 0, fail = 0;
+function check(name, got, want) {
+    const okv = JSON.stringify(got) === JSON.stringify(want);
+    console.log((okv ? "  ✔ " : "  ✘ ") + name + (okv ? "" : `  got=${JSON.stringify(got)} want=${JSON.stringify(want)}`));
+    okv ? pass++ : fail++;
+}
+
+console.log("Lane C 多商户路由单测:");
+
+// ① 已登记商户 → 走登记表
+check("港思恒(1118152327) 解析", resolveSubMchid("tct1v75dSellerA").subMchid, "1118152327");
+check("第二商户(1900000109) 解析", resolveSubMchid("tct1v75dSellerB").subMchid, "1900000109");
+check("第二商户 source=registry", resolveSubMchid("tct1v75dSellerB").source, "registry");
+
+// ② 未登记卖家 → 回落 env + source 标记(不静默)
+const r3 = resolveSubMchid("tct1unknown");
+check("未登记卖家回落 env", r3.subMchid, "1118152327");
+check("未登记卖家 source=env-fallback", r3.source, "env-fallback");
+
+// ③ 无卖家地址 → 也不静默
+check("无 seller 回落 env", resolveSubMchid("").source, "env-fallback-no-seller");
+
+// ④ 费率按传入商户号解析 (第二商户 1% = 100bp; 全局默认未登记 → 0)
+resolveRateBp.cache = null;
+(async () => {
+    const bp2 = await resolveRateBp("1900000109");
+    check("费率按第二商户解析 (1%=100bp)", bp2, 100);
+    const bp1 = await resolveRateBp("1118152327");
+    check("费率按港思恒解析 (未登记→0)", bp1, 0);
+    // 不传参 → 回落 env 商户号
+    const bp0 = await resolveRateBp();
+    check("费率不传参回落 env", bp0, 0);
+
+    console.log(`\n结果: ${pass} 通过, ${fail} 失败`);
+    try { fs.unlinkSync(tmp); } catch (_) {}
+    process.exit(fail ? 1 : 0);
+})();