linxianzhuang/saasshop
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PlatformOrder store: guard renewal must match subscription merchant/plan

Browse Source
This commit is contained in:
萝卜
2026-03-15 02:59:58 +00:00
parent 09c8aeca2a
commit 1c5827fd85
3 changed files with 182 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
app/Http/Controllers/Admin/PlatformOrderController.php
View File

@@ -122,6 +122,30 @@ class PlatformOrderController extends Controller
'lead_id' => ['nullable', 'integer', 'exists:platform_leads,id'],
]);
// 治理口径：续费单必须与订阅上下文一致（站点/套餐）。
// 当前阶段暂不支持“跨站点/跨套餐续费”，避免误续费/串单风险；升级/降级后续再单独建设。
if ((string) ($data['order_type'] ?? '') === 'renewal') {
$subId = (int) ($data['site_subscription_id'] ?? 0);
$sub = $subId > 0 ? SiteSubscription::query()->find($subId) : null;
if (! $sub) {
return redirect()->back()->withErrors([
'site_subscription_id' => '续费单必须绑定有效订阅。',
])->withInput();
}
if ((int) ($data['merchant_id'] ?? 0) !== (int) ($sub->merchant_id ?? 0)) {
return redirect()->back()->withErrors([
'merchant_id' => '续费单站点必须与订阅所属站点一致（请从订阅维度进入下单）。',
])->withInput();
}
if ((int) ($data['plan_id'] ?? 0) !== (int) ($sub->plan_id ?? 0)) {
return redirect()->back()->withErrors([
'plan_id' => '续费单套餐必须与订阅当前套餐一致（当前阶段暂不支持跨套餐续费）。',
])->withInput();
}
}
$plan = Plan::query()->findOrFail((int) $data['plan_id']);
$periodMonths = $this->periodMonthsFromBillingCycle((string) $plan->billing_cycle);

76
tests/Feature/AdminPlatformOrderStoreRenewalShouldRejectMerchantMismatchTest.php Normal file
View File

@@ -0,0 +1,76 @@
<?php
namespace Tests\Feature;
use App\Models\Merchant;
use App\Models\Plan;
use App\Models\SiteSubscription;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class AdminPlatformOrderStoreRenewalShouldRejectMerchantMismatchTest extends TestCase
{
use RefreshDatabase;
protected function loginAsPlatformAdmin(): void
{
$this->seed();
$this->post('/admin/login', [
'email' => 'platform.admin@demo.local',
'password' => 'Platform@123456',
])->assertRedirect('/admin');
}
public function test_store_should_reject_renewal_when_merchant_mismatch_with_subscription(): void
{
$this->loginAsPlatformAdmin();
$merchantA = Merchant::query()->firstOrFail();
$merchantB = Merchant::query()->create([
'name' => '站点B',
'slug' => 'merchant-b',
'status' => 'active',
]);
$plan = Plan::query()->create([
'code' => 'po_store_renewal_merchant_mismatch_plan',
'name' => '续费下单站点不一致拒绝测试套餐',
'billing_cycle' => 'monthly',
'price' => 10,
'list_price' => 10,
'status' => 'active',
'sort' => 10,
'published_at' => now(),
]);
$sub = SiteSubscription::query()->create([
'merchant_id' => $merchantA->id,
'plan_id' => $plan->id,
'status' => 'activated',
'source' => 'manual',
'subscription_no' => 'SUB_PO_STORE_MERCHANT_MISMATCH_0001',
'plan_name' => $plan->name,
'billing_cycle' => $plan->billing_cycle,
'period_months' => 1,
'amount' => 10,
'starts_at' => now()->subDay(),
'ends_at' => now()->addMonth(),
'activated_at' => now()->subDay(),
]);
$res = $this->from('/admin/platform-orders/create')->post('/admin/platform-orders', [
'merchant_id' => $merchantB->id,
'plan_id' => $plan->id,
'site_subscription_id' => $sub->id,
'order_type' => 'renewal',
'quantity' => 1,
'discount_amount' => 0,
'payment_channel' => 'offline',
'remark' => 'merchant mismatch',
]);
$res->assertStatus(302);
$res->assertSessionHasErrors('merchant_id');
}
}

82
tests/Feature/AdminPlatformOrderStoreRenewalShouldRejectPlanMismatchTest.php Normal file
View File

@@ -0,0 +1,82 @@
<?php
namespace Tests\Feature;
use App\Models\Merchant;
use App\Models\Plan;
use App\Models\SiteSubscription;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class AdminPlatformOrderStoreRenewalShouldRejectPlanMismatchTest extends TestCase
{
use RefreshDatabase;
protected function loginAsPlatformAdmin(): void
{
$this->seed();
$this->post('/admin/login', [
'email' => 'platform.admin@demo.local',
'password' => 'Platform@123456',
])->assertRedirect('/admin');
}
public function test_store_should_reject_renewal_when_plan_mismatch_with_subscription(): void
{
$this->loginAsPlatformAdmin();
$merchant = Merchant::query()->firstOrFail();
$planA = Plan::query()->create([
'code' => 'po_store_renewal_plan_mismatch_plan_a',
'name' => '续费下单套餐不一致拒绝测试套餐A',
'billing_cycle' => 'monthly',
'price' => 10,
'list_price' => 10,
'status' => 'active',
'sort' => 10,
'published_at' => now(),
]);
$planB = Plan::query()->create([
'code' => 'po_store_renewal_plan_mismatch_plan_b',
'name' => '续费下单套餐不一致拒绝测试套餐B',
'billing_cycle' => 'monthly',
'price' => 20,
'list_price' => 20,
'status' => 'active',
'sort' => 9,
'published_at' => now(),
]);
$sub = SiteSubscription::query()->create([
'merchant_id' => $merchant->id,
'plan_id' => $planA->id,
'status' => 'activated',
'source' => 'manual',
'subscription_no' => 'SUB_PO_STORE_PLAN_MISMATCH_0001',
'plan_name' => $planA->name,
'billing_cycle' => $planA->billing_cycle,
'period_months' => 1,
'amount' => 10,
'starts_at' => now()->subDay(),
'ends_at' => now()->addMonth(),
'activated_at' => now()->subDay(),
]);
$res = $this->from('/admin/platform-orders/create')->post('/admin/platform-orders', [
'merchant_id' => $merchant->id,
'plan_id' => $planB->id,
'site_subscription_id' => $sub->id,
'order_type' => 'renewal',
'quantity' => 1,
'discount_amount' => 0,
'payment_channel' => 'offline',
'remark' => 'plan mismatch',
]);
$res->assertStatus(302);
$res->assertSessionHasErrors('plan_id');
}
}