fix(payment): harden payment and refund chains

src/AKSRT/Admin/Native/PayAfterSale.php

@@ -41,20 +41,14 @@ class PayAfterSale {
 
         $ok = false;
         if ($order_number !== '' && class_exists('\AKSRT\Payment\AfterSale')) {
-            $user_id = isset($_POST['user_id']) ? (int) $_POST['user_id'] : 0;
-            if ($user_id <= 0 && class_exists('\AKSRT\Payment\OrderRepository')) {
-                $order = \AKSRT\Payment\OrderRepository::get_instance()->get($order_number);
-                $user_id = (int) ($order['user_id'] ?? 0);
-            }
             $id = \AKSRT\Payment\AfterSale::get_instance()->create([
                 'order_number' => $order_number,
-                'user_id'      => $user_id,
                 'type'         => sanitize_key((string) wp_unslash($_POST['type'] ?? 'refund')),
                 'reason'       => sanitize_textarea_field((string) wp_unslash($_POST['reason'] ?? '')),
                 'amount'       => (float) ($_POST['amount'] ?? 0),
                 'note'         => sanitize_textarea_field((string) wp_unslash($_POST['note'] ?? '')),
             ]);
-            $ok = $id > 0;
+            $ok = !is_wp_error($id) && $id > 0;
         }
 
         $msg = $ok ? 'after_sale_created' : 'after_sale_create_failed';

src/AKSRT/Admin/Schema/SchemaPayment.php

@@ -258,7 +258,7 @@ class SchemaPayment {
                         ]],
                         ['key' => 'alipay', 'title' => '支付宝配置', 'collapsible' => true, 'expandWhen' => 'payment_alipay_enabled', 'dependsOn' => ['key' => 'payment_alipay_enabled', 'value' => true], 'fields' => [
                             ['key' => 'alipay_appid', 'label' => 'AppID', 'type' => 'input', 'default' => '', 'dependsOn' => ['key' => 'payment_alipay_enabled', 'value' => true]],
-                            ['key' => 'alipay_privatekey', 'label' => '应用私钥', 'type' => 'textarea', 'default' => '', 'dependsOn' => ['key' => 'payment_alipay_enabled', 'value' => true]],
+                            ['key' => 'alipay_privatekey', 'label' => '应用私钥', 'type' => 'textarea', 'sanitize_type' => 'code', 'default' => '', 'dependsOn' => ['key' => 'payment_alipay_enabled', 'value' => true]],
                             ['key' => 'alipay_payment_type', 'label' => '支付方式', 'type' => 'select', 'default' => 'page', 'options' => [
                                 ['value' => 'page', 'label' => '电脑网站支付（web）'],
                                 ['value' => 'wap', 'label' => '手机网站支付（wap）'],

src/AKSRT/Admin/Schema/SchemaUsers.php

@@ -318,7 +318,7 @@ class SchemaUsers {
                         ]],
                         ['key' => 'alipay', 'title' => '支付宝配置', 'fields' => [
                             ['key' => 'alipay_appid', 'label' => 'AppID', 'type' => 'input', 'default' => ''],
-                            ['key' => 'alipay_privatekey', 'label' => '应用私钥', 'type' => 'input', 'default' => ''],
+                            ['key' => 'alipay_privatekey', 'label' => '应用私钥', 'type' => 'textarea', 'sanitize_type' => 'code', 'default' => ''],
                             ['key' => 'alipay_publickey', 'label' => '支付宝公钥', 'type' => 'input', 'default' => ''],
                         ]],
                     ],

src/AKSRT/Admin/ShopControllerFulfillmentOperations.php

@@ -82,13 +82,12 @@ trait ShopControllerFulfillmentOperations {
             return $this->error(__('订单不存在', 'aksrt'), 404);
         }
 
-        $params['user_id'] = (int) ($params['user_id'] ?? ($order['user_id'] ?? 0));
-        if ($params['user_id'] <= 0) {
-            return $this->error(__('订单未绑定有效用户', 'aksrt'));
-        }
-
+        unset($params['user_id'], $params['applicant_user_id']);
         $id = \AKSRT\Payment\AfterSale::get_instance()->create($params);
 
+        if (is_wp_error($id)) {
+            return $this->error($id->get_error_message(), 422);
+        }
         if ($id > 0) {
             return $this->success([
                 'message' => __('售后工单已创建', 'aksrt'),