积分与余额账务系统硬切重构

src/Content/PayRest.php

@@ -17,11 +17,23 @@ trait PayRest {
                 'methods'             => 'GET',
                 'callback'            => [$this, 'rest_preview'],
                 'permission_callback' => [$this, 'check_rest_nonce'],
+				'args' => [
+					'id' => ['type' => 'integer', 'required' => true, 'minimum' => 1],
+					'price_type' => ['type' => 'string', 'enum' => ['', 'download_limit_over']],
+					'coupon_code' => ['type' => 'string', 'maxLength' => 64, 'sanitize_callback' => 'sanitize_text_field'],
+				],
             ],
             [
                 'methods'             => 'POST',
                 'callback'            => [$this, 'rest_purchase'],
                 'permission_callback' => [$this, 'check_rest_nonce'],
+				'args' => [
+					'id' => ['type' => 'integer', 'required' => true, 'minimum' => 1],
+					'mode' => ['type' => 'string', 'enum' => ['points', 'cash']],
+					'payment_method' => ['type' => 'string', 'maxLength' => 32, 'sanitize_callback' => 'sanitize_key'],
+					'price_type' => ['type' => 'string', 'enum' => ['', 'download_limit_over']],
+					'coupon_code' => ['type' => 'string', 'maxLength' => 64, 'sanitize_callback' => 'sanitize_text_field'],
+				],
             ],
         ]);
 
@@ -29,6 +41,15 @@ trait PayRest {
             'methods'             => 'GET',
             'callback'            => [$this, 'rest_order_status'],
             'permission_callback' => [$this, 'check_rest_nonce'],
+			'args' => [
+				'order_number' => [
+					'type' => 'string',
+					'required' => true,
+					'pattern' => '^[A-Za-z0-9_-]+$',
+					'maxLength' => 64,
+					'sanitize_callback' => 'sanitize_text_field',
+				],
+			],
         ]);
     }
 
@@ -60,7 +81,7 @@ trait PayRest {
     public function rest_preview(\WP_REST_Request $request) {
         $post_id = (int) $request['id'];
         $uid = get_current_user_id();
-        $coupon_code = sanitize_text_field((string) ($request->get_param('coupon_code') ?? $request->get_param('coupon') ?? ''));
+		$coupon_code = sanitize_text_field((string) $request->get_param('coupon_code'));
         $price_type = sanitize_key((string) ($request->get_param('price_type') ?? ''));
         if ($price_type !== 'download_limit_over') {
             $price_type = '';
@@ -81,6 +102,10 @@ trait PayRest {
     public function rest_purchase(\WP_REST_Request $request) {
         $post_id = (int) $request['id'];
         $uid = get_current_user_id();
+		$operation_key = \AKSRT\Ledger\OperationKey::from_request($request, 'content-purchase', $uid);
+		if (is_wp_error($operation_key)) {
+			return $operation_key;
+		}
 
         $params = $request->get_json_params();
         if (!is_array($params)) {
@@ -91,7 +116,7 @@ trait PayRest {
         if ($price_type !== 'download_limit_over') {
             $price_type = '';
         }
-        $coupon_code = sanitize_text_field((string) ($params['coupon_code'] ?? $params['coupon'] ?? ''));
+		$coupon_code = sanitize_text_field((string) ($params['coupon_code'] ?? ''));
 
         // Guest allowed only for cash + pay_limit=0 + setting on.
         if ($uid <= 0) {
@@ -121,8 +146,8 @@ trait PayRest {
             if ($uid <= 0) {
                 return new \WP_Error('aksrt_need_login', __('积分支付请先登录。', 'aksrt'), ['status' => 401]);
             }
-            // Points path: ignore coupon (legacy parity).
-            return $this->rest_wrap_result($this->create_and_pay_points($post_id, $uid, $price_type));
+			// Point purchases do not support coupons.
+            return $this->rest_wrap_result($this->create_and_pay_points($post_id, $uid, $price_type, $operation_key));
         }
 
         $payment_method = sanitize_key((string) ($params['payment_method'] ?? 'balance'));
@@ -133,7 +158,7 @@ trait PayRest {
         if ($uid <= 0 && in_array($payment_method, ['balance', 'points'], true)) {
             $payment_method = 'alipay';
         }
-        return $this->rest_wrap_result($this->create_cash_order($post_id, $uid, $payment_method, $price_type, $coupon_code));
+        return $this->rest_wrap_result($this->create_cash_order($post_id, $uid, $payment_method, $price_type, $coupon_code, $operation_key));
     }
 
 
@@ -177,7 +202,7 @@ trait PayRest {
             'order_number' => $order_number,
             'status' => $status,
             'paid' => $paid,
-            'amount' => (float) ($order['amount'] ?? 0),
+			'amount' => (string) ($order['amount'] ?? '0.00'),
             'currency' => (string) ($order['currency'] ?? ''),
             'product_id' => (int) ($order['product_id'] ?? 0),
             'product_type' => (string) ($order['product_type'] ?? ''),