积分与余额账务系统硬切重构

src/Payment/Gateways/PayPalGateway.php

@@ -40,13 +40,16 @@ class PayPalGateway implements \AKSRT\Payment\GatewayInterface {
                 ? \AKSRT\Payment\OrderRepository::provider_out_trade_no($order)
                 : $order_number;
         }
-        $amount = (float) ($order['amount'] ?? 0);
+        $amount = $this->amount_string($order['amount'] ?? null);
         $subject = $order['subject'] ?? __('订单支付', 'aksrt');
         $order_currency = strtoupper((string) ($order['currency'] ?? ''));
         $currency = strtoupper((string) ($config['currency'] ?? 'USD'));
         if ($order_currency === '' || !hash_equals($order_currency, $currency)) {
             return ['success' => false, 'message' => __('PayPal 币种与订单币种不一致', 'aksrt')];
         }
+		if ($order_number === '' || $out_trade_no === '' || $amount === null) {
+			return ['success' => false, 'message' => __('订单金额无效', 'aksrt')];
+		}
 
         try {
             $response = $this->api_request('POST', '/v2/checkout/orders', [
@@ -56,7 +59,7 @@ class PayPalGateway implements \AKSRT\Payment\GatewayInterface {
                     'description'  => $subject,
                     'amount'       => [
                         'currency_code' => $currency,
-                        'value'         => number_format($amount, 2, '.', ''),
+                        'value'         => $amount,
                     ],
                 ]],
                 'application_context' => [
@@ -142,7 +145,7 @@ class PayPalGateway implements \AKSRT\Payment\GatewayInterface {
         }
     }
 
-    public function refund(string $order_number, float $amount, string $request_id = ''): array {
+	public function refund(string $order_number, string $amount, string $request_id = ''): array {
         return [
             'success' => false,
             'message' => __('PayPal 退款需要通过后台手动处理', 'aksrt'),
@@ -167,7 +170,7 @@ class PayPalGateway implements \AKSRT\Payment\GatewayInterface {
      * 用户在 return_url 返回后调用，确认真正扣款。
      *
      * @param string $paypal_order_id PayPal 订单 ID（create 时返回的 id）
-     * @return array{success:bool, order_number?:string, amount?:float, transaction_id?:string, status?:string, message?:string}
+     * @return array{success:bool, order_number?:string, amount?:string, transaction_id?:string, status?:string, message?:string}
      */
     public function capture_order(string $paypal_order_id): array {
         if ($paypal_order_id === '') {
@@ -192,16 +195,32 @@ class PayPalGateway implements \AKSRT\Payment\GatewayInterface {
     private function completed_order_evidence(array $body): array {
         $unit = $body['purchase_units'][0] ?? [];
         $capture = $unit['payments']['captures'][0] ?? [];
+		$amount = $this->amount_string($capture['amount']['value'] ?? null);
+		if ($amount === null) {
+			return ['success' => false, 'message' => __('PayPal 返回金额无效', 'aksrt')];
+		}
         return [
             'success'        => true,
             'order_number'   => (string) ($unit['reference_id'] ?? ''),
-            'amount'         => (float) ($capture['amount']['value'] ?? 0),
+            'amount'         => $amount,
             'currency'       => strtoupper((string) ($capture['amount']['currency_code'] ?? '')),
             'transaction_id' => (string) ($capture['id'] ?? ($body['id'] ?? '')),
             'status'         => 'paid',
         ];
     }
 
+	private function amount_string(mixed $value): ?string {
+		if (!is_string($value)) {
+			return null;
+		}
+		try {
+			$amount = \AKSRT\Ledger\AssetAmount::balance(trim($value));
+			return $amount->minor() > 0 ? $amount->decimal() : null;
+		} catch (\InvalidArgumentException $e) {
+			return null;
+		}
+	}
+
     /**
      * 获取 OAuth2 access token（v2 REST 必需）。
      */