From abc3f1565fe18d2b5c18bd9a257f7b292584d983 Mon Sep 17 00:00:00 2001
From: unknown <kate522@88.com>
Date: Mon, 27 Jul 2026 11:31:39 +0800
Subject: [PATCH] fix(payment): reject duplicate provider transactions

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/AKSRT/Payment/Gateway.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/AKSRT/Payment/Gateway.php b/src/AKSRT/Payment/Gateway.php
index bba3cb0a..721d2ca3 100644
--- a/src/AKSRT/Payment/Gateway.php
+++ b/src/AKSRT/Payment/Gateway.php
@@ -296,9 +296,11 @@ class Gateway {
 
         $current = (string) ($order['status'] ?? '');
 
-        // 幂等：已支付/已交付/已完成视为成功，不重复处理（回调可能多次到达）
+        // 幂等：仅同一交易号的重复回调可视为成功。不同交易号意味着
+        // 用户可能重复付款，不能静默 ACK 为已正确同步。
         if (in_array($current, ['paid', 'delivered', 'completed'], true)) {
-            return true;
+            $stored_transaction = sanitize_text_field((string) ($order['payment_transaction_id'] ?? ''));
+            return $stored_transaction !== '' && hash_equals($stored_transaction, $transaction_id);
         }
         // 只允许从未支付态完成
         if (!in_array($current, ['created', 'pending'], true)) {