diff --git a/sundynix-gateway/go.mod b/sundynix-gateway/go.mod index 2247c2e..ef68deb 100644 --- a/sundynix-gateway/go.mod +++ b/sundynix-gateway/go.mod @@ -6,6 +6,7 @@ require ( github.com/bwmarrin/snowflake v0.3.0 github.com/gin-contrib/sse v1.1.1 github.com/gin-gonic/gin v1.12.0 + github.com/glebarez/sqlite v1.11.0 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/minio/minio-go/v7 v7.2.0 github.com/prometheus/client_golang v1.23.2 @@ -30,6 +31,7 @@ require ( github.com/cloudwego/base64x v0.1.7 // indirect github.com/dustin/go-humanize v1.0.1 // indirect github.com/gabriel-vasile/mimetype v1.4.13 // indirect + github.com/glebarez/go-sqlite v1.21.2 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/go-playground/locales v0.14.1 // indirect @@ -67,6 +69,7 @@ require ( github.com/prometheus/procfs v0.16.1 // indirect github.com/quic-go/qpack v0.6.0 // indirect github.com/quic-go/quic-go v0.59.1 // indirect + github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect github.com/rs/xid v1.6.0 // indirect github.com/tinylib/msgp v1.6.1 // indirect github.com/twitchyliquid64/golang-asm v0.15.1 // indirect @@ -94,4 +97,8 @@ require ( google.golang.org/grpc v1.81.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/ini.v1 v1.67.2 // indirect + modernc.org/libc v1.22.5 // indirect + modernc.org/mathutil v1.5.0 // indirect + modernc.org/memory v1.5.0 // indirect + modernc.org/sqlite v1.23.1 // indirect ) diff --git a/sundynix-gateway/go.sum b/sundynix-gateway/go.sum index 462cc98..e7a49a1 100644 --- a/sundynix-gateway/go.sum +++ b/sundynix-gateway/go.sum @@ -31,6 +31,10 @@ github.com/gin-contrib/sse v1.1.1 h1:uGYpNwTacv5R68bSGMapo62iLTRa9l5zxGCps4hK6ko github.com/gin-contrib/sse v1.1.1/go.mod h1:QXzuVkA0YO7o/gun03UI1Q+FTI8ZV/n5t03kIQAI89s= github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8= github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc= +github.com/glebarez/go-sqlite v1.21.2 h1:3a6LFC4sKahUunAmynQKLZceZCOzUthkRkEAl9gAXWo= +github.com/glebarez/go-sqlite v1.21.2/go.mod h1:sfxdZyhQjTM2Wry3gVYWaW072Ri1WMdWJi0k6+3382k= +github.com/glebarez/sqlite v1.11.0 h1:wSG0irqzP6VurnMEpFGer5Li19RpIRi2qvQz++w0GMw= +github.com/glebarez/sqlite v1.11.0/go.mod h1:h8/o8j5wiAsqSPoWELDUdJXhjAhsVliSn7bWZjOhrgQ= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= @@ -55,6 +59,8 @@ github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= +github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbuBVKCudVG457BR2GZFIz3uw3hQ= +github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26/go.mod h1:dDKJzRmX4S37WGHujM7tX//fmj1uioxKzKxz3lo4HJo= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= @@ -135,6 +141,9 @@ github.com/quic-go/quic-go v0.59.1 h1:0Gmua0HW1Tv7ANR7hUYwRyD0MG5OJfgvYSZasGZzBi github.com/quic-go/quic-go v0.59.1/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU= github.com/redis/go-redis/v9 v9.20.0 h1:WnQYxLkgO2xiXTCJY0ldIiI8dNqCDlQAG+AtaH7a2a0= github.com/redis/go-redis/v9 v9.20.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA= +github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= +github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= +github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU= @@ -236,3 +245,11 @@ gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4= gorm.io/driver/postgres v1.6.0/go.mod h1:vUw0mrGgrTK+uPHEhAdV4sfFELrByKVGnaVRkXDhtWo= gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg= gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs= +modernc.org/libc v1.22.5 h1:91BNch/e5B0uPbJFgqbxXuOnxBQjlS//icfQEGmvyjE= +modernc.org/libc v1.22.5/go.mod h1:jj+Z7dTNX8fBScMVNRAYZ/jF91K8fdT2hYMThc3YjBY= +modernc.org/mathutil v1.5.0 h1:rV0Ko/6SfM+8G+yKiyI830l3Wuz1zRutdslNoQ0kfiQ= +modernc.org/mathutil v1.5.0/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E= +modernc.org/memory v1.5.0 h1:N+/8c5rE6EqugZwHii4IFsaJ7MUhoWX07J5tC/iI5Ds= +modernc.org/memory v1.5.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU= +modernc.org/sqlite v1.23.1 h1:nrSBg4aRQQwq59JpvGEQ15tNxoO5pX/kUjcRNwSAGQM= +modernc.org/sqlite v1.23.1/go.mod h1:OrDj17Mggn6MhE+iPbBNf7RGKODDE9NFT0f3EwDzJqk= diff --git a/sundynix-gateway/internal/store/payment_invariant_test.go b/sundynix-gateway/internal/store/payment_invariant_test.go new file mode 100644 index 0000000..34272ff --- /dev/null +++ b/sundynix-gateway/internal/store/payment_invariant_test.go @@ -0,0 +1,191 @@ +package store + +import ( + "context" + "testing" + + "github.com/sundynix/sundynix-shared/contract" +) + +// 这些是本会话 live 手验过的支付/计费不变量，固化成回归测试（P0-1）。 +// 涉及钱的路径此前 0 测试——一个回归就是真金白银的错账。 + +// GrantCredits：记 grant 分录 + 增物化余额，且余额恒等于账本之和。 +func TestGrantCredits_LedgerAndBalance(t *testing.T) { + p := newTestStore(t) + ctx := context.Background() + seedTenant(t, p, "t1") + + if err := p.GrantCredits(ctx, "t1", LedgerGrant, 100_000_000, "ref-a", "充值A"); err != nil { + t.Fatalf("充值失败: %v", err) + } + if bal := p.TenantBalance(WithoutTenant(ctx), "t1"); bal != 100_000_000 { + t.Fatalf("首充后余额应为 100e6，得 %d", bal) + } + if err := p.GrantCredits(ctx, "t1", LedgerGrant, 50_000_000, "ref-b", "充值B"); err != nil { + t.Fatalf("二次充值失败: %v", err) + } + if bal := p.TenantBalance(WithoutTenant(ctx), "t1"); bal != 150_000_000 { + t.Fatalf("二次充值后余额应为 150e6，得 %d", bal) + } + assertBalanceInvariant(t, p, "t1") +} + +// 兑换码核销：一次性（CAS）+ 原子入账（码占用/订单/分录/余额同事务）。 +func TestRedeem_OnceAndAtomic(t *testing.T) { + p := newTestStore(t) + ctx := context.Background() + seedTenant(t, p, "t1") + + codes, err := p.GenerateRedeemCodes(ctx, 1, 100_000_000, "测试") + if err != nil { + t.Fatalf("生成码失败: %v", err) + } + code := codes[0] + + order, err := p.Redeem(ctx, code, "t1", "u1") + if err != nil { + t.Fatalf("首次核销应成功: %v", err) + } + if order.Status != OrderPaid || order.CreditsMicro != 100_000_000 { + t.Fatalf("订单应 paid/100e6，得 %s/%d", order.Status, order.CreditsMicro) + } + if bal := p.TenantBalance(WithoutTenant(ctx), "t1"); bal != 100_000_000 { + t.Fatalf("核销后余额应 100e6，得 %d", bal) + } + + // 同码再核销 → 必须被 CAS 拦下，且余额纹丝不动（不重复入账）。 + if _, err := p.Redeem(ctx, code, "t1", "u1"); err == nil { + t.Fatal("同一张码第二次核销应报错") + } + if bal := p.TenantBalance(WithoutTenant(ctx), "t1"); bal != 100_000_000 { + t.Fatalf("重复核销后余额不应变，得 %d", bal) + } + assertBalanceInvariant(t, p, "t1") + + // 瞎编的码 → 报错。 + if _, err := p.Redeem(ctx, "SDX-FAKE-FAKE-FAKE", "t1", "u1"); err == nil { + t.Fatal("不存在的码应报错") + } +} + +// 账本 (kind,ref) 部分唯一索引：支付回调 at-least-once，重复的 grant 分录必须被兜底拦下。 +func TestLedgerGrantRefUnique_Backstop(t *testing.T) { + p := newTestStore(t) + seedTenant(t, p, "t1") + + first := &CreditLedger{TenantID: "t1", Kind: LedgerGrant, CreditsMicro: 1_000_000, Ref: "order-x", Memo: "首次"} + if err := p.db.Create(first).Error; err != nil { + t.Fatalf("首条 grant 应成功: %v", err) + } + // 同 (kind=grant, ref=order-x) 再插 → 唯一索引拒绝。 + dup := &CreditLedger{TenantID: "t1", Kind: LedgerGrant, CreditsMicro: 1_000_000, Ref: "order-x", Memo: "重复"} + if err := p.db.Create(dup).Error; err == nil { + t.Fatal("重复 grant/ref 应被唯一索引拒绝") + } + // usage 分录不受该索引约束（部分索引只管 kind='grant'）：同 ref 的 usage 可正常写。 + u := &CreditLedger{TenantID: "t1", Kind: LedgerUsage, CreditsMicro: -1, Ref: "order-x", Memo: "用量"} + if err := p.db.Create(u).Error; err != nil { + t.Fatalf("usage 分录不该被 grant 索引挡住: %v", err) + } +} + +// MarkOrderPaid：CAS 幂等——回调重复推送/回调与查单赛跑时只入账一次。 +func TestMarkOrderPaid_IdempotentCAS(t *testing.T) { + p := newTestStore(t) + ctx := context.Background() + seedTenant(t, p, "t1") + + o := &PaymentOrder{TenantID: "t1", UserID: "u1", AmountFen: 990, CreditsMicro: 100_000_000, Channel: ChannelWechat, Status: OrderPending} + if err := p.CreateOrder(ctx, o); err != nil { + t.Fatalf("建单失败: %v", err) + } + + changed, err := p.MarkOrderPaid(ctx, o.ID, "wx-txn-1") + if err != nil || !changed { + t.Fatalf("首次入账应 changed=true, err=%v", err) + } + if bal := p.TenantBalance(WithoutTenant(ctx), "t1"); bal != 100_000_000 { + t.Fatalf("入账后余额应 100e6，得 %d", bal) + } + + // 再次 MarkOrderPaid（模拟重复回调）→ changed=false，余额不变，无第二条分录。 + changed2, err := p.MarkOrderPaid(ctx, o.ID, "wx-txn-1") + if err != nil { + t.Fatalf("重复入账不应报错: %v", err) + } + if changed2 { + t.Fatal("重复回调应 changed=false（幂等），不得重复入账") + } + if bal := p.TenantBalance(WithoutTenant(ctx), "t1"); bal != 100_000_000 { + t.Fatalf("重复回调后余额不应变，得 %d", bal) + } + assertBalanceInvariant(t, p, "t1") +} + +// SaveUsageEvent：task_id 幂等锚——同一任务的用量重投不重复扣费。 +func TestSaveUsageEvent_IdempotentByTask(t *testing.T) { + p := newTestStore(t) + ctx := context.Background() + seedTenant(t, p, "t1") + p.GrantCredits(ctx, "t1", LedgerGrant, 100_000_000, "seed", "初始") // 先充值垫底 + + ev := &contract.UsageEvent{ + TenantID: "t1", UserID: "u1", TaskID: "task-1", Model: "test-model", + PromptTok: 500, CompTok: 500, TotalTok: 1000, TS: 1_700_000_000_000, + } + // tokensPerCredit 默认 1000、weight 默认 1.0 → 1000 tok = 1 积分 = 1e6 micro。 + inserted, err := p.SaveUsageEvent(ctx, ev) + if err != nil || !inserted { + t.Fatalf("首次计量应 inserted=true, err=%v", err) + } + after1 := p.TenantBalance(WithoutTenant(ctx), "t1") + if after1 != 99_000_000 { // 100e6 - 1e6 + t.Fatalf("扣费后余额应 99e6，得 %d", after1) + } + + // 同 task_id 重投 → inserted=false，余额纹丝不动（不重复扣）。 + inserted2, err := p.SaveUsageEvent(ctx, ev) + if err != nil { + t.Fatalf("重投不应报错: %v", err) + } + if inserted2 { + t.Fatal("同 task_id 重投应 inserted=false（幂等）") + } + if bal := p.TenantBalance(WithoutTenant(ctx), "t1"); bal != after1 { + t.Fatalf("重投后余额不应变，得 %d（应 %d）", bal, after1) + } + assertBalanceInvariant(t, p, "t1") +} + +// ReconcileOrders：paid 订单缺对应 grant 分录 → 抓出 order_without_ledger（钱到了积分没给，最严重）。 +func TestReconcileOrders_DetectsMissingLedger(t *testing.T) { + p := newTestStore(t) + ctx := context.Background() + seedTenant(t, p, "t1") + + // 正常入账的单：对账应无差异。 + o := &PaymentOrder{TenantID: "t1", UserID: "u1", AmountFen: 100, CreditsMicro: 1_000_000, Channel: ChannelWechat, Status: OrderPending} + p.CreateOrder(ctx, o) + p.MarkOrderPaid(ctx, o.ID, "txn") + if diffs, _ := p.ReconcileOrders(ctx, 100); len(diffs) != 0 { + t.Fatalf("正常入账单不该有对账差异，得 %d 条", len(diffs)) + } + + // 造一张 paid 但无账本分录的坏单 → 应被抓出。 + bad := &PaymentOrder{BaseModel: BaseModel{ID: "bad-order"}, TenantID: "t1", UserID: "u1", CreditsMicro: 5_000_000, Channel: ChannelWechat, Status: OrderPaid} + p.db.Create(bad) + diffs, err := p.ReconcileOrders(ctx, 100) + if err != nil { + t.Fatalf("对账失败: %v", err) + } + found := false + for _, d := range diffs { + if d.OrderID == "bad-order" && d.Issue == "order_without_ledger" { + found = true + } + } + if !found { + t.Fatalf("应抓出 bad-order 的 order_without_ledger 差异，实得 %+v", diffs) + } +} diff --git a/sundynix-gateway/internal/store/tenant_isolation_test.go b/sundynix-gateway/internal/store/tenant_isolation_test.go new file mode 100644 index 0000000..330a1de --- /dev/null +++ b/sundynix-gateway/internal/store/tenant_isolation_test.go @@ -0,0 +1,96 @@ +package store + +import ( + "context" + "testing" +) + +// 租户数据层隔离（P0-3）：tenant_scope 插件是多租户的命根，此前只测了角色门禁、 +// 没测数据层是否真隔离。一个回归就可能串租户数据——SaaS 里这是致命的。 +// 用租户作用域模型 KB 验证：创建自动填 tenant_id + 查询自动按 ctx 租户过滤 + WithoutTenant 跨租户可见。 + +func countKB(t *testing.T, p *Postgres, ctx context.Context) int64 { + t.Helper() + var n int64 + if err := p.db.WithContext(ctx).Model(&KB{}).Count(&n).Error; err != nil { + t.Fatalf("计数失败: %v", err) + } + return n +} + +func TestTenantScope_CreateAutoFillAndQueryFilter(t *testing.T) { + p := newTestStore(t) + ctxA := WithTenant(context.Background(), "tenant-A") + ctxB := WithTenant(context.Background(), "tenant-B") + + // 在 A 的上下文里建库，不显式写 tenant_id —— 插件应自动填成 tenant-A。 + kb := &KB{Name: "A的库", Owner: "u1", Kind: "general"} + if err := p.db.WithContext(ctxA).Create(kb).Error; err != nil { + t.Fatalf("建库失败: %v", err) + } + var got KB + p.db.WithContext(WithoutTenant(context.Background())).First(&got, "id = ?", kb.ID) + if got.TenantID != "tenant-A" { + t.Fatalf("创建应自动填 tenant_id=tenant-A，实得 %q", got.TenantID) + } + + // B 的上下文查不到 A 的库（隔离）。 + if n := countKB(t, p, ctxB); n != 0 { + t.Fatalf("tenant-B 不该看到 tenant-A 的库，却查到 %d 条", n) + } + // A 的上下文能查到自己的。 + if n := countKB(t, p, ctxA); n != 1 { + t.Fatalf("tenant-A 应看到自己 1 条库，实得 %d", n) + } +} + +func TestTenantScope_CrossTenantLeakGuard(t *testing.T) { + p := newTestStore(t) + ctxA := WithTenant(context.Background(), "tenant-A") + ctxB := WithTenant(context.Background(), "tenant-B") + + p.db.WithContext(ctxA).Create(&KB{Name: "A1", Kind: "general"}) + p.db.WithContext(ctxA).Create(&KB{Name: "A2", Kind: "general"}) + p.db.WithContext(ctxB).Create(&KB{Name: "B1", Kind: "general"}) + + if n := countKB(t, p, ctxA); n != 2 { + t.Fatalf("A 应见 2 条，实得 %d", n) + } + if n := countKB(t, p, ctxB); n != 1 { + t.Fatalf("B 应见 1 条，实得 %d", n) + } + // WithoutTenant（系统/admin 聚合口径）应看到全部 3 条。 + if n := countKB(t, p, WithoutTenant(context.Background())); n != 3 { + t.Fatalf("WithoutTenant 应见全部 3 条，实得 %d", n) + } + // 无 tenant 上下文（既非 WithTenant 也非 WithoutTenant）：插件不过滤，等同系统视角 + // —— 这是设计约定（回填/未登录路径），用户面由中间件保证必有 tenant。 + if n := countKB(t, p, context.Background()); n != 3 { + t.Fatalf("裸 ctx 不过滤应见全部 3 条，实得 %d", n) + } +} + +func TestTenantScope_UpdateAndDeleteScoped(t *testing.T) { + p := newTestStore(t) + ctxA := WithTenant(context.Background(), "tenant-A") + ctxB := WithTenant(context.Background(), "tenant-B") + + a := &KB{Name: "A的库", Kind: "general"} + p.db.WithContext(ctxA).Create(a) + + // B 的上下文尝试改 A 的库 —— 插件按 tenant-B 过滤，命不中，改不动（防越权写他租）。 + res := p.db.WithContext(ctxB).Model(&KB{}).Where("id = ?", a.ID).Update("name", "被B改了") + if res.RowsAffected != 0 { + t.Fatalf("B 不该能改 A 的库，却影响了 %d 行", res.RowsAffected) + } + // B 的上下文删 A 的库 —— 同样命不中。 + res = p.db.WithContext(ctxB).Where("id = ?", a.ID).Delete(&KB{}) + if res.RowsAffected != 0 { + t.Fatalf("B 不该能删 A 的库，却删了 %d 行", res.RowsAffected) + } + // A 自己能改。 + res = p.db.WithContext(ctxA).Model(&KB{}).Where("id = ?", a.ID).Update("name", "A自己改") + if res.RowsAffected != 1 { + t.Fatalf("A 应能改自己的库，实影响 %d 行", res.RowsAffected) + } +} diff --git a/sundynix-gateway/internal/store/testdb_test.go b/sundynix-gateway/internal/store/testdb_test.go new file mode 100644 index 0000000..79487ba --- /dev/null +++ b/sundynix-gateway/internal/store/testdb_test.go @@ -0,0 +1,64 @@ +package store + +import ( + "context" + "testing" + + "github.com/glebarez/sqlite" // 纯 Go sqlite（无 CGO）：DB 背书的单测在 CI ubuntu 无 Postgres 服务时也能跑 + "gorm.io/gorm" + "gorm.io/gorm/logger" +) + +// newTestStore 起一个内存 sqlite，迁移同款模型 + 建那道支付幂等兜底的部分唯一索引 + +// 挂租户作用域回调，尽量贴近生产 Postgres 的行为（核心事务/CAS/OnConflict 在两者一致）。 +// 返回的 *Postgres 直接复用生产的 store 方法——测的是真逻辑，不是替身。 +func newTestStore(t *testing.T) *Postgres { + t.Helper() + // 静音 gorm 日志：计费路径故意查 pricing/setting 取不到时回退默认，属预期空查询，别刷屏。 + db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)}) + if err != nil { + t.Fatalf("打开内存 sqlite 失败: %v", err) + } + sqlDB, err := db.DB() + if err != nil { + t.Fatalf("取 *sql.DB 失败: %v", err) + } + sqlDB.SetMaxOpenConns(1) // :memory: 每连接一个库，锁死单连接才共享同一份数据 + + if err := db.AutoMigrate( + &User{}, &Tenant{}, &TenantMember{}, &CreditLedger{}, &PaymentOrder{}, + &RedeemCode{}, &CreditPack{}, &UsageEvent{}, &UsageRollup{}, &Setting{}, &Pricing{}, &LLMModel{}, + &KB{}, // 租户作用域模型，验证隔离插件 + ); err != nil { + t.Fatalf("AutoMigrate 失败: %v", err) + } + // 支付入账幂等兜底闸：与 pgsql.go 生产建的同一道部分唯一索引（sqlite 同样支持）。 + if err := db.Exec(`CREATE UNIQUE INDEX idx_ledger_grant_ref ON sundynix_credit_ledger (kind, ref) WHERE kind = 'grant' AND ref <> ''`).Error; err != nil { + t.Fatalf("建幂等索引失败: %v", err) + } + registerTenantScope(db) + return &Postgres{db: db} +} + +// seedTenant 建一个租户行（GrantCredits/MarkOrderPaid 靠 UpdateColumn 更新它的物化余额， +// 无租户行则余额更新落空 → 破坏「余额 == SUM(ledger)」不变量，故测试必须先建）。 +func seedTenant(t *testing.T, p *Postgres, id string) { + t.Helper() + if err := p.db.Create(&Tenant{BaseModel: BaseModel{ID: id}, Name: "T-" + id, Slug: "slug-" + id, Status: "active"}).Error; err != nil { + t.Fatalf("建租户失败: %v", err) + } +} + +// balanceEqualsSumLedger 是计费系统的核心不变量：物化余额 == 账本分录之和。 +// 任何入账/扣费路径违反它都是对账事故。 +func assertBalanceInvariant(t *testing.T, p *Postgres, tenantID string) { + t.Helper() + ctx := WithoutTenant(context.Background()) + var sum int64 + p.db.WithContext(ctx).Model(&CreditLedger{}).Where("tenant_id = ?", tenantID). + Select("coalesce(sum(credits_micro),0)").Scan(&sum) + bal := p.TenantBalance(ctx, tenantID) + if bal != sum { + t.Fatalf("不变量破坏：物化余额=%d 但 SUM(ledger)=%d", bal, sum) + } +}