feat(core): harden sessions settlement and credit activity

app/Http/Controllers/Api/V1/Admin/Auth/LoginController.php

@@ -8,6 +8,7 @@ use Illuminate\Support\Str;
 use App\Support\ApiResponse;
 use App\Support\AdminAuthProfile;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\DB;
 use App\Http\Controllers\Controller;
 use Illuminate\Support\Facades\Hash;
 use App\Services\AdminCaptchaService;
@@ -37,38 +38,59 @@ final class LoginController extends Controller
 
         $normalizedAccount = Str::lower(trim($data['account']));
 
-        /** @var AdminUser|null $admin */
-        $admin = AdminUser::query()->where('username', $normalizedAccount)->first();
-
-        $passwordOk = $admin !== null && Hash::check($data['password'], $admin->password);
-
-        if (! $passwordOk) {
-            /** 统一措辞，弱化枚举用户 */
-            return ApiResponse::error(
-                trans('admin.invalid_credentials', [], $locale),
-                ErrorCode::AdminCredentialsInvalid->value,
-                null,
-                401,
-            );
-        }
-
-        if ((int) $admin->status !== 0) {
-            return ApiResponse::error(
-                trans('admin.account_disabled', [], $locale),
-                ErrorCode::AdminAccountDisabled->value,
-                null,
-                403,
-            );
-        }
-
         $ttlDays = (int) config('lottery.admin_api.token_ttl_days', 7);
-        $plainToken = $admin->createToken(
-            'admin-api',
-            ['*'],
-            now()->addDays(max(1, $ttlDays)),
-        )->plainTextToken;
 
-        $admin->forceFill(['last_login_at' => now()])->save();
+        /**
+         * 串行化同账号登录，确保并发登录也只有版本号最大的会话有效。
+         * 不立即删除旧 Token，旧端下一次请求时才能收到明确的 8115 业务码。
+         */
+        $loginResult = DB::transaction(function () use ($normalizedAccount, $data, $ttlDays, $locale): array|JsonResponse {
+            /** @var AdminUser|null $lockedAdmin */
+            $lockedAdmin = AdminUser::query()
+                ->where('username', $normalizedAccount)
+                ->lockForUpdate()
+                ->first();
+
+            if ($lockedAdmin === null || ! Hash::check($data['password'], $lockedAdmin->password)) {
+                /** 统一措辞，弱化枚举用户 */
+                return ApiResponse::error(
+                    trans('admin.invalid_credentials', [], $locale),
+                    ErrorCode::AdminCredentialsInvalid->value,
+                    null,
+                    401,
+                );
+            }
+
+            if ((int) $lockedAdmin->status !== 0) {
+                return ApiResponse::error(
+                    trans('admin.account_disabled', [], $locale),
+                    ErrorCode::AdminAccountDisabled->value,
+                    null,
+                    403,
+                );
+            }
+
+            $sessionVersion = (int) $lockedAdmin->admin_session_version + 1;
+            $lockedAdmin->forceFill([
+                'admin_session_version' => $sessionVersion,
+                'last_login_at' => now(),
+            ])->save();
+
+            $token = $lockedAdmin->createToken(
+                'admin-api',
+                ['admin-session:'.$sessionVersion],
+                now()->addDays(max(1, $ttlDays)),
+            )->plainTextToken;
+
+            return [$token, $lockedAdmin];
+        });
+
+        if ($loginResult instanceof JsonResponse) {
+            return $loginResult;
+        }
+
+        [$plainToken, $admin] = $loginResult;
+
         return ApiResponse::success([
             'token' => $plainToken,
             'token_type' => 'Bearer',

app/Http/Controllers/Api/V1/Admin/Auth/LogoutController.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Auth;
+
+use App\Support\ApiResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\JsonResponse;
+use App\Http\Controllers\Controller;
+
+final class LogoutController extends Controller
+{
+    public function __invoke(Request $request): JsonResponse
+    {
+        $request->lotteryAdmin()->tokens()
+            ->where('name', 'admin-api')
+            ->delete();
+
+        return ApiResponse::success(['logged_out' => true]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Draw/AdminDrawFinanceSummaryController.php

@@ -3,17 +3,18 @@
 namespace App\Http\Controllers\Api\V1\Admin\Draw;
 
 use App\Models\Draw;
+use App\Models\AdminUser;
+use App\Lottery\ErrorCode;
 use App\Models\TicketItem;
 use App\Models\TicketOrder;
-use App\Models\AdminUser;
+use App\Support\ApiMessage;
 use App\Support\ApiResponse;
+use Illuminate\Http\Request;
 use App\Models\SettlementBatch;
+use App\Support\AdminScopePolicy;
 use Illuminate\Http\JsonResponse;
 use App\Http\Controllers\Controller;
-use App\Lottery\ErrorCode;
 use App\Support\AdminDrawResponsePolicy;
-use App\Support\AdminScopePolicy;
-use App\Support\ApiMessage;
 
 /**
  * GET /api/v1/admin/draws/{draw}/finance-summary — 单期投注/派彩汇总（客服/财务视角，PRD §15.4）。
@@ -22,7 +23,7 @@ use App\Support\ApiMessage;
  */
 final class AdminDrawFinanceSummaryController extends Controller
 {
-    public function __invoke(\Illuminate\Http\Request $request, Draw $draw): JsonResponse
+    public function __invoke(Request $request, Draw $draw): JsonResponse
     {
         $admin = $request->lotteryAdmin();
         abort_if(! $admin instanceof AdminUser, 401);
@@ -58,14 +59,19 @@ final class AdminDrawFinanceSummaryController extends Controller
         $approxHouseGrossMinor = $totalBetMinor - $totalPayoutMinor;
 
         $batches = SettlementBatch::query()
+            ->with('resultBatch:id,provider_code,provider_name,result_version')
             ->where('draw_id', $drawId)
             ->orderByDesc('id')
             ->limit(30)
-            ->get(['id', 'status', 'total_ticket_count', 'total_win_count', 'total_payout_amount', 'total_jackpot_payout_amount', 'finished_at']);
+            ->get(['id', 'result_batch_id', 'settle_version', 'status', 'total_ticket_count', 'total_win_count', 'total_payout_amount', 'total_jackpot_payout_amount', 'finished_at']);
 
         $batchRows = $batches->map(static function (SettlementBatch $b): array {
             return [
                 'id' => (int) $b->id,
+                'provider_code' => $b->resultBatch?->provider_code,
+                'provider_name' => $b->resultBatch?->provider_name,
+                'result_version' => $b->resultBatch !== null ? (int) $b->resultBatch->result_version : null,
+                'settle_version' => (int) $b->settle_version,
                 'status' => $b->status,
                 'total_ticket_count' => (int) $b->total_ticket_count,
                 'total_win_count' => (int) $b->total_win_count,

app/Http/Controllers/Api/V1/Admin/Draw/DrawSettlementRunController.php

@@ -5,18 +5,21 @@ namespace App\Http\Controllers\Api\V1\Admin\Draw;
 use App\Models\Draw;
 use App\Models\AdminUser;
 use App\Lottery\ErrorCode;
+use App\Support\ApiMessage;
 use App\Support\ApiResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\JsonResponse;
 use App\Http\Controllers\Controller;
 use App\Services\Settlement\SettlementOrchestrator;
+use App\Services\Settlement\DrawSettlementStartService;
 
 /**
- * POST /api/v1/admin/draws/{draw}/settlement/run — 对 `settling` 期号执行结算（可关自动结算时手工触发）。
+ * POST /api/v1/admin/draws/{draw}/settlement/run — 冷静期可提前结算，结算中可幂等重试。
  */
 final class DrawSettlementRunController extends Controller
 {
     public function __construct(
+        private readonly DrawSettlementStartService $startService,
         private readonly SettlementOrchestrator $orchestrator,
     ) {}
 
@@ -32,7 +35,13 @@ final class DrawSettlementRunController extends Controller
             );
         }
 
-        $ran = $this->orchestrator->trySettleDraw($draw);
+        try {
+            $started = $this->startService->start($draw);
+        } catch (\RuntimeException $e) {
+            return ApiMessage::runtimeErrorResponse($request, $e);
+        }
+
+        $ran = $this->orchestrator->trySettleDraw($started['draw']);
 
         $draw->refresh();
 
@@ -44,6 +53,8 @@ final class DrawSettlementRunController extends Controller
                     'draw_no' => $draw->draw_no,
                     'status' => $draw->status,
                     'settle_version' => (int) $draw->settle_version,
+                    'cooldown_skipped' => $started['cooldown_skipped'],
+                    'cooling_end_time' => $draw->cooling_end_time?->toIso8601String(),
                 ],
                 409,
             );
@@ -54,6 +65,8 @@ final class DrawSettlementRunController extends Controller
             'draw_no' => $draw->draw_no,
             'status' => $draw->status,
             'settle_version' => (int) $draw->settle_version,
+            'cooldown_skipped' => $started['cooldown_skipped'],
+            'cooling_end_time' => $draw->cooling_end_time?->toIso8601String(),
         ]);
     }
 }

app/Http/Controllers/Api/V1/Ticket/TicketItemsIndexController.php

@@ -5,12 +5,12 @@ namespace App\Http\Controllers\Api\V1\Ticket;
 use App\Models\Player;
 use App\Models\TicketItem;
 use App\Support\ApiResponse;
-use App\Support\TicketItemListFilters;
 use Illuminate\Http\Request;
 use App\Support\PaginationTrait;
 use Illuminate\Http\JsonResponse;
 use App\Support\CurrencyFormatter;
 use App\Http\Controllers\Controller;
+use App\Support\TicketItemListFilters;
 
 /**
  * `GET /api/v1/ticket/items` — 我的注单（注项列表，支持 `draw_no` 筛选）。
@@ -37,6 +37,7 @@ final class TicketItemsIndexController extends Controller
             $statusInput,
         ))) : [];
         $number = trim((string) $request->query('number', ''));
+        $ticketNo = trim((string) $request->query('ticket_no', ''));
         $orderNo = trim((string) $request->query('order_no', ''));
         $startDate = $this->normalizeDate((string) $request->query('start_date', ''));
         $endDate = $this->normalizeDate((string) $request->query('end_date', ''));
@@ -62,6 +63,10 @@ final class TicketItemsIndexController extends Controller
             $query->whereHas('order', fn ($q) => $q->where('order_no', $orderNo));
         }
 
+        if ($ticketNo !== '') {
+            $query->where('ticket_items.ticket_no', $ticketNo);
+        }
+
         $this->applyTicketItemNumberSearch($query, $number);
         $this->applyOrderPlacedDateRange($query, $startDate, $endDate);