feat: enhance player authentication and agent management features

- Updated AGENTS.md to clarify player interface bindings and agent account restrictions.
- Improved PlayerAuthLoginController to include captcha verification for player login.
- Enhanced AdminPlayerIndexController with permission checks for admin users.
- Refactored AdminPlayerStoreController to enforce agent node restrictions for non-super admins.
- Introduced new error codes for player authentication failures and updated related services.
- Enhanced validation rules for agent profiles to include settlement cycle options.
- Improved AdminCaptchaService to support separate scopes for admin and player captcha handling.
- Updated various services to ensure proper credit management and settlement processes.

app/Support/AdminAgentNodeAccess.php

@@ -23,32 +23,30 @@ final class AdminAgentNodeAccess
                 ?? AdminSite::query()->orderBy('id')->value('id'));
         }
 
-        // Check if admin is a platform account (bound via admin_user_site_roles)
-        $accessibleSiteIds = $admin->accessibleAdminSiteIds();
-        if ($accessibleSiteIds !== null) {
-            // Platform account (site admin)
-            if ($requestedSiteId !== null && $requestedSiteId > 0) {
-                if (in_array($requestedSiteId, $accessibleSiteIds, true)) {
-                    return $requestedSiteId;
-                }
+        // Agent account (bound via agent node) - check first
+        $actor = AdminAgentScope::primaryAgentNode($admin);
+        if ($actor !== null) {
+            if ($requestedSiteId !== null && $requestedSiteId > 0 && $requestedSiteId !== (int) $actor->admin_site_id) {
                 return null;
             }
 
-            // Return first accessible site if no specific site requested
-            return $accessibleSiteIds[0] ?? null;
+            return (int) $actor->admin_site_id;
         }
 
-        // Agent account (bound via agent node)
-        $actor = AdminAgentScope::primaryAgentNode($admin);
-        if ($actor === null) {
+        if (! AdminAgentScope::isSiteOnlyOperator($admin)) {
             return null;
         }
 
-        if ($requestedSiteId !== null && $requestedSiteId > 0 && $requestedSiteId !== (int) $actor->admin_site_id) {
+        $accessibleSiteIds = $admin->accessibleAdminSiteIds() ?? [];
+        if ($requestedSiteId !== null && $requestedSiteId > 0) {
+            if (in_array($requestedSiteId, $accessibleSiteIds, true)) {
+                return $requestedSiteId;
+            }
+
             return null;
         }
 
-        return (int) $actor->admin_site_id;
+        return $accessibleSiteIds[0] ?? null;
     }
 
     public static function denyUnlessSiteResolved(AdminUser $admin, ?int $siteId): ?JsonResponse

app/Support/AdminAgentScope.php

@@ -26,6 +26,18 @@ final class AdminAgentScope
         return AgentNode::query()->find($agentId);
     }
 
+    /** 仅站点运营（admin_user_site_roles），未绑定代理节点。 */
+    public static function isSiteOnlyOperator(AdminUser $admin): bool
+    {
+        if ($admin->isSuperAdmin() || self::primaryAgentNode($admin) !== null) {
+            return false;
+        }
+
+        $siteIds = $admin->accessibleAdminSiteIds();
+
+        return $siteIds !== null && $siteIds !== [];
+    }
+
     public static function nodeVisibleTo(AdminUser $admin, AgentNode $node): bool
     {
         if ($admin->isSuperAdmin()) {
@@ -55,30 +67,21 @@ final class AdminAgentScope
             return true;
         }
 
-        // Check if admin is a platform account (bound via admin_user_site_roles)
-        $accessibleSiteIds = $admin->accessibleAdminSiteIds();
-        if ($accessibleSiteIds !== null) {
-            // Platform account (site admin) can access all players in the site
-            // Site check is done by AdminSiteScope::playerAccessible before calling this
-            return true;
-        }
-
-        // Agent account (bound via agent node)
         $actor = self::primaryAgentNode($admin);
-        if ($actor === null) {
-            return false;
+        if ($actor !== null) {
+            if ($player->agent_node_id === null) {
+                return false;
+            }
+
+            $playerAgent = AgentNode::query()->find((int) $player->agent_node_id);
+            if ($playerAgent === null) {
+                return false;
+            }
+
+            return $playerAgent->isSameOrDescendantOf($actor);
         }
 
-        if ($player->agent_node_id === null) {
-            return false;
-        }
-
-        $playerAgent = AgentNode::query()->find((int) $player->agent_node_id);
-        if ($playerAgent === null) {
-            return false;
-        }
-
-        return $playerAgent->isSameOrDescendantOf($actor);
+        return self::isSiteOnlyOperator($admin);
     }
 
     public static function nodeManageableBy(AdminUser $admin, AgentNode $node): bool
@@ -113,32 +116,22 @@ final class AdminAgentScope
             return false;
         }
 
-        // Check if admin is a platform account (bound via admin_user_site_roles)
-        $accessibleSiteIds = $admin->accessibleAdminSiteIds();
-        if ($accessibleSiteIds !== null) {
-            // Platform account (site admin) can edit all nodes in the site
-            // EXCEPT their own bound agent node
-            if (in_array((int) $node->admin_site_id, $accessibleSiteIds, true)) {
-                $actor = self::primaryAgentNode($admin);
-                if ($actor !== null && (int) $actor->id === (int) $node->id) {
-                    return false; // Cannot edit own bound node
-                }
-                return true;
-            }
-            return false;
-        }
-
-        // Agent account (bound via agent node)
         $actor = self::primaryAgentNode($admin);
-        if ($actor === null) {
+        if ($actor !== null) {
+            if ((int) $actor->id === (int) $node->id) {
+                return false;
+            }
+
+            return $node->isDescendantOf($actor);
+        }
+
+        if (! self::isSiteOnlyOperator($admin)) {
             return false;
         }
 
-        if ((int) $actor->id === (int) $node->id) {
-            return false;
-        }
+        $accessibleSiteIds = $admin->accessibleAdminSiteIds();
 
-        return $node->isDescendantOf($actor);
+        return in_array((int) $node->admin_site_id, $accessibleSiteIds ?? [], true);
     }
 
     /**
@@ -188,18 +181,11 @@ final class AdminAgentScope
             return;
         }
 
-        // Check if admin is a platform account (bound via admin_user_site_roles)
-        $accessibleSiteIds = $admin->accessibleAdminSiteIds();
-        if ($accessibleSiteIds !== null) {
-            // Platform account (site admin) - site filtering is handled by AdminSiteScope
-            // No agent node filtering needed
-            return;
-        }
-
-        // Agent account (bound via agent node)
         $actor = self::primaryAgentNode($admin);
         if ($actor === null) {
-            $query->whereRaw('0 = 1');
+            if (! self::isSiteOnlyOperator($admin)) {
+                $query->whereRaw('0 = 1');
+            }
 
             return;
         }

app/Support/AdminAuthorizationRegistry.php

@@ -541,13 +541,13 @@ final class AdminAuthorizationRegistry
             ['code' => 'admin.jackpot.pools.manual-burst', 'module_code' => 'jackpot', 'name' => '手动爆池', 'http_method' => 'POST', 'uri_pattern' => '/api/v1/admin/jackpot/pools/{pool}/manual-burst', 'route_name' => 'api.v1.admin.jackpot.pools.manual-burst', 'auth_mode' => 'permission_required', 'is_audit_required' => true, 'legacy_permission_slugs' => ['prd.jackpot.manual_burst']],
 
             ['code' => 'admin.players.index', 'module_code' => 'player_service', 'name' => '玩家列表', 'http_method' => 'GET', 'uri_pattern' => '/api/v1/admin/players', 'route_name' => 'api.v1.admin.players.index', 'auth_mode' => 'permission_required', 'is_audit_required' => false, 'permission_codes' => ['service.players.manage', 'service.players.view']],
-            ['code' => 'admin.players.store', 'module_code' => 'player_service', 'name' => '创建玩家', 'http_method' => 'POST', 'uri_pattern' => '/api/v1/admin/players', 'route_name' => 'api.v1.admin.players.store', 'auth_mode' => 'permission_required', 'is_audit_required' => true, 'legacy_permission_slugs' => ['prd.users.manage']],
+            ['code' => 'admin.players.store', 'module_code' => 'player_service', 'name' => '创建玩家', 'http_method' => 'POST', 'uri_pattern' => '/api/v1/admin/players', 'route_name' => 'api.v1.admin.players.store', 'auth_mode' => 'permission_required', 'is_audit_required' => true, 'permission_codes' => ['service.players.manage']],
             ['code' => 'admin.players.show', 'module_code' => 'player_service', 'name' => '玩家详情', 'http_method' => 'GET', 'uri_pattern' => '/api/v1/admin/players/{player}', 'route_name' => 'api.v1.admin.players.show', 'auth_mode' => 'permission_required', 'is_audit_required' => false, 'permission_codes' => ['service.players.manage', 'service.players.view']],
-            ['code' => 'admin.players.update', 'module_code' => 'player_service', 'name' => '更新玩家', 'http_method' => 'PUT', 'uri_pattern' => '/api/v1/admin/players/{player}', 'route_name' => 'api.v1.admin.players.update', 'auth_mode' => 'permission_required', 'is_audit_required' => true, 'legacy_permission_slugs' => ['prd.users.manage']],
-            ['code' => 'admin.players.destroy', 'module_code' => 'player_service', 'name' => '删除玩家', 'http_method' => 'DELETE', 'uri_pattern' => '/api/v1/admin/players/{player}', 'route_name' => 'api.v1.admin.players.destroy', 'auth_mode' => 'permission_required', 'is_audit_required' => true, 'legacy_permission_slugs' => ['prd.users.manage']],
+            ['code' => 'admin.players.update', 'module_code' => 'player_service', 'name' => '更新玩家', 'http_method' => 'PUT', 'uri_pattern' => '/api/v1/admin/players/{player}', 'route_name' => 'api.v1.admin.players.update', 'auth_mode' => 'permission_required', 'is_audit_required' => true, 'permission_codes' => ['service.players.manage']],
+            ['code' => 'admin.players.destroy', 'module_code' => 'player_service', 'name' => '删除玩家', 'http_method' => 'DELETE', 'uri_pattern' => '/api/v1/admin/players/{player}', 'route_name' => 'api.v1.admin.players.destroy', 'auth_mode' => 'permission_required', 'is_audit_required' => true, 'permission_codes' => ['service.players.manage']],
             ['code' => 'admin.players.freeze', 'module_code' => 'player_service', 'name' => '冻结玩家', 'http_method' => 'POST', 'uri_pattern' => '/api/v1/admin/players/{player}/freeze', 'route_name' => 'api.v1.admin.players.freeze', 'auth_mode' => 'permission_required', 'is_audit_required' => true, 'permission_codes' => ['service.players.freeze']],
             ['code' => 'admin.players.unfreeze', 'module_code' => 'player_service', 'name' => '解冻玩家', 'http_method' => 'POST', 'uri_pattern' => '/api/v1/admin/players/{player}/unfreeze', 'route_name' => 'api.v1.admin.players.unfreeze', 'auth_mode' => 'permission_required', 'is_audit_required' => true, 'permission_codes' => ['service.players.freeze']],
-            ['code' => 'admin.players.wallets', 'module_code' => 'player_service', 'name' => '玩家钱包查看', 'http_method' => 'GET', 'uri_pattern' => '/api/v1/admin/players/{player}/wallets', 'route_name' => 'api.v1.admin.players.wallets', 'auth_mode' => 'permission_required', 'is_audit_required' => false, 'permission_codes' => ['service.wallet.view']],
+            ['code' => 'admin.players.wallets', 'module_code' => 'player_service', 'name' => '玩家钱包查看', 'http_method' => 'GET', 'uri_pattern' => '/api/v1/admin/players/{player}/wallets', 'route_name' => 'api.v1.admin.players.wallets', 'auth_mode' => 'permission_required', 'is_audit_required' => false, 'permission_codes' => ['service.players.manage', 'service.wallet.view']],
             ['code' => 'admin.players.ticket-items', 'module_code' => 'player_service', 'name' => '玩家注单查看', 'http_method' => 'GET', 'uri_pattern' => '/api/v1/admin/players/{player}/ticket-items', 'route_name' => 'api.v1.admin.players.ticket-items.index', 'auth_mode' => 'permission_required', 'is_audit_required' => false, 'permission_codes' => ['service.players.manage', 'service.tickets.view']],
             ['code' => 'admin.tickets.index', 'module_code' => 'ticket', 'name' => '后台注单列表', 'http_method' => 'GET', 'uri_pattern' => '/api/v1/admin/tickets', 'route_name' => 'api.v1.admin.tickets.index', 'auth_mode' => 'permission_required', 'is_audit_required' => false, 'legacy_permission_slugs' => ['prd.tickets.view']],
             ['code' => 'admin.tickets.show', 'module_code' => 'ticket', 'name' => '后台注单详情', 'http_method' => 'GET', 'uri_pattern' => '/api/v1/admin/tickets/{ticket_no}', 'route_name' => 'api.v1.admin.tickets.show', 'auth_mode' => 'permission_required', 'is_audit_required' => false, 'legacy_permission_slugs' => ['prd.tickets.view', 'prd.draw_result.manage', 'prd.draw_result.view', 'prd.risk.view', 'prd.risk.manage']],

app/Support/AdminDataScope.php

@@ -43,20 +43,13 @@ final class AdminDataScope
             $query->whereIn($alias.'.site_code', $codes);
         }
 
-        // Check if admin is a platform account (bound via admin_user_site_roles)
-        $accessibleSiteIds = $admin->accessibleAdminSiteIds();
-        if ($accessibleSiteIds !== null) {
-            // Platform account (site admin) - no agent node filtering needed
-            if ($requestedAgentNodeId !== null && $requestedAgentNodeId > 0) {
-                self::applyAgentNodeIdOnAlias($query, $admin, $alias, $requestedAgentNodeId);
-            }
-            return;
-        }
-
-        // Agent account (bound via agent node)
         $actor = AdminAgentScope::primaryAgentNode($admin);
         if ($actor === null) {
-            $query->whereRaw('0 = 1');
+            if (! AdminAgentScope::isSiteOnlyOperator($admin)) {
+                $query->whereRaw('0 = 1');
+            } elseif ($requestedAgentNodeId !== null && $requestedAgentNodeId > 0) {
+                self::applyAgentNodeIdOnAlias($query, $admin, $alias, $requestedAgentNodeId);
+            }
 
             return;
         }

app/Support/AdminSiteScope.php

@@ -91,13 +91,7 @@ final class AdminSiteScope
 
         $query->whereIn('site_code', $codes);
 
-        // Apply agent node filtering only for agent accounts, not platform accounts
-        $accessibleSiteIds = $admin->accessibleAdminSiteIds();
-        if ($accessibleSiteIds === null) {
-            // Agent account - apply agent node filtering
-            AdminAgentScope::applyToPlayerQuery($query, $admin);
-        }
-        // Platform account - no additional agent node filtering needed
+        AdminAgentScope::applyToPlayerQuery($query, $admin);
     }
 
     /**

app/Support/CreditAmountScale.php

@@ -35,7 +35,9 @@ final class CreditAmountScale
         return $major * self::minorUnitFactor($currencyCode);
     }
 
-    /** 最小单位 → 主货币整数（四舍五入）。 */
+    /**
+     * 最小单位 → 主货币整数（占用授信时向上取整，与 preflight 按 major 校验一致）。
+     */
     public static function minorToMajor(int $minor, string $currencyCode): int
     {
         $factor = self::minorUnitFactor($currencyCode);
@@ -43,10 +45,10 @@ final class CreditAmountScale
             return $minor;
         }
 
-        if ($minor >= 0) {
-            return intdiv($minor + intdiv($factor, 2), $factor);
+        if ($minor <= 0) {
+            return 0;
         }
 
-        return -intdiv(-$minor + intdiv($factor, 2), $factor);
+        return intdiv($minor + $factor - 1, $factor);
     }
 }

app/Support/CreditLineMode.php

@@ -3,16 +3,12 @@
 namespace App\Support;
 
 use App\Models\AdminSite;
-use App\Services\LotterySettings;
 
+/** 站点级信用占成盘开关（extra_json.credit_line_mode）；玩家判读以 funding_mode 为准。 */
 final class CreditLineMode
 {
     public static function isEnabledForSiteCode(string $siteCode): bool
     {
-        if ((bool) LotterySettings::get('settlement.credit_line_disable_instant_rebate', false)) {
-            return true;
-        }
-
         $site = AdminSite::query()->where('code', $siteCode)->first(['extra_json']);
         if ($site === null) {
             return false;

app/Support/PlayerFundingMode.php

@@ -13,18 +13,7 @@ final class PlayerFundingMode
 
     public static function usesCredit(Player $player): bool
     {
-        $mode = (string) ($player->funding_mode ?? '');
-
-        if ($mode === self::CREDIT) {
-            return true;
-        }
-
-        if ($mode === self::WALLET) {
-            return false;
-        }
-
-        return (string) ($player->auth_source ?? '') === PlayerAuthSource::LOTTERY_NATIVE
-            && CreditLineMode::isEnabledForSiteCode((string) $player->site_code);
+        return (string) ($player->funding_mode ?? '') === self::CREDIT;
     }
 
     public static function usesWallet(Player $player): bool