fix(core): harden settlement and wallet integration

app/Services/Player/NativeJwtSecretGuard.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Services\Player;
+
+use Throwable;
+use App\Models\AdminSite;
+use App\Lottery\ErrorCode;
+use Illuminate\Support\Facades\Schema;
+use App\Exceptions\PlayerAuthenticationException;
+
+final class NativeJwtSecretGuard
+{
+    public function validatedSecret(): string
+    {
+        $secret = config('lottery.player_auth.native.secret');
+        if (! is_string($secret) || $secret === '') {
+            $this->rejectConfiguration('原生登录未配置');
+        }
+
+        $legacySsoSecret = config('lottery.main_site.sso_jwt_secret');
+        if ($this->matches($secret, $legacySsoSecret)) {
+            $this->rejectConfiguration('原生登录密钥不得与 legacy SSO 密钥相同');
+        }
+
+        if ($this->matchesStoredSiteSsoSecret($secret)) {
+            $this->rejectConfiguration('原生登录密钥不得与任何站点保存的 SSO 密钥相同');
+        }
+
+        return $secret;
+    }
+
+    private function matchesStoredSiteSsoSecret(string $nativeSecret): bool
+    {
+        try {
+            if (! Schema::hasTable('admin_sites')
+                || ! Schema::hasColumn('admin_sites', 'sso_jwt_secret_encrypted')) {
+                return false;
+            }
+
+            $sites = AdminSite::query()
+                ->whereNotNull('sso_jwt_secret_encrypted')
+                ->get(['sso_jwt_secret_encrypted']);
+        } catch (Throwable) {
+            $this->rejectConfiguration('无法检查原生登录密钥是否与站点 SSO 密钥冲突');
+        }
+
+        foreach ($sites as $site) {
+            if ($this->matches($nativeSecret, $site->decryptedSsoJwtSecret())) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private function matches(string $nativeSecret, mixed $candidate): bool
+    {
+        return is_string($candidate)
+            && $candidate !== ''
+            && hash_equals($nativeSecret, $candidate);
+    }
+
+    private function rejectConfiguration(string $message): never
+    {
+        throw new PlayerAuthenticationException(
+            $message,
+            ErrorCode::PlayerSsoSecretNotConfigured->value,
+            503,
+        );
+    }
+}

app/Services/Player/PlayerCreditService.php

@@ -3,19 +3,20 @@
 namespace App\Services\Player;
 
 use App\Models\Player;
-use App\Services\Agent\AgentUsedCreditSyncService;
 use App\Support\AgentOverdueGuard;
 use App\Support\CreditAmountScale;
 use App\Support\PlayerFundingMode;
-use Illuminate\Database\QueryException;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Database\QueryException;
 use Illuminate\Validation\ValidationException;
+use App\Services\Agent\AgentUsedCreditSyncService;
 
 final class PlayerCreditService
 {
     public function __construct(
         private readonly AgentUsedCreditSyncService $usedCreditSync,
     ) {}
+
     /**
      * @param  array{credit_limit?: int}  $payload
      */
@@ -163,8 +164,12 @@ final class PlayerCreditService
         $this->syncAgentUsedCredit($player);
     }
 
-    public function applySettledLoss(Player $player, int $amountMinor, int $ticketItemId): void
-    {
+    public function applySettledLoss(
+        Player $player,
+        int $amountMinor,
+        int $ticketItemId,
+        int $settlementVersion = 0,
+    ): void {
         if ($amountMinor <= 0) {
             return;
         }
@@ -187,6 +192,7 @@ final class PlayerCreditService
                 'reason' => 'game_settlement_loss',
                 'ref_type' => 'ticket_item',
                 'ref_id' => $ticketItemId,
+                'settlement_version' => $settlementVersion,
                 'created_at' => $now,
                 'updated_at' => $now,
             ]);
@@ -218,8 +224,12 @@ final class PlayerCreditService
         $this->syncAgentUsedCredit($player);
     }
 
-    public function applySettledWin(Player $player, int $amountMinor, int $ticketItemId): void
-    {
+    public function applySettledWin(
+        Player $player,
+        int $amountMinor,
+        int $ticketItemId,
+        int $settlementVersion = 0,
+    ): void {
         if ($amountMinor <= 0) {
             return;
         }
@@ -228,30 +238,55 @@ final class PlayerCreditService
             return;
         }
 
-        $now = now();
+        $applied = DB::transaction(function () use ($player, $amountMinor, $ticketItemId, $settlementVersion): bool {
+            $now = now();
+            $currency = (string) $player->default_currency;
+            $requestedMajor = CreditAmountScale::minorToMajor($amountMinor, $currency);
+            $account = DB::table('player_credit_accounts')
+                ->where('player_id', $player->id)
+                ->lockForUpdate()
+                ->first();
+            $appliedMajor = $account === null
+                ? 0
+                : min((int) $account->used_credit, $requestedMajor);
+            $appliedMinor = CreditAmountScale::majorToMinor($appliedMajor, $currency);
 
-        // 先写 credit_ledger：以 (ref_type, ref_id, reason) partial unique 索引为幂等闸门。
-        // 已存在同 (ticket_item, game_settlement_win) 的流水则直接返回，避免并发/重入场景下重复扣减 used_credit。
-        try {
-            DB::table('credit_ledger')->insert([
-                'owner_type' => 'player',
-                'owner_id' => $player->id,
-                'amount' => $amountMinor,
-                'reason' => 'game_settlement_win',
-                'ref_type' => 'ticket_item',
-                'ref_id' => $ticketItemId,
-                'created_at' => $now,
-                'updated_at' => $now,
-            ]);
-        } catch (QueryException $e) {
-            if ($this->isUniqueViolation($e)) {
-                return;
+            // 流水记录实际释放的额度，而非可能超过 used_credit 的名义中奖额。
+            // 结算被驳回时必须按这个实际值恢复，否则会凭空增加玩家已用额度。
+            try {
+                DB::table('credit_ledger')->insert([
+                    'owner_type' => 'player',
+                    'owner_id' => $player->id,
+                    'amount' => $appliedMinor,
+                    'reason' => 'game_settlement_win',
+                    'ref_type' => 'ticket_item',
+                    'ref_id' => $ticketItemId,
+                    'settlement_version' => $settlementVersion,
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ]);
+            } catch (QueryException $e) {
+                if ($this->isUniqueViolation($e)) {
+                    return false;
+                }
+                throw $e;
             }
-            throw $e;
-        }
 
-        $this->decreaseUsedCredit($player, $amountMinor);
-        $this->syncAgentUsedCredit($player);
+            if ($account !== null && $appliedMajor > 0) {
+                DB::table('player_credit_accounts')
+                    ->where('player_id', $player->id)
+                    ->update([
+                        'used_credit' => (int) $account->used_credit - $appliedMajor,
+                        'updated_at' => $now,
+                    ]);
+            }
+
+            return true;
+        });
+
+        if ($applied) {
+            $this->syncAgentUsedCredit($player);
+        }
     }
 
     public function assertMayPlaceBet(Player $player, int $amountMinor): void
@@ -290,8 +325,12 @@ final class PlayerCreditService
         }
     }
 
-    public function releaseBetHold(Player $player, int $amountMinor, int $ticketItemId): void
-    {
+    public function releaseBetHold(
+        Player $player,
+        int $amountMinor,
+        int $ticketItemId,
+        int $settlementVersion = 0,
+    ): void {
         if ($amountMinor <= 0 || ! PlayerFundingMode::usesCredit($player)) {
             return;
         }
@@ -308,6 +347,7 @@ final class PlayerCreditService
                 'reason' => 'bet_hold_release',
                 'ref_type' => 'ticket_item',
                 'ref_id' => $ticketItemId,
+                'settlement_version' => $settlementVersion,
                 'created_at' => $now,
                 'updated_at' => $now,
             ]);
@@ -354,14 +394,33 @@ final class PlayerCreditService
         $this->syncAgentUsedCredit($player);
     }
 
-    public function reverseGameSettlement(Player $player, int $gameWinLossSigned, int $ticketItemId): void
-    {
+    public function reverseGameSettlement(
+        Player $player,
+        int $gameWinLossSigned,
+        int $ticketItemId,
+        int $settlementVersion = 0,
+    ): void {
         if ($gameWinLossSigned === 0 || ! PlayerFundingMode::usesCredit($player)) {
             return;
         }
 
         $now = now();
         $amountMinor = abs($gameWinLossSigned);
+        if ($gameWinLossSigned < 0) {
+            // 中奖释放 used_credit 时可能受 0 下限截断；反转只能恢复当时实际释放的数额。
+            // 旧流水或人工修复数据可能不存在，保留名义值兜底以兼容历史记录。
+            $recordedAmount = DB::table('credit_ledger')
+                ->where('owner_type', 'player')
+                ->where('owner_id', $player->id)
+                ->where('ref_type', 'ticket_item')
+                ->where('ref_id', $ticketItemId)
+                ->where('reason', 'game_settlement_win')
+                ->where('settlement_version', $settlementVersion)
+                ->value('amount');
+            if ($recordedAmount !== null) {
+                $amountMinor = abs((int) $recordedAmount);
+            }
+        }
 
         // 先写 credit_ledger：以 (ref_type, ref_id, reason) partial unique 索引为幂等闸门。
         try {
@@ -372,6 +431,7 @@ final class PlayerCreditService
                 'reason' => 'game_settlement_reversal',
                 'ref_type' => 'ticket_item',
                 'ref_id' => $ticketItemId,
+                'settlement_version' => $settlementVersion,
                 'created_at' => $now,
                 'updated_at' => $now,
             ]);
@@ -410,6 +470,56 @@ final class PlayerCreditService
         $this->syncAgentUsedCredit($player);
     }
 
+    /** 驳回结算后恢复原注占额，使票回到 pending_draw 时额度状态与结算前一致。 */
+    public function restoreBetHoldAfterSettlementReversal(
+        Player $player,
+        int $amountMinor,
+        int $ticketItemId,
+        int $settlementVersion = 0,
+    ): void {
+        if ($amountMinor <= 0 || ! PlayerFundingMode::usesCredit($player)) {
+            return;
+        }
+
+        $now = now();
+        try {
+            DB::table('credit_ledger')->insert([
+                'owner_type' => 'player',
+                'owner_id' => $player->id,
+                'amount' => -$amountMinor,
+                'reason' => 'bet_hold_restore',
+                'ref_type' => 'ticket_item',
+                'ref_id' => $ticketItemId,
+                'settlement_version' => $settlementVersion,
+                'created_at' => $now,
+                'updated_at' => $now,
+            ]);
+        } catch (QueryException $e) {
+            if ($this->isUniqueViolation($e)) {
+                return;
+            }
+            throw $e;
+        }
+
+        $majorDelta = CreditAmountScale::minorToMajor($amountMinor, (string) $player->default_currency);
+        $row = DB::table('player_credit_accounts')
+            ->where('player_id', $player->id)
+            ->lockForUpdate()
+            ->first();
+        if ($row === null) {
+            return;
+        }
+
+        DB::table('player_credit_accounts')
+            ->where('player_id', $player->id)
+            ->update([
+                'used_credit' => (int) $row->used_credit + $majorDelta,
+                'updated_at' => $now,
+            ]);
+
+        $this->syncAgentUsedCredit($player);
+    }
+
     /**
      * @param  int  $cumulativePaidMinor  账单累计已登记收付（minor），支持部分收付多笔递增。
      */

app/Services/Player/PlayerNativeAuthService.php

@@ -11,6 +11,10 @@ use App\Exceptions\PlayerAuthenticationException;
 
 final class PlayerNativeAuthService
 {
+    public function __construct(
+        private readonly NativeJwtSecretGuard $nativeJwtSecretGuard,
+    ) {}
+
     /**
      * @return array{access_token: string, expires_in: int, token_type: string, player: array<string, mixed>}
      */
@@ -85,14 +89,7 @@ final class PlayerNativeAuthService
 
     public function issueToken(Player $player, ?int $ttlSeconds = null): string
     {
-        $secret = (string) config('lottery.player_auth.native.secret', '');
-        if ($secret === '') {
-            throw new PlayerAuthenticationException(
-                '原生登录未配置',
-                ErrorCode::PlayerSsoSecretNotConfigured->value,
-                503,
-            );
-        }
+        $secret = $this->nativeJwtSecretGuard->validatedSecret();
 
         $ttl = $ttlSeconds ?? (int) config('lottery.player_auth.native.ttl_seconds', 28800);
         $now = time();