feat(admin): 统一后台 API 资源鉴权并完善投注风控快照与回补

tests/Feature/TicketBettingApiTest.php

@@ -9,11 +9,13 @@ use App\Models\TicketItem;
 use App\Lottery\DrawStatus;
 use App\Models\OddsVersion;
 use App\Models\TicketOrder;
+use App\Models\JackpotPool;
 use App\Models\PlayerWallet;
 use App\Models\TicketCombination;
 use App\Models\PlayConfigItem;
 use App\Models\PlayConfigVersion;
 use App\Lottery\ConfigVersionStatus;
+use Illuminate\Support\Facades\DB;
 use Database\Seeders\CurrencySeeder;
 use Database\Seeders\PlayTypeSeeder;
 use Database\Seeders\LotterySettingsSeeder;
@@ -226,6 +228,59 @@ test('ticket place deducts wallet and persists order items combinations and logs
     expect((int) $wallet->balance)->toBe(200_000 - 12_400);
 });
 
+test('ticket place is idempotent by player draw and client trace id', function (): void {
+    $player = ticketPlayerWithWallet();
+    ticketOpenDraw();
+
+    $payload = array_merge(ticketPreviewPayload(), ['client_trace_id' => 'same-submit-once']);
+
+    $first = $this->withHeader('Authorization', 'Bearer dev:'.$player->id)
+        ->postJson('/api/v1/ticket/place', $payload)
+        ->assertOk()
+        ->assertJsonPath('code', ErrorCode::Success->value)
+        ->json('data');
+
+    $second = $this->withHeader('Authorization', 'Bearer dev:'.$player->id)
+        ->postJson('/api/v1/ticket/place', $payload)
+        ->assertOk()
+        ->assertJsonPath('code', ErrorCode::Success->value)
+        ->json('data');
+
+    expect($second['order_no'])->toBe($first['order_no'])
+        ->and(TicketOrder::query()->count())->toBe(1)
+        ->and(TicketItem::query()->count())->toBe(2)
+        ->and(WalletTxn::query()->where('biz_type', 'bet_deduct')->count())->toBe(1);
+
+    $wallet = PlayerWallet::query()->where('player_id', $player->id)->firstOrFail();
+    expect((int) $wallet->balance)->toBe(200_000 - 12_400);
+});
+
+test('box family estimated max payout is the sum of every expanded combination payout', function (): void {
+    $player = ticketPlayerWithWallet(500_000);
+    ticketOpenDraw();
+
+    $response = $this->withHeader('Authorization', 'Bearer dev:'.$player->id)
+        ->postJson('/api/v1/ticket/place', [
+            'draw_id' => '20260511-001',
+            'currency_code' => 'NPR',
+            'client_trace_id' => 'combo-payout-sum',
+            'lines' => [
+                ['number' => '1122', 'play_code' => 'ibox', 'amount' => 100],
+            ],
+        ])
+        ->assertOk()
+        ->json('data');
+
+    $item = TicketItem::query()->firstOrFail();
+    $combinationSum = TicketCombination::query()
+        ->where('ticket_item_id', $item->id)
+        ->sum('estimated_payout');
+
+    expect((int) $response['summary']['total_estimated_payout'])->toBe((int) $combinationSum)
+        ->and((int) $item->estimated_max_payout)->toBe((int) $combinationSum)
+        ->and((int) $item->risk_locked_amount)->toBe((int) $combinationSum);
+});
+
 test('ticket place rejects closed draw', function (): void {
     $player = ticketPlayerWithWallet();
     $draw = ticketOpenDraw();
@@ -285,6 +340,10 @@ test('ticket place succeeds when expected_config_versions matches preview', func
         ->assertJsonPath('code', ErrorCode::Success->value);
 
     expect(TicketOrder::query()->count())->toBe(1);
+    $order = TicketOrder::query()->firstOrFail();
+    expect((int) $order->play_config_version_no)->toBe((int) $versions['play_config_version_no'])
+        ->and((int) $order->odds_version_no)->toBe((int) $versions['odds_version_no'])
+        ->and((int) $order->risk_cap_version_no)->toBe((int) $versions['risk_cap_version_no']);
 });
 
 test('ticket place rejects stale expected_config_versions', function (): void {
@@ -769,3 +828,40 @@ test('ticket pending confirmation reconcile confirms order when wallet deduction
         ->and($item->fresh()->status)->toBe('success')
         ->and((int) RiskPool::query()->where('draw_id', $draw->id)->where('normalized_number', '1234')->value('locked_amount'))->toBe(3000);
 });
+
+test('ticket place reverses wallet and releases risk when post deduction confirmation fails', function (): void {
+    $player = ticketPlayerWithWallet(20_000);
+    $draw = ticketOpenDraw();
+
+    JackpotPool::query()->create([
+        'currency_code' => 'NPR',
+        'current_amount' => 0,
+        'contribution_rate' => 1,
+        'trigger_threshold' => 0,
+        'payout_rate' => 0,
+        'force_trigger_draw_gap' => 0,
+        'min_bet_amount' => 0,
+        'status' => 1,
+    ]);
+    DB::statement("CREATE TRIGGER fail_jackpot_contribution_insert BEFORE INSERT ON jackpot_contributions BEGIN SELECT RAISE(ABORT, 'forced_confirmation_failure'); END");
+
+    $this->withHeader('Authorization', 'Bearer dev:'.$player->id)
+        ->postJson('/api/v1/ticket/place', [
+            'draw_id' => '20260511-001',
+            'currency_code' => 'NPR',
+            'client_trace_id' => 'wallet-reverse-on-confirm-fail',
+            'lines' => [
+                ['number' => '1234', 'play_code' => 'big', 'amount' => 120],
+            ],
+        ])
+        ->assertStatus(500);
+
+    $wallet = PlayerWallet::query()->where('player_id', $player->id)->firstOrFail();
+    $order = TicketOrder::query()->where('client_trace_id', 'wallet-reverse-on-confirm-fail')->firstOrFail();
+
+    expect((int) $wallet->balance)->toBe(20_000)
+        ->and($order->status)->toBe('refunded')
+        ->and(WalletTxn::query()->where('biz_no', $order->order_no)->where('biz_type', 'bet_deduct')->count())->toBe(1)
+        ->and(WalletTxn::query()->where('biz_no', $order->order_no)->where('biz_type', 'bet_reverse')->count())->toBe(1)
+        ->and((int) RiskPool::query()->where('draw_id', $draw->id)->where('normalized_number', '1234')->value('locked_amount'))->toBe(0);
+});