pay/internal/store/refund.go

package store

import (
	"errors"
	"fmt"
	"time"

	"gorm.io/gorm"
	"gorm.io/gorm/clause"

	"github.com/wangjia/pay/internal/model"
)

var ErrRefundNotFound = errors.New("store: refund not found")

type RefundStore struct{ db *gorm.DB }

func NewRefundStore(db *gorm.DB) *RefundStore { return &RefundStore{db: db} }

// CreateRefund is a plain insert with no over-refund guard — safe only for
// callers that already hold their own serialization (e.g. tests, backfills).
// Money-path callers (退款下单) MUST use CreateRefundGuarded instead: a bare
// RefundSum(...)-then-CreateRefund round trip races under concurrent refund
// requests (both read reserved=0, both pass, both insert → over-refund).
func (s *RefundStore) CreateRefund(r *model.Refund) error {
	if r.RefundID == "" {
		return fmt.Errorf("store.CreateRefund: empty RefundID")
	}
	if err := s.db.Create(r).Error; err != nil {
		return fmt.Errorf("store.CreateRefund: %w", err)
	}
	return nil
}

// CreateRefundGuarded 在单事务内完成 锁定订单行 → 求和(非failed)→ 超退校验 → 插入。
// 返回 (false, nil) 表示超退拒绝;并发同单退款经订单行锁串行化。
//
// 订单行锁 clause.Locking{Strength: "UPDATE"} 在 MySQL 上是真正的 SELECT ... FOR
// UPDATE 行锁;SQLite 不支持行级锁,glebarez/sqlite 的 "FOR" ClauseBuilder 会把它
// 静默丢弃(不报错、也不生效)。SQLite 侧真正的串行化来自 DSN 的
// _txlock=immediate(见 internal/model/testdb.go / main.go initDB):BEGIN IMMEDIATE
// 让事务一开始就抢库级写锁,第二个并发事务的 BEGIN 会阻塞到第一个提交/回滚为止,
// 效果等价于「锁行」。没有 _txlock=immediate 时 SQLite 默认 BEGIN DEFERRED,写锁
// 推迟到第一次写语句才抢,两个事务的读阶段(求和)仍可能交错,防不住超退。
func (s *RefundStore) CreateRefundGuarded(r *model.Refund, paidAmountMinor int64) (bool, error) {
	if r.RefundID == "" {
		return false, fmt.Errorf("store.CreateRefundGuarded: empty RefundID")
	}
	if r.OutTradeNo == "" {
		return false, fmt.Errorf("store.CreateRefundGuarded: empty OutTradeNo")
	}
	var ok bool
	err := s.db.Transaction(func(tx *gorm.DB) error {
		var o model.OrderV2
		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).
			Where("out_trade_no = ?", r.OutTradeNo).First(&o).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				return ErrOrderNotFound
			}
			return fmt.Errorf("lock order: %w", err)
		}

		var reserved int64
		q := tx.Model(&model.Refund{}).
			Where("out_trade_no = ? AND status <> ?", r.OutTradeNo, model.RefundFailed)
		if err := q.Select("COALESCE(SUM(amount_minor),0)").Scan(&reserved).Error; err != nil {
			return fmt.Errorf("sum refunds: %w", err)
		}

		if reserved+r.AmountMinor > paidAmountMinor {
			ok = false
			return nil
		}

		if err := tx.Create(r).Error; err != nil {
			return err
		}
		ok = true
		return nil
	})
	if err != nil {
		return false, fmt.Errorf("store.CreateRefundGuarded: %w", err)
	}
	return ok, nil
}

func (s *RefundStore) GetRefund(refundID string) (*model.Refund, error) {
	var r model.Refund
	if err := s.db.Where("refund_id = ?", refundID).First(&r).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return nil, ErrRefundNotFound
		}
		return nil, fmt.Errorf("store.GetRefund: %w", err)
	}
	return &r, nil
}

// RefundSum sums amount_minor of an order's refunds in the given statuses
// (no statuses = all). 用两种口径:守卫查非失败之和(占额度),态机查 succeeded 之和。
func (s *RefundStore) RefundSum(outTradeNo string, statuses ...model.RefundStatus) (int64, error) {
	var total int64
	q := s.db.Model(&model.Refund{}).Where("out_trade_no = ?", outTradeNo)
	if len(statuses) > 0 {
		q = q.Where("status IN ?", statuses)
	}
	if err := q.Select("COALESCE(SUM(amount_minor),0)").Scan(&total).Error; err != nil {
		return 0, fmt.Errorf("store.RefundSum: %w", err)
	}
	return total, nil
}

// MarkRefundStatus flips a refund from an expected status to a new one
// (conditional UPDATE + RowsAffected). Returns false if not in the from-status.
func (s *RefundStore) MarkRefundStatus(refundID string, from, to model.RefundStatus, providerRefundRef string, at time.Time) (bool, error) {
	updates := map[string]any{"status": to}
	if providerRefundRef != "" {
		updates["provider_refund_ref"] = providerRefundRef
	}
	if to == model.RefundSucceeded || to == model.RefundFailed {
		updates["completed_at"] = at
	}
	res := s.db.Model(&model.Refund{}).
		Where("refund_id = ? AND status = ?", refundID, from).
		Updates(updates)
	if res.Error != nil {
		return false, fmt.Errorf("store.MarkRefundStatus: %w", res.Error)
	}
	return res.RowsAffected > 0, nil
}

// ListDistinctOutTradeNosByStatus 列有某状态退款的 distinct out_trade_no,供退款修复
// 扫描(RefundApplyTask)定位「有 succeeded 退款」的候选订单——self-heal「退款成功但
// 订单卡 paid」的崩溃窗口(P4 T3 review 义务,见 task-5-brief 外的两条追加义务)。
func (s *RefundStore) ListDistinctOutTradeNosByStatus(status model.RefundStatus, limit int) ([]string, error) {
	if limit <= 0 || limit > 500 {
		limit = 200
	}
	var out []string
	if err := s.db.Model(&model.Refund{}).Where("status = ?", status).
		Group("out_trade_no").Order("out_trade_no ASC").Limit(limit).
		Pluck("out_trade_no", &out).Error; err != nil {
		return nil, fmt.Errorf("store.ListDistinctOutTradeNosByStatus: %w", err)
	}
	return out, nil
}

// ListDistinctOutTradeNosByStatusSince 同 ListDistinctOutTradeNosByStatus,但加
// completed_at>=since 回溯窗——防「LIMIT 尾部饥饿」:succeeded 退款历史只增不减,
// 若不设窗口,按 out_trade_no ASC 取前 limit 条,超过 limit 后最新出现的"退款已成但
// 订单卡 paid"崩溃窗口(本扫描要自愈的目标)会被排在候选之外、永远扫不到。completed_at
// 是 MarkRefundStatus 翻成 succeeded/failed 时打的时间戳(即"进入该终态"的时刻),succeeded
// 是终态、之后不会再被改动,用它做窗口锚点比 updated_at 更精确。调用方(RefundApplyTask)
// 用 now-lookback 算 since,lookback 只覆盖近期崩溃窗口——历史一致性由已收敛状态保证,
// 不需要扫全表。
func (s *RefundStore) ListDistinctOutTradeNosByStatusSince(status model.RefundStatus, since time.Time, limit int) ([]string, error) {
	if limit <= 0 || limit > 500 {
		limit = 200
	}
	var out []string
	if err := s.db.Model(&model.Refund{}).Where("status = ? AND completed_at >= ?", status, since).
		Group("out_trade_no").Order("out_trade_no ASC").Limit(limit).
		Pluck("out_trade_no", &out).Error; err != nil {
		return nil, fmt.Errorf("store.ListDistinctOutTradeNosByStatusSince: %w", err)
	}
	return out, nil
}

// ListStuckRefunds 列 status 落在给定集合、且 updated_at 早于 before 的退款行,供
// 「卡滞 processing/manual_pending 退款告警」只读观测扫描用(不改状态)。updated_at
// 用作「进入当前状态」的近似时刻——本表除 MarkRefundStatus/CreateRefundGuarded 外
// 不写,近似成立。
func (s *RefundStore) ListStuckRefunds(statuses []model.RefundStatus, before time.Time, limit int) ([]model.Refund, error) {
	if limit <= 0 || limit > 500 {
		limit = 200
	}
	var out []model.Refund
	if err := s.db.Where("status IN ? AND updated_at < ?", statuses, before).
		Order("updated_at ASC").Limit(limit).Find(&out).Error; err != nil {
		return nil, fmt.Errorf("store.ListStuckRefunds: %w", err)
	}
	return out, nil
}

// ListManualPending lists refunds awaiting manual (crypto) settlement.
func (s *RefundStore) ListManualPending(limit int) ([]model.Refund, error) {
	if limit <= 0 || limit > 200 {
		limit = 50
	}
	var out []model.Refund
	if err := s.db.Where("status = ?", model.RefundManualPending).
		Order("id ASC").Limit(limit).Find(&out).Error; err != nil {
		return nil, fmt.Errorf("store.ListManualPending: %w", err)
	}
	return out, nil
}