fix(payment): 修正扫呗签名并自动查询支付结果

backend/internal/integrations/payment/saobei/client.go

@@ -160,7 +160,7 @@ func (c *Client) CreatePayment(ctx context.Context, req CreatePaymentRequest) (*
 		"terminal_trace":  req.ThirdOrderID,
 		"terminal_time":   now.Format("20060102150405"),
 		"total_fee":       strconv.FormatInt(req.AmountCent, 10),
-		"order_body":      sanitizeText(req.Body, 128),
+		"order_body":      sanitizeOrderBody(req.Body),
 		"notify_url":      firstNonEmpty(req.NotifyURL, c.cfg.NotifyURL),
 		"attach":          sanitizeText(req.Attach, 128),
 		"timeout_express": strconv.Itoa(expireSeconds),
@@ -175,8 +175,12 @@ func (c *Client) CreatePayment(ctx context.Context, req CreatePaymentRequest) (*
 	if err != nil {
 		return nil, err
 	}
-	if err := c.verifyResponse(raw); err != nil {
-		return nil, err
+	if err := c.verifyResponseOrChannelError(raw); err != nil {
+		return &CreatePaymentResponse{
+			ErrorMessage: responseMessage(raw),
+			Raw:          raw,
+			RawRequest:   copyMap(params),
+		}, err
 	}
 	return &CreatePaymentResponse{
 		OK:           responseOK(raw),
@@ -219,7 +223,7 @@ func (c *Client) QueryPayment(ctx context.Context, req QueryPaymentRequest) (*Qu
 	if err != nil {
 		return nil, err
 	}
-	if err := c.verifyResponse(raw); err != nil {
+	if err := c.verifyResponseOrChannelError(raw); err != nil {
 		return nil, err
 	}
 	return &QueryPaymentResponse{
@@ -269,7 +273,7 @@ func (c *Client) CreateRefund(ctx context.Context, req CreateRefundRequest) (*Cr
 	if err != nil {
 		return nil, err
 	}
-	if err := c.verifyResponse(raw); err != nil {
+	if err := c.verifyResponseOrChannelError(raw); err != nil {
 		return nil, err
 	}
 	return &CreateRefundResponse{
@@ -313,7 +317,7 @@ func (c *Client) QueryRefund(ctx context.Context, req QueryRefundRequest) (*Quer
 	if err != nil {
 		return nil, err
 	}
-	if err := c.verifyResponse(raw); err != nil {
+	if err := c.verifyResponseOrChannelError(raw); err != nil {
 		return nil, err
 	}
 	return &QueryRefundResponse{
@@ -468,6 +472,18 @@ func (c *Client) verifyResponse(raw map[string]string) error {
 	return nil
 }
 
+func (c *Client) verifyResponseOrChannelError(raw map[string]string) error {
+	if err := c.verifyResponse(raw); err == nil {
+		return nil
+	}
+	// 扫呗的失败响应通常不带 key_sign。失败响应只会阻断支付或触发退款查询，
+	// 可以安全地保留为业务错误；成功响应仍必须严格验签。
+	if responseCode(raw) != "01" {
+		return nil
+	}
+	return ErrVerifyFailed
+}
+
 func responseCode(raw map[string]string) string {
 	return strings.TrimSpace(raw["return_code"])
 }
@@ -573,6 +589,22 @@ func sanitizeText(value string, max int) string {
 	return value
 }
 
+func sanitizeOrderBody(value string) string {
+	value = strings.Join(strings.Fields(value), "-")
+	value = strings.NewReplacer(
+		"+", "-",
+		"/", "-",
+		"?", "",
+		"%", "",
+		"#", "",
+		"&", "",
+		"=", "",
+		"【", "[",
+		"】", "]",
+	).Replace(value)
+	return sanitizeText(value, 128)
+}
+
 func firstNonEmpty(values ...string) string {
 	for _, value := range values {
 		if strings.TrimSpace(value) != "" {

backend/internal/integrations/payment/saobei/client_test.go

@@ -67,7 +67,7 @@ func TestCreatePaymentPostsQRPayAndVerifiesResponse(t *testing.T) {
 	resp, err := client.CreatePayment(context.Background(), CreatePaymentRequest{
 		ThirdOrderID: "PAY1",
 		AmountCent:   100,
-		Body:         "租号订单",
+		Body:         "租号订单 ORD1",
 		Attach:       "ORD1",
 	})
 	if err != nil {
@@ -82,6 +82,33 @@ func TestCreatePaymentPostsQRPayAndVerifiesResponse(t *testing.T) {
 	if captured["repeated_trace"] != "3" || captured["auto_pay"] != "1" {
 		t.Fatalf("qrpay safety fields = %#v", captured)
 	}
+	if captured["order_body"] != "租号订单-ORD1" {
+		t.Fatalf("order_body = %q, want safe characters only", captured["order_body"])
+	}
+}
+
+func TestCreatePaymentTreatsUnsignedFailureAsBusinessError(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`{"return_code":"02","return_msg":"签名未通过校验！","result_code":"02"}`))
+	}))
+	defer server.Close()
+
+	client := NewClient(Config{
+		GatewayURL:  server.URL,
+		MerchantID:  "M1",
+		TerminalID:  "T1",
+		AccessToken: "token-1",
+	})
+	resp, err := client.CreatePayment(context.Background(), CreatePaymentRequest{
+		ThirdOrderID: "PAY1",
+		AmountCent:   100,
+	})
+	if err != nil {
+		t.Fatalf("CreatePayment() error = %v, want nil business error", err)
+	}
+	if resp.OK || resp.ErrorMessage == "" || resp.Raw["return_code"] != "02" {
+		t.Fatalf("CreatePayment() response = %+v", resp)
+	}
 }
 
 func TestQueryPaymentUsesTraceTimeAndMapsSuccess(t *testing.T) {