优化发货接口对接流程

backend/internal/middleware/open_auth_test.go

@@ -104,10 +104,12 @@ func TestOpenAuthRejectsSignatureMismatch(t *testing.T) {
 
 func TestSourceOpenAuthKeepsLegacyUpstreamSignature(t *testing.T) {
 	gin.SetMode(gin.TestMode)
+	db := testdb.New(t)
 	appKey := "source-key"
 	secret := "source-secret"
 	r := gin.New()
 	r.Use(SourceOpenAuth(SourceOpenAuthConfig{
+		DB:          db,
 		APIKey:      appKey,
 		APISecret:   secret,
 		SkewSeconds: 300,
@@ -130,14 +132,24 @@ func TestSourceOpenAuthKeepsLegacyUpstreamSignature(t *testing.T) {
 	if w.Code != http.StatusOK {
 		t.Fatalf("legacy signed request should pass, code=%d body=%s", w.Code, w.Body.String())
 	}
+
+	replay := httptest.NewRequest(http.MethodPost, path, strings.NewReader(body))
+	replay.Header = req.Header.Clone()
+	w = httptest.NewRecorder()
+	r.ServeHTTP(w, replay)
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("legacy replay should be rejected, code=%d body=%s", w.Code, w.Body.String())
+	}
 }
 
 func TestSourceOpenAuthAcceptsUppercaseLegacySignature(t *testing.T) {
 	gin.SetMode(gin.TestMode)
+	db := testdb.New(t)
 	appKey := "source-key"
 	secret := "source-secret"
 	r := gin.New()
 	r.Use(SourceOpenAuth(SourceOpenAuthConfig{
+		DB:          db,
 		APIKey:      appKey,
 		APISecret:   secret,
 		SkewSeconds: 300,