优化领取页绑定 UID 校验

apps/backend/src/services/claim/kuaishou-cloud-claim-service.ts

@@ -404,35 +404,86 @@ export async function submitAffiliateDashClaim(
     })
   }
 
-  const gameAccount = String(payload.gameAccount || flow.gameAccount || '').trim()
-  const bindUuid = String(payload.bindUuid || flow.bindUuid || '').trim()
-  if (!gameAccount || !bindUuid) {
+  const expectedGameAccount = String(
+    getClaimIdentityFromTask(task).expectedUid || flow.expectedGameAccount || flow.gameAccount || '',
+  ).trim()
+  const requestedGameAccount = String(payload.gameAccount || '').trim()
+  const requestedBindUuid = String(payload.bindUuid || '').trim()
+  const bindUuid = String(flow.bindUuid || '').trim()
+  if (!expectedGameAccount || !bindUuid) {
     throw createHttpError('缺少绑定账号或 bindUuid', {
       statusCode: 400,
       errorCode: 'affiliate_dash_submit_missing',
     })
   }
+  if (requestedGameAccount && normalizeUid(requestedGameAccount) !== normalizeUid(expectedGameAccount)) {
+    throw createHttpError('提交 UID 与第一步填写 UID 不一致，请先更新 UID 后重新绑定', {
+      statusCode: 409,
+      errorCode: 'affiliate_dash_submit_uid_changed',
+    })
+  }
+  if (requestedBindUuid && requestedBindUuid !== bindUuid) {
+    throw createHttpError('绑定二维码已更新，请刷新页面后重试', {
+      statusCode: 409,
+      errorCode: 'affiliate_dash_bind_uuid_stale',
+    })
+  }
 
   const now = nowIso()
   const isMock = Boolean(flow.mock?.enabled)
+  const gameAccount = expectedGameAccount
+  let latestFlow = flow
 
   // 强制校验：绑定返回的游戏账号与第一步填写 UID 不一致时禁止提交（防止 uid 输错），
-  // 不依赖平台 mismatch 字段。拉取绑定结果失败时不阻塞（平台提交时仍会校验）。
+  // 不依赖请求体 UID，也不依赖平台 mismatch 字段，避免错绑后被前端或手动请求绕过。
   if (!isMock && flow.bindUuid) {
-    let mismatch = false
     try {
       const bindResult = await getAffiliateDashBindResult({
         orderNo: flow.orderNo,
         bindUuid,
       })
       const boundAccount = bindResult.gameAccount
-      mismatch =
+      const bindMismatch =
         Boolean(bindResult.mismatch) ||
-        Boolean(boundAccount && normalizeUid(boundAccount) !== normalizeUid(gameAccount))
+        Boolean(boundAccount && normalizeUid(boundAccount) !== normalizeUid(expectedGameAccount))
+      latestFlow = {
+        ...flow,
+        bound: bindResult.bound,
+        boundAccount: boundAccount || flow.boundAccount,
+        gameChannel: bindResult.gameChannel || flow.gameChannel,
+        bindMismatch,
+      }
+      await updateTask(task.id, {
+        context_json: JSON.stringify({
+          ...taskContext,
+          affiliateDash: latestFlow,
+        }),
+        updated_at: now,
+      })
     } catch {
-      // 拉取失败：保持放行
+      // 拉取失败：只能使用本地最近一次详情刷新结果，不能无校验放行。
     }
-    if (mismatch) {
+    const latestBoundAccount = latestFlow.boundAccount
+    const latestMismatch =
+      Boolean(latestFlow.bindMismatch) ||
+      Boolean(
+        latestFlow.bound &&
+        latestBoundAccount &&
+        normalizeUid(latestBoundAccount) !== normalizeUid(expectedGameAccount),
+      )
+    if (!latestFlow.bound) {
+      throw createHttpError('绑定尚未完成，请先扫码绑定账号', {
+        statusCode: 409,
+        errorCode: 'affiliate_dash_bind_pending',
+      })
+    }
+    if (!latestBoundAccount) {
+      throw createHttpError('暂时无法确认绑定 UID，请稍后自动刷新后再提交', {
+        statusCode: 409,
+        errorCode: 'affiliate_dash_bound_account_missing',
+      })
+    }
+    if (latestMismatch) {
       throw createHttpError('绑定账号与填写 UID 不一致，请确认后重新绑定', {
         statusCode: 409,
         errorCode: 'affiliate_dash_bind_mismatch',
@@ -453,7 +504,7 @@ export async function submitAffiliateDashClaim(
       })
 
   const nextFlow = {
-    ...flow,
+    ...latestFlow,
     gameAccount,
     bindUuid,
     submitStatus: result.status,
@@ -519,6 +570,7 @@ async function bindAffiliateDashClaimForTask(task: TaskRow, gameAccount: string)
     // 重新绑定：清空旧绑定状态，等待用户用新账号扫码完成新绑定
     bound: false,
     boundAccount: '',
+    gameChannel: '',
     bindMismatch: false,
   }