支付相关

internal/biz/payment_test.go

@@ -2,6 +2,7 @@ package biz
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"io"
 	"log/slog"
@@ -346,3 +347,23 @@ func TestPaymentConfirmationRejectsBrokenDiscountConservation(t *testing.T) {
 		t.Fatal("broken discount conservation was accepted")
 	}
 }
+
+func TestPaymentConfirmationBindsAppleProductID(t *testing.T) {
+	intent := &PaymentIntent{
+		Provider: PaymentApple, TradeNo: "123e4567-e89b-12d3-a456-426614174000",
+		Amount: 100, Currency: "USD", BusinessType: "item", BusinessID: "I1",
+		Extra: json.RawMessage(`{"product_id":"com.example.coin100"}`),
+	}
+	result := &PaymentResult{
+		Provider: PaymentApple, TradeNo: intent.TradeNo, ProviderTradeNo: "APPLE-TX-1",
+		Status: "success", Amount: 100, Currency: "USD",
+		Payload: json.RawMessage(`{"productId":"com.example.coin100"}`),
+	}
+	if err := validatePaymentConfirmation(intent, PaymentApple, intent.TradeNo, result); err != nil {
+		t.Fatalf("matching productId rejected: %v", err)
+	}
+	result.Payload = json.RawMessage(`{"productId":"com.example.coin200"}`)
+	if err := validatePaymentConfirmation(intent, PaymentApple, intent.TradeNo, result); err == nil {
+		t.Fatal("mismatched Apple productId was accepted")
+	}
+}