优化结构

internal/data/migrations_test.go

@@ -25,7 +25,7 @@ func TestMigrateAllRunsModuleSchemasWithoutBootstrapSeed(t *testing.T) {
 	if err = migrateAll(db, testCatalog()); err != nil {
 		t.Fatalf("second migration run: %v", err)
 	}
-	for _, table := range []string{"sys_integration_configs", "sys_users", "sys_base_menus", "pay_orders"} {
+	for _, table := range []string{"sys_integration_configs", "sys_users", "sys_base_menus", "pay_orders", "pay_events"} {
 		if !db.Migrator().HasTable(table) {
 			t.Fatalf("migration did not create %s", table)
 		}
@@ -34,8 +34,8 @@ func TestMigrateAllRunsModuleSchemasWithoutBootstrapSeed(t *testing.T) {
 	if err = db.Table(migration.TableName).Count(&versions).Error; err != nil {
 		t.Fatal(err)
 	}
-	if versions != 8 {
-		t.Fatalf("migration versions = %d, want 8", versions)
+	if versions != 11 {
+		t.Fatalf("migration versions = %d, want 11", versions)
 	}
 	var communicationRows []dataintegration.ConfigPO
 	if err = db.Where("kind IN ?", []string{"mq", "websocket"}).Order("kind, provider").Find(&communicationRows).Error; err != nil {

internal/data/payment/demo_seed.go

@@ -0,0 +1,147 @@
+package payment
+
+import (
+	"fmt"
+	bizpayment "kra/internal/biz/payment"
+	"time"
+
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+const DemoTradePrefix = "DEMO-PAY-"
+
+type DemoSeedResult struct {
+	Orders int
+	Events int
+}
+
+// SeedDemoOrders replaces only DEMO-PAY-* records with a representative set
+// of payment operations for administration-page review.
+func SeedDemoOrders(db *gorm.DB, now time.Time) (*DemoSeedResult, error) {
+	if db == nil {
+		return nil, fmt.Errorf("demo payment database is nil")
+	}
+	if !db.Migrator().HasTable(&paymentOrderPO{}) || !db.Migrator().HasTable(&paymentEventPO{}) {
+		return nil, fmt.Errorf("payment tables are not migrated")
+	}
+	now = now.UTC().Truncate(time.Second)
+	if now.IsZero() {
+		now = time.Now().UTC().Truncate(time.Second)
+	}
+
+	type demoOrder struct {
+		order  paymentOrderPO
+		events []paymentEventPO
+	}
+	makeOrder := func(index int, provider, subject, status, fulfillment, refund string, amount int64, currency string, created time.Time) paymentOrderPO {
+		tradeNo := fmt.Sprintf("%s%02d", DemoTradePrefix, index)
+		return paymentOrderPO{
+			TradeNo: tradeNo, Provider: provider, BusinessType: "demo_subscription", BusinessID: fmt.Sprintf("DEMO-LICENSE-%02d", index),
+			Subject: subject, PaymentMode: bizpayment.PaymentModeExternal, OriginalAmount: amount, Amount: amount,
+			Currency: currency, PaymentStatus: status, FulfillmentStatus: fulfillment, RefundStatus: refund,
+			ConfirmationID: uuid.NewString(), RequestFingerprint: fmt.Sprintf("demo-fingerprint-%02d", index),
+			CreatePayload: "{}", Extra: "{}", Version: 1, CreatedAt: created, UpdatedAt: created,
+		}
+	}
+	makeEvent := func(order paymentOrderPO, eventType, source, status, providerStatus, message string, amount int64, at time.Time) paymentEventPO {
+		event := paymentEventPO{
+			Provider: order.Provider, TradeNo: order.TradeNo, Type: eventType, Source: source, Status: status,
+			ProviderStatus: providerStatus, Message: message, Amount: amount, Currency: order.Currency, CreatedAt: at,
+		}
+		if source == "client" {
+			event.ClientIP, event.UserAgent, event.DeviceID = "111.29.161.79", "Kra-Demo/1.2 Android/16", fmt.Sprintf("DEMO-DEVICE-%s", order.TradeNo)
+		}
+		if source == "admin" {
+			event.OperatorID, event.OperatorName = 1, "demo-admin"
+		}
+		return event
+	}
+	providerDate := now.Format("20060102")
+
+	created1, paid1, fulfilled1 := now.Add(-35*time.Minute), now.Add(-34*time.Minute), now.Add(-33*time.Minute)
+	paid := makeOrder(1, bizpayment.PaymentAlipay, "专业版 7 天授权", bizpayment.PaymentStatusPaid, bizpayment.FulfillmentStatusSucceeded, bizpayment.RefundStatusNone, 940, "CNY", created1)
+	providerTrade1 := fmt.Sprintf("DEMO-ALIPAY-%s%04d", providerDate, 1)
+	paid.ProviderTradeNo = &providerTrade1
+	paid.ProviderStatus, paid.PaidAmount, paid.PayerPaidAmount, paid.CashPaidAmount, paid.SettlementAmount = "TRADE_SUCCESS", 940, 940, 940, 934
+	paid.AmountBreakdownKnown, paid.PaidAt, paid.FulfilledAt, paid.UpdatedAt = true, &paid1, &fulfilled1, fulfilled1
+
+	pendingCreated := now.Add(-28 * time.Minute)
+	pending := makeOrder(2, bizpayment.PaymentWechatV3, "专业版 30 天授权", bizpayment.PaymentStatusPending, bizpayment.FulfillmentStatusPending, bizpayment.RefundStatusNone, 2990, "CNY", pendingCreated)
+	pending.ProviderStatus = "NOTPAY"
+	pending.UpdatedAt = now.Add(-27 * time.Minute)
+
+	failedCreated := now.Add(-24 * time.Minute)
+	failed := makeOrder(3, bizpayment.PaymentPayPal, "海外数字商品", bizpayment.PaymentStatusFailed, bizpayment.FulfillmentStatusPending, bizpayment.RefundStatusNone, 1299, "USD", failedCreated)
+	failed.ProviderStatus, failed.LastError = "DECLINED", "付款方式被渠道拒绝"
+	failed.UpdatedAt = now.Add(-23 * time.Minute)
+
+	fulfillCreated, fulfillPaid := now.Add(-20*time.Minute), now.Add(-19*time.Minute)
+	fulfillFailed := makeOrder(4, bizpayment.PaymentAlipayV3, "企业版 90 天授权", bizpayment.PaymentStatusPaid, bizpayment.FulfillmentStatusFailed, bizpayment.RefundStatusNone, 8990, "CNY", fulfillCreated)
+	providerTrade4 := fmt.Sprintf("DEMO-ALIPAY-%s%04d", providerDate, 4)
+	fulfillFailed.ProviderTradeNo, fulfillFailed.ProviderStatus = &providerTrade4, "TRADE_SUCCESS"
+	fulfillFailed.PaidAmount, fulfillFailed.SettlementAmount, fulfillFailed.PaidAt = 8990, 8936, &fulfillPaid
+	fulfillFailed.LastError, fulfillFailed.UpdatedAt = "业务授权服务暂时不可用，可人工重试发货", now.Add(-18*time.Minute)
+
+	partialCreated, partialPaid, partialRefunded := now.Add(-16*time.Minute), now.Add(-15*time.Minute), now.Add(-12*time.Minute)
+	partial := makeOrder(5, bizpayment.PaymentWechatV3, "团队版 30 天授权", bizpayment.PaymentStatusPartiallyRefunded, bizpayment.FulfillmentStatusSucceeded, bizpayment.RefundStatusPartial, 5000, "CNY", partialCreated)
+	providerTrade5 := fmt.Sprintf("DEMO-WECHAT-%s%04d", providerDate, 5)
+	partial.ProviderTradeNo, partial.ProviderStatus = &providerTrade5, "SUCCESS"
+	partial.PaidAmount, partial.SettlementAmount, partial.RefundedAmount = 5000, 4970, 1200
+	partial.PaidAt, partial.FulfilledAt, partial.RefundedAt, partial.UpdatedAt = &partialPaid, &partialPaid, &partialRefunded, partialRefunded
+
+	refundCreated, refundPaid := now.Add(-11*time.Minute), now.Add(-10*time.Minute)
+	refundPending := makeOrder(6, bizpayment.PaymentAlipay, "增值服务包", bizpayment.PaymentStatusPaid, bizpayment.FulfillmentStatusSucceeded, bizpayment.RefundStatusPending, 1880, "CNY", refundCreated)
+	providerTrade6 := fmt.Sprintf("DEMO-ALIPAY-%s%04d", providerDate, 6)
+	refundPending.ProviderTradeNo, refundPending.ProviderStatus = &providerTrade6, "TRADE_SUCCESS"
+	refundPending.PaidAmount, refundPending.SettlementAmount, refundPending.RefundRequestedAmount = 1880, 1869, 600
+	refundPending.RefundNo, refundPending.PaidAt, refundPending.FulfilledAt, refundPending.UpdatedAt = "DEMO-REFUND-06", &refundPaid, &refundPaid, now.Add(-8*time.Minute)
+
+	refundedCreated, refundedPaid, refundedAt := now.Add(-9*time.Minute), now.Add(-8*time.Minute), now.Add(-5*time.Minute)
+	refunded := makeOrder(7, bizpayment.PaymentWechatV3, "体验卡 7 天", bizpayment.PaymentStatusRefunded, bizpayment.FulfillmentStatusSucceeded, bizpayment.RefundStatusSucceeded, 500, "CNY", refundedCreated)
+	providerTrade7 := fmt.Sprintf("DEMO-WECHAT-%s%04d", providerDate, 7)
+	refunded.ProviderTradeNo, refunded.ProviderStatus = &providerTrade7, "REFUND_SUCCESS"
+	refunded.PaidAmount, refunded.SettlementAmount, refunded.RefundedAmount = 500, 497, 500
+	refunded.PaidAt, refunded.FulfilledAt, refunded.RefundedAt, refunded.UpdatedAt = &refundedPaid, &refundedPaid, &refundedAt, refundedAt
+
+	internalCreated, internalPaid := now.Add(-4*time.Minute), now.Add(-3*time.Minute)
+	internal := makeOrder(8, bizpayment.PaymentInternal, "积分兑换月卡", bizpayment.PaymentStatusPaid, bizpayment.FulfillmentStatusSucceeded, bizpayment.RefundStatusNone, 1200, "POINT", internalCreated)
+	internal.PaymentMode, internal.ProviderStatus = bizpayment.PaymentModeInternal, "AUTHORIZED"
+	internal.PaidAmount, internal.PointPaidAmount, internal.SettlementAmount, internal.AmountBreakdownKnown = 1200, 1200, 1200, true
+	internal.PaidAt, internal.FulfilledAt, internal.UpdatedAt = &internalPaid, &internalPaid, internalPaid
+
+	demos := []demoOrder{
+		{paid, []paymentEventPO{makeEvent(paid, bizpayment.PaymentEventOrderCreated, "client", bizpayment.PaymentStatusInitialized, "", "客户端创建订单", paid.Amount, created1), makeEvent(paid, bizpayment.PaymentEventPaymentCallback, bizpayment.PaymentAlipay, bizpayment.PaymentStatusPaid, paid.ProviderStatus, "支付宝异步通知验签并主动查单成功", paid.PaidAmount, paid1), makeEvent(paid, bizpayment.PaymentEventFulfillmentFinished, "system", bizpayment.FulfillmentStatusSucceeded, "", "授权自动激活成功，有效期 7 天", 0, fulfilled1)}},
+		{pending, []paymentEventPO{makeEvent(pending, bizpayment.PaymentEventOrderCreated, "client", bizpayment.PaymentStatusInitialized, "", "客户端创建订单", pending.Amount, pendingCreated), makeEvent(pending, bizpayment.PaymentEventProviderCreated, bizpayment.PaymentWechatV3, bizpayment.PaymentStatusPending, pending.ProviderStatus, "预支付订单已创建，等待买家付款", pending.Amount, pending.UpdatedAt)}},
+		{failed, []paymentEventPO{makeEvent(failed, bizpayment.PaymentEventOrderCreated, "client", bizpayment.PaymentStatusInitialized, "", "客户端创建订单", failed.Amount, failedCreated), makeEvent(failed, bizpayment.PaymentEventPaymentSynchronized, "admin", bizpayment.PaymentStatusFailed, failed.ProviderStatus, failed.LastError, 0, failed.UpdatedAt)}},
+		{fulfillFailed, []paymentEventPO{makeEvent(fulfillFailed, bizpayment.PaymentEventPaymentCallback, bizpayment.PaymentAlipayV3, bizpayment.PaymentStatusPaid, fulfillFailed.ProviderStatus, "支付成功", fulfillFailed.PaidAmount, fulfillPaid), makeEvent(fulfillFailed, bizpayment.PaymentEventFulfillmentFinished, "system", bizpayment.FulfillmentStatusFailed, "", fulfillFailed.LastError, 0, fulfillFailed.UpdatedAt)}},
+		{partial, []paymentEventPO{makeEvent(partial, bizpayment.PaymentEventPaymentCallback, bizpayment.PaymentWechatV3, bizpayment.PaymentStatusPaid, partial.ProviderStatus, "支付成功并完成发货", partial.PaidAmount, partialPaid), makeEvent(partial, bizpayment.PaymentEventRefundConfirmed, bizpayment.PaymentWechatV3, bizpayment.RefundStatusPartial, "SUCCESS", "售后部分退款 12.00 CNY", partial.RefundedAmount, partialRefunded)}},
+		{refundPending, []paymentEventPO{makeEvent(refundPending, bizpayment.PaymentEventPaymentCallback, bizpayment.PaymentAlipay, bizpayment.PaymentStatusPaid, refundPending.ProviderStatus, "支付成功并完成发货", refundPending.PaidAmount, refundPaid), makeEvent(refundPending, bizpayment.PaymentEventRefundSubmitted, "admin", bizpayment.RefundStatusPending, "", "客户重复购买，退款已提交渠道", refundPending.RefundRequestedAmount, refundPending.UpdatedAt)}},
+		{refunded, []paymentEventPO{makeEvent(refunded, bizpayment.PaymentEventPaymentCallback, bizpayment.PaymentWechatV3, bizpayment.PaymentStatusPaid, "SUCCESS", "支付成功并完成发货", refunded.PaidAmount, refundedPaid), makeEvent(refunded, bizpayment.PaymentEventRefundConfirmed, bizpayment.PaymentWechatV3, bizpayment.RefundStatusSucceeded, refunded.ProviderStatus, "原路全额退款成功", refunded.RefundedAmount, refundedAt)}},
+		{internal, []paymentEventPO{makeEvent(internal, bizpayment.PaymentEventOrderCreated, "client", bizpayment.PaymentStatusInitialized, "", "创建积分支付订单", internal.Amount, internalCreated), makeEvent(internal, bizpayment.PaymentEventPaymentSynchronized, bizpayment.PaymentInternal, bizpayment.PaymentStatusPaid, internal.ProviderStatus, "积分扣减与授权发放成功", internal.PaidAmount, internalPaid)}},
+	}
+
+	result := &DemoSeedResult{}
+	err := db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("trade_no LIKE ?", DemoTradePrefix+"%").Delete(&paymentEventPO{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Where("trade_no LIKE ?", DemoTradePrefix+"%").Delete(&paymentOrderPO{}).Error; err != nil {
+			return err
+		}
+		for i := range demos {
+			if err := tx.Create(&demos[i].order).Error; err != nil {
+				return err
+			}
+			result.Orders++
+			if len(demos[i].events) > 0 {
+				if err := tx.Create(&demos[i].events).Error; err != nil {
+					return err
+				}
+				result.Events += len(demos[i].events)
+			}
+		}
+		return nil
+	})
+	return result, err
+}

internal/data/payment/demo_seed_test.go

@@ -0,0 +1,59 @@
+package payment
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestSeedDemoOrdersIsRepeatableAndCoversOperationalStates(t *testing.T) {
+	repo := newPaymentOrderRepoForTest(t)
+	db := repo.data.DB()
+	now := time.Date(2026, 8, 29, 2, 0, 0, 0, time.UTC)
+	for attempt := 0; attempt < 2; attempt++ {
+		result, err := SeedDemoOrders(db, now)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if result.Orders != 8 || result.Events < 16 {
+			t.Fatalf("seed result = %#v", result)
+		}
+	}
+	var orders int64
+	if err := db.Model(&paymentOrderPO{}).Where("trade_no LIKE ?", DemoTradePrefix+"%").Count(&orders).Error; err != nil {
+		t.Fatal(err)
+	}
+	if orders != 8 {
+		t.Fatalf("demo orders = %d, want 8", orders)
+	}
+	for _, status := range []string{"pending", "failed", "paid", "partially_refunded", "refunded"} {
+		var count int64
+		if err := db.Model(&paymentOrderPO{}).Where("trade_no LIKE ? AND payment_status = ?", DemoTradePrefix+"%", status).Count(&count).Error; err != nil {
+			t.Fatal(err)
+		}
+		if count == 0 {
+			t.Fatalf("demo status %q is missing", status)
+		}
+	}
+	var partialRefund paymentEventPO
+	if err := db.Where("trade_no = ? AND type = ?", DemoTradePrefix+"05", "refund_confirmed").First(&partialRefund).Error; err != nil {
+		t.Fatal(err)
+	}
+	if partialRefund.Amount != 1200 {
+		t.Fatalf("partial refund event amount = %d, want 1200", partialRefund.Amount)
+	}
+	var created paymentEventPO
+	if err := db.Where("trade_no = ? AND type = ?", DemoTradePrefix+"01", "order_created").First(&created).Error; err != nil {
+		t.Fatal(err)
+	}
+	if created.ProviderStatus != "" || created.ClientIP == "" || created.DeviceID == "" {
+		t.Fatalf("created event metadata = %#v", created)
+	}
+	var paid paymentOrderPO
+	if err := db.Where("trade_no = ?", DemoTradePrefix+"01").First(&paid).Error; err != nil {
+		t.Fatal(err)
+	}
+	if paid.ProviderTradeNo == nil || !strings.Contains(*paid.ProviderTradeNo, "20260829") {
+		t.Fatalf("provider trade number = %#v", paid.ProviderTradeNo)
+	}
+}

internal/data/payment/migrations.go

@@ -11,5 +11,8 @@ func Migrations() []migration.Step {
 		{ID: "202608200003_payment_schema", Migrate: func(db *gorm.DB) error {
 			return migration.CreateMissingTables(db, &paymentOrderPO{})
 		}},
+		{ID: "202608290001_payment_event_schema", Migrate: func(db *gorm.DB) error {
+			return migration.CreateMissingTables(db, &paymentEventPO{})
+		}},
 	}
 }

internal/data/payment/payment_event.go

@@ -0,0 +1,117 @@
+package payment
+
+import (
+	"context"
+	bizpayment "kra/internal/biz/payment"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+type paymentEventPO struct {
+	ID             uint64    `gorm:"primaryKey"`
+	Provider       string    `gorm:"size:64;not null;index:idx_pay_events_order,priority:1"`
+	TradeNo        string    `gorm:"size:128;not null;index:idx_pay_events_order,priority:2"`
+	Type           string    `gorm:"size:64;not null;index"`
+	Source         string    `gorm:"size:64;not null;index"`
+	Status         string    `gorm:"size:64"`
+	ProviderStatus string    `gorm:"size:64"`
+	Message        string    `gorm:"size:512"`
+	EventID        string    `gorm:"size:128;index"`
+	PayloadHash    string    `gorm:"size:64"`
+	Amount         int64     `gorm:"not null;default:0"`
+	Currency       string    `gorm:"size:16"`
+	OperatorID     uint      `gorm:"index"`
+	OperatorName   string    `gorm:"size:128"`
+	ClientIP       string    `gorm:"size:64"`
+	UserAgent      string    `gorm:"size:512"`
+	DeviceID       string    `gorm:"size:128"`
+	CreatedAt      time.Time `gorm:"index"`
+}
+
+func (paymentEventPO) TableName() string { return "pay_events" }
+
+func toBizPaymentEvent(po *paymentEventPO) *bizpayment.PaymentEvent {
+	if po == nil {
+		return nil
+	}
+	return &bizpayment.PaymentEvent{
+		ID: po.ID, Provider: po.Provider, TradeNo: po.TradeNo, Type: po.Type, Source: po.Source,
+		Status: po.Status, ProviderStatus: po.ProviderStatus, Message: po.Message, EventID: po.EventID,
+		PayloadHash: po.PayloadHash, Amount: po.Amount, Currency: po.Currency, OperatorID: po.OperatorID,
+		OperatorName: po.OperatorName, ClientIP: po.ClientIP, UserAgent: po.UserAgent, DeviceID: po.DeviceID,
+		CreatedAt: po.CreatedAt,
+	}
+}
+
+func appendPaymentEvent(ctx context.Context, tx *gorm.DB, order *paymentOrderPO, event *bizpayment.PaymentEvent) error {
+	if tx == nil || order == nil || event == nil {
+		return nil
+	}
+	operation := bizpayment.PaymentOperationFromContext(ctx)
+	source := trimTo(event.Source, 64)
+	if source == "" {
+		source = trimTo(operation.Source, 64)
+	}
+	if source == "" {
+		source = "system"
+	}
+	message := trimTo(event.Message, 512)
+	if message == "" {
+		message = trimTo(operation.Reason, 512)
+	}
+	operatorID := event.OperatorID
+	if operatorID == 0 {
+		operatorID = operation.OperatorID
+	}
+	operatorName := trimTo(event.OperatorName, 128)
+	if operatorName == "" {
+		operatorName = trimTo(operation.OperatorName, 128)
+	}
+	clientIP := trimTo(event.ClientIP, 64)
+	if clientIP == "" {
+		clientIP = trimTo(operation.ClientIP, 64)
+	}
+	userAgent := trimTo(event.UserAgent, 512)
+	if userAgent == "" {
+		userAgent = trimTo(operation.UserAgent, 512)
+	}
+	deviceID := trimTo(event.DeviceID, 128)
+	if deviceID == "" {
+		deviceID = trimTo(operation.DeviceID, 128)
+	}
+	return tx.Create(&paymentEventPO{
+		Provider: order.Provider, TradeNo: order.TradeNo, Type: trimTo(event.Type, 64), Source: source,
+		Status: trimTo(event.Status, 64), ProviderStatus: trimTo(event.ProviderStatus, 64), Message: message,
+		EventID: trimTo(event.EventID, 128), PayloadHash: trimTo(event.PayloadHash, 64), Amount: event.Amount,
+		Currency: trimTo(event.Currency, 16), OperatorID: operatorID, OperatorName: operatorName,
+		ClientIP: clientIP, UserAgent: userAgent, DeviceID: deviceID,
+	}).Error
+}
+
+func savePaymentOrderWithEvent(ctx context.Context, tx *gorm.DB, order *paymentOrderPO, event *bizpayment.PaymentEvent) error {
+	if err := tx.Save(order).Error; err != nil {
+		return err
+	}
+	return appendPaymentEvent(ctx, tx, order, event)
+}
+
+func (r *paymentOrderRepo) ListPaymentEvents(ctx context.Context, provider, tradeNo string, limit int) ([]*bizpayment.PaymentEvent, error) {
+	if limit <= 0 {
+		limit = 100
+	}
+	if limit > 500 {
+		limit = 500
+	}
+	var rows []paymentEventPO
+	if err := r.data.DB().WithContext(ctx).
+		Where("provider = ? AND trade_no = ?", provider, tradeNo).
+		Order("id DESC").Limit(limit).Find(&rows).Error; err != nil {
+		return nil, err
+	}
+	items := make([]*bizpayment.PaymentEvent, 0, len(rows))
+	for i := range rows {
+		items = append(items, toBizPaymentEvent(&rows[i]))
+	}
+	return items, nil
+}

internal/data/payment/payment_order.go

@@ -146,7 +146,17 @@ func (r *paymentOrderRepo) CreatePaymentOrder(ctx context.Context, order *bizpay
 	if !errors.Is(err, gorm.ErrRecordNotFound) {
 		return nil, false, err
 	}
-	if err = db.Create(po).Error; err == nil {
+	err = db.Transaction(func(tx *gorm.DB) error {
+		if createErr := tx.Create(po).Error; createErr != nil {
+			return createErr
+		}
+		return appendPaymentEvent(ctx, tx, po, &bizpayment.PaymentEvent{
+			Type: bizpayment.PaymentEventOrderCreated, Source: "client", Status: po.PaymentStatus,
+			Amount: po.Amount, Currency: po.Currency, ClientIP: order.ClientIP,
+			UserAgent: order.UserAgent, DeviceID: order.DeviceID,
+		})
+	})
+	if err == nil {
 		return toBizPaymentOrder(po), true, nil
 	}
 	if lookupErr := db.Where("provider = ? AND trade_no = ?", po.Provider, po.TradeNo).First(&current).Error; lookupErr == nil {
@@ -167,25 +177,7 @@ func (r *paymentOrderRepo) FindPaymentOrder(ctx context.Context, provider, trade
 }
 
 func (r *paymentOrderRepo) ListPaymentOrders(ctx context.Context, page, pageSize int, filter bizpayment.PaymentOrderFilter) ([]*bizpayment.PaymentOrder, int64, error) {
-	db := r.data.DB().WithContext(ctx).Model(&paymentOrderPO{})
-	if value := strings.TrimSpace(filter.Provider); value != "" {
-		db = db.Where("provider = ?", value)
-	}
-	if value := strings.TrimSpace(filter.TradeNo); value != "" {
-		db = db.Where("trade_no LIKE ?", "%"+value+"%")
-	}
-	if value := strings.TrimSpace(filter.BusinessType); value != "" {
-		db = db.Where("business_type = ?", value)
-	}
-	if value := strings.TrimSpace(filter.BusinessID); value != "" {
-		db = db.Where("business_id LIKE ?", "%"+value+"%")
-	}
-	if value := strings.TrimSpace(filter.PaymentStatus); value != "" {
-		db = db.Where("payment_status = ?", value)
-	}
-	if value := strings.TrimSpace(filter.RefundStatus); value != "" {
-		db = db.Where("refund_status = ?", value)
-	}
+	db := r.filteredPaymentOrders(ctx, filter)
 	var total int64
 	if err := db.Count(&total).Error; err != nil {
 		return nil, 0, err
@@ -201,6 +193,105 @@ func (r *paymentOrderRepo) ListPaymentOrders(ctx context.Context, page, pageSize
 	return items, total, nil
 }
 
+func (r *paymentOrderRepo) filteredPaymentOrders(ctx context.Context, filter bizpayment.PaymentOrderFilter) *gorm.DB {
+	db := r.data.DB().WithContext(ctx).Model(&paymentOrderPO{})
+	if value := strings.TrimSpace(filter.Provider); value != "" {
+		db = db.Where("provider = ?", value)
+	}
+	if value := strings.TrimSpace(filter.TradeNo); value != "" {
+		db = db.Where("trade_no LIKE ?", "%"+value+"%")
+	}
+	if value := strings.TrimSpace(filter.ProviderTradeNo); value != "" {
+		db = db.Where("provider_trade_no LIKE ?", "%"+value+"%")
+	}
+	if value := strings.TrimSpace(filter.Keyword); value != "" {
+		like := "%" + value + "%"
+		db = db.Where("trade_no LIKE ? OR provider_trade_no LIKE ? OR business_id LIKE ? OR subject LIKE ?", like, like, like, like)
+	}
+	if value := strings.TrimSpace(filter.BusinessType); value != "" {
+		db = db.Where("business_type = ?", value)
+	}
+	if value := strings.TrimSpace(filter.BusinessID); value != "" {
+		db = db.Where("business_id LIKE ?", "%"+value+"%")
+	}
+	if value := strings.TrimSpace(filter.PaymentStatus); value != "" {
+		db = db.Where("payment_status = ?", value)
+	}
+	if value := strings.TrimSpace(filter.RefundStatus); value != "" {
+		db = db.Where("refund_status = ?", value)
+	}
+	if filter.CreatedFrom != nil {
+		db = db.Where("created_at >= ?", filter.CreatedFrom.UTC())
+	}
+	if filter.CreatedTo != nil {
+		db = db.Where("created_at < ?", filter.CreatedTo.UTC())
+	}
+	if filter.PaidFrom != nil {
+		db = db.Where("paid_at >= ?", filter.PaidFrom.UTC())
+	}
+	if filter.PaidTo != nil {
+		db = db.Where("paid_at < ?", filter.PaidTo.UTC())
+	}
+	if filter.IssueOnly {
+		db = db.Where("payment_status = ? OR fulfillment_status = ? OR refund_status = ? OR last_error <> ''",
+			bizpayment.PaymentStatusFailed, bizpayment.FulfillmentStatusFailed, bizpayment.RefundStatusFailed)
+	}
+	return db
+}
+
+func (r *paymentOrderRepo) SummarizePaymentOrders(ctx context.Context, filter bizpayment.PaymentOrderFilter) (*bizpayment.PaymentOrderSummary, error) {
+	type countRow struct {
+		OrderCount    int64
+		PendingCount  int64
+		PaidCount     int64
+		RefundedCount int64
+		IssueCount    int64
+	}
+	var counts countRow
+	if err := r.filteredPaymentOrders(ctx, filter).Select(`
+		COUNT(*) AS order_count,
+		COALESCE(SUM(CASE WHEN payment_status IN ? THEN 1 ELSE 0 END), 0) AS pending_count,
+		COALESCE(SUM(CASE WHEN payment_status IN ? THEN 1 ELSE 0 END), 0) AS paid_count,
+		COALESCE(SUM(CASE WHEN refunded_amount > 0 THEN 1 ELSE 0 END), 0) AS refunded_count,
+		COALESCE(SUM(CASE WHEN payment_status = ? OR fulfillment_status = ? OR refund_status = ? OR last_error <> '' THEN 1 ELSE 0 END), 0) AS issue_count`,
+		[]string{bizpayment.PaymentStatusInitialized, bizpayment.PaymentStatusPending},
+		[]string{bizpayment.PaymentStatusPaid, bizpayment.PaymentStatusPartiallyRefunded, bizpayment.PaymentStatusRefunded},
+		bizpayment.PaymentStatusFailed, bizpayment.FulfillmentStatusFailed, bizpayment.RefundStatusFailed,
+	).Scan(&counts).Error; err != nil {
+		return nil, err
+	}
+	type currencyRow struct {
+		Currency         string
+		OrderAmount      int64
+		PaidAmount       int64
+		RefundedAmount   int64
+		SettlementAmount int64
+	}
+	var rows []currencyRow
+	if err := r.filteredPaymentOrders(ctx, filter).
+		Select(`currency,
+			COALESCE(SUM(amount), 0) AS order_amount,
+			COALESCE(SUM(paid_amount), 0) AS paid_amount,
+			COALESCE(SUM(refunded_amount), 0) AS refunded_amount,
+			COALESCE(SUM(CASE WHEN settlement_amount > 0 THEN settlement_amount ELSE paid_amount END), 0) AS settlement_amount`).
+		Group("currency").Order("currency ASC").Scan(&rows).Error; err != nil {
+		return nil, err
+	}
+	summary := &bizpayment.PaymentOrderSummary{
+		OrderCount: counts.OrderCount, PendingCount: counts.PendingCount, PaidCount: counts.PaidCount,
+		RefundedCount: counts.RefundedCount, IssueCount: counts.IssueCount,
+		Currencies: make([]bizpayment.PaymentCurrencySummary, 0, len(rows)),
+	}
+	for _, row := range rows {
+		summary.Currencies = append(summary.Currencies, bizpayment.PaymentCurrencySummary{
+			Currency: row.Currency, OrderAmount: row.OrderAmount, PaidAmount: row.PaidAmount,
+			RefundedAmount: row.RefundedAmount, SettlementAmount: row.SettlementAmount,
+			NetAmount: row.SettlementAmount - row.RefundedAmount,
+		})
+	}
+	return summary, nil
+}
+
 func (r *paymentOrderRepo) RecordPaymentCreate(ctx context.Context, provider, tradeNo string, update *bizpayment.PaymentProviderUpdate) (*bizpayment.PaymentOrder, error) {
 	return r.withLockedOrder(ctx, provider, tradeNo, func(tx *gorm.DB, po *paymentOrderPO) error {
 		if update == nil {
@@ -224,7 +315,11 @@ func (r *paymentOrderRepo) RecordPaymentCreate(ctx context.Context, provider, tr
 			po.PaymentStatus = status
 		}
 		po.Version++
-		return tx.Save(po).Error
+		return savePaymentOrderWithEvent(ctx, tx, po, &bizpayment.PaymentEvent{
+			Type: bizpayment.PaymentEventProviderCreated, Source: update.EventSource, Status: po.PaymentStatus,
+			ProviderStatus: po.ProviderStatus, Message: update.EventMessage, EventID: update.EventID,
+			PayloadHash: update.PayloadHash, Amount: po.Amount, Currency: po.Currency,
+		})
 	})
 }
 
@@ -279,7 +374,15 @@ func (r *paymentOrderRepo) ApplyPaymentResult(ctx context.Context, provider, tra
 			}
 		}
 		po.Version++
-		return tx.Save(po).Error
+		eventType := update.EventType
+		if eventType == "" {
+			eventType = bizpayment.PaymentEventPaymentSynchronized
+		}
+		return savePaymentOrderWithEvent(ctx, tx, po, &bizpayment.PaymentEvent{
+			Type: eventType, Source: update.EventSource, Status: po.PaymentStatus,
+			ProviderStatus: po.ProviderStatus, Message: update.EventMessage, EventID: update.EventID,
+			PayloadHash: update.PayloadHash, Amount: po.PaidAmount, Currency: po.Currency,
+		})
 	})
 }
 
@@ -308,7 +411,9 @@ func (r *paymentOrderRepo) BeginPaymentFulfillment(ctx context.Context, provider
 		po.FulfillmentLeaseUntil = &until
 		po.LastError = ""
 		po.Version++
-		return tx.Save(po).Error
+		return savePaymentOrderWithEvent(ctx, tx, po, &bizpayment.PaymentEvent{
+			Type: bizpayment.PaymentEventFulfillmentStarted, Status: po.FulfillmentStatus,
+		})
 	})
 	return order, token, duplicate, err
 }
@@ -329,7 +434,9 @@ func (r *paymentOrderRepo) CompletePaymentFulfillment(ctx context.Context, provi
 			po.FulfillmentStatus = bizpayment.FulfillmentStatusFailed
 		}
 		po.Version++
-		return tx.Save(po).Error
+		return savePaymentOrderWithEvent(ctx, tx, po, &bizpayment.PaymentEvent{
+			Type: bizpayment.PaymentEventFulfillmentFinished, Status: po.FulfillmentStatus, Message: message,
+		})
 	})
 }
 
@@ -378,7 +485,9 @@ func (r *paymentOrderRepo) BeginPaymentRefund(ctx context.Context, provider, tra
 		po.RefundLeaseUntil = &until
 		po.LastError = ""
 		po.Version++
-		return tx.Save(po).Error
+		return savePaymentOrderWithEvent(ctx, tx, po, &bizpayment.PaymentEvent{
+			Type: bizpayment.PaymentEventRefundStarted, Status: po.RefundStatus, Amount: amount, Currency: po.Currency,
+		})
 	})
 	return order, token, err
 }
@@ -399,7 +508,10 @@ func (r *paymentOrderRepo) CompletePaymentRefundRequest(ctx context.Context, pro
 			po.RefundNo = ""
 		}
 		po.Version++
-		return tx.Save(po).Error
+		return savePaymentOrderWithEvent(ctx, tx, po, &bizpayment.PaymentEvent{
+			Type: bizpayment.PaymentEventRefundSubmitted, Status: po.RefundStatus, Message: message,
+			Amount: po.RefundRequestedAmount, Currency: po.Currency,
+		})
 	})
 }
 
@@ -414,7 +526,10 @@ func (r *paymentOrderRepo) ConfirmPaymentRefund(ctx context.Context, provider, t
 			po.RefundStatus = bizpayment.RefundStatusFailed
 			po.RefundNo = ""
 			po.Version++
-			return tx.Save(po).Error
+			return savePaymentOrderWithEvent(ctx, tx, po, &bizpayment.PaymentEvent{
+				Type: bizpayment.PaymentEventRefundConfirmed, Status: po.RefundStatus, Message: message,
+				Amount: amount, Currency: po.Currency,
+			})
 		}
 		po.RefundedAmount += amount
 		if po.RefundedAmount >= po.Amount {
@@ -428,7 +543,10 @@ func (r *paymentOrderRepo) ConfirmPaymentRefund(ctx context.Context, provider, t
 		now := time.Now().UTC()
 		po.RefundedAt = &now
 		po.Version++
-		return tx.Save(po).Error
+		return savePaymentOrderWithEvent(ctx, tx, po, &bizpayment.PaymentEvent{
+			Type: bizpayment.PaymentEventRefundConfirmed, Status: po.RefundStatus, Message: message,
+			Amount: amount, Currency: po.Currency,
+		})
 	})
 }
 

internal/data/payment/payment_order_test.go

@@ -13,7 +13,7 @@ func newPaymentOrderRepoForTest(t *testing.T) *paymentOrderRepo {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err = db.AutoMigrate(&paymentOrderPO{}); err != nil {
+	if err = db.AutoMigrate(&paymentOrderPO{}, &paymentEventPO{}); err != nil {
 		t.Fatal(err)
 	}
 	return &paymentOrderRepo{data: &Data{gormDB: newReloadableDB(db, nil)}}
@@ -114,3 +114,57 @@ func TestPaymentOrderRepositoryListsWithFilters(t *testing.T) {
 		t.Fatalf("filtered orders = %#v total=%d", items, total)
 	}
 }
+
+func TestPaymentOrderRepositorySummarizesAndListsEvents(t *testing.T) {
+	repo := newPaymentOrderRepoForTest(t)
+	ctx := bizpayment.WithPaymentOperation(context.Background(), bizpayment.PaymentOperation{
+		Source: "admin", Reason: "客户重复购买", OperatorID: 7, OperatorName: "operator",
+		ClientIP: "127.0.0.1", DeviceID: "device-1",
+	})
+	order := testPaymentOrder()
+	order.ClientIP = "10.0.0.8"
+	order.UserAgent = "payment-client/1.0"
+	if _, _, err := repo.CreatePaymentOrder(ctx, order); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := repo.ApplyPaymentResult(ctx, bizpayment.PaymentAlipay, order.TradeNo, &bizpayment.PaymentProviderUpdate{
+		Status: "success", ProviderStatus: "TRADE_SUCCESS", ProviderTradeNo: "provider-summary-1",
+		Amount: 100, Currency: "CNY", EventType: bizpayment.PaymentEventPaymentSynchronized,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	current, token, err := repo.BeginPaymentRefund(ctx, bizpayment.PaymentAlipay, order.TradeNo, 40, time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if current, err = repo.CompletePaymentRefundRequest(ctx, bizpayment.PaymentAlipay, order.TradeNo, token, true, ""); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = repo.ConfirmPaymentRefund(ctx, bizpayment.PaymentAlipay, order.TradeNo, current.RefundNo, 40, true, ""); err != nil {
+		t.Fatal(err)
+	}
+
+	summary, err := repo.SummarizePaymentOrders(ctx, bizpayment.PaymentOrderFilter{ProviderTradeNo: "summary-1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if summary.OrderCount != 1 || summary.PaidCount != 1 || summary.RefundedCount != 1 || len(summary.Currencies) != 1 || summary.Currencies[0].NetAmount != 60 {
+		t.Fatalf("unexpected summary: %#v", summary)
+	}
+	events, err := repo.ListPaymentEvents(ctx, bizpayment.PaymentAlipay, order.TradeNo, 100)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(events) < 5 {
+		t.Fatalf("event count = %d, want at least 5", len(events))
+	}
+	var foundRefund bool
+	for _, event := range events {
+		if event.Type == bizpayment.PaymentEventRefundStarted {
+			foundRefund = event.Message == "客户重复购买" && event.OperatorID == 7 && event.DeviceID == "device-1"
+		}
+	}
+	if !foundRefund {
+		t.Fatalf("refund audit event missing operation context: %#v", events)
+	}
+}

internal/data/system/surface_upgrade.go

@@ -0,0 +1,200 @@
+package system
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+
+	platformmodule "kra/pkg/module"
+
+	"gorm.io/gorm"
+)
+
+// EnsureAdminSurface upgrades an already initialized installation with a
+// module's current menus, API metadata, root menu links, and root policies.
+// It intentionally does nothing before first-install seed data exists.
+func EnsureAdminSurface(db *gorm.DB, surface platformmodule.Surface, rootAuthorityID uint) error {
+	if db == nil || !db.Migrator().HasTable(&menuPO{}) || !db.Migrator().HasTable(&apiPO{}) {
+		return nil
+	}
+	return db.Transaction(func(tx *gorm.DB) error {
+		parentIDs := map[string]uint{}
+		for _, item := range surface.Menus {
+			if item.ParentName == "" {
+				continue
+			}
+			if _, ok := parentIDs[item.ParentName]; ok {
+				continue
+			}
+			var parent menuPO
+			if err := tx.Where("name = ?", item.ParentName).First(&parent).Error; err != nil {
+				if errors.Is(err, gorm.ErrRecordNotFound) {
+					return nil
+				}
+				return err
+			}
+			parentIDs[item.ParentName] = parent.ID
+		}
+
+		menus := make([]menuPO, 0, len(surface.Menus))
+		for _, item := range surface.Menus {
+			menu := menuPO{
+				MenuLevel: 1, ParentID: parentIDs[item.ParentName], Path: item.Path, Name: item.Name,
+				Component: item.Component, Title: item.Title, Icon: item.Icon, Sort: item.Sort,
+			}
+			if item.ParentName == "" {
+				menu.MenuLevel = 0
+			}
+			var current menuPO
+			err := tx.Where("name = ?", item.Name).First(&current).Error
+			switch {
+			case errors.Is(err, gorm.ErrRecordNotFound):
+				if err = tx.Create(&menu).Error; err != nil {
+					return err
+				}
+			case err != nil:
+				return err
+			default:
+				if err = tx.Model(&current).Updates(map[string]any{
+					"menu_level": menu.MenuLevel, "parent_id": menu.ParentID, "path": menu.Path,
+					"component": menu.Component, "title": menu.Title, "icon": menu.Icon, "sort": menu.Sort,
+				}).Error; err != nil {
+					return err
+				}
+				menu.ID = current.ID
+			}
+			menus = append(menus, menu)
+		}
+
+		apis := make([]apiPO, 0, len(surface.APIs))
+		for _, item := range surface.APIs {
+			api := apiPO{Path: item.Path, Method: strings.ToUpper(item.Method), APIGroup: item.Group, Description: item.Description}
+			var current apiPO
+			err := tx.Where("path = ? AND method = ?", api.Path, api.Method).First(&current).Error
+			switch {
+			case errors.Is(err, gorm.ErrRecordNotFound):
+				if err = tx.Create(&api).Error; err != nil {
+					return err
+				}
+			case err != nil:
+				return err
+			default:
+				if err = tx.Model(&current).Updates(map[string]any{"api_group": api.APIGroup, "description": api.Description}).Error; err != nil {
+					return err
+				}
+				api.ID = current.ID
+			}
+			apis = append(apis, api)
+		}
+
+		if rootAuthorityID == 0 || !tx.Migrator().HasTable(&authorityPO{}) || !tx.Migrator().HasTable(&authorityMenuPO{}) || !tx.Migrator().HasTable(&casbinRulePO{}) {
+			return nil
+		}
+		var root authorityPO
+		if err := tx.Where("authority_id = ?", rootAuthorityID).First(&root).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return nil
+			}
+			return err
+		}
+		for _, menu := range menus {
+			link := authorityMenuPO{SysAuthorityAuthorityID: rootAuthorityID, SysBaseMenuID: menu.ID}
+			var count int64
+			if err := tx.Model(&authorityMenuPO{}).
+				Where("sys_authority_authority_id = ? AND sys_base_menu_id = ?", rootAuthorityID, menu.ID).
+				Count(&count).Error; err != nil {
+				return err
+			}
+			if count == 0 {
+				if err := tx.Create(&link).Error; err != nil {
+					return err
+				}
+			}
+		}
+		for _, api := range apis {
+			exists, err := policyExists(tx, rootAuthorityID, api.Path, api.Method)
+			if err != nil {
+				return err
+			}
+			if !exists {
+				rule := newPolicyRule(rootAuthorityID, api.Path, api.Method)
+				if err := tx.Create(&rule).Error; err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	})
+}
+
+// InheritAPIPolicy grants a new route only to authorities that already own
+// the supplied predecessor route. This preserves existing read-access intent
+// without broadening unrelated write permissions.
+func InheritAPIPolicy(db *gorm.DB, sourcePath, sourceMethod, targetPath, targetMethod string) error {
+	if db == nil || !db.Migrator().HasTable(&casbinRulePO{}) {
+		return nil
+	}
+	sourceMethod = strings.ToUpper(sourceMethod)
+	targetMethod = strings.ToUpper(targetMethod)
+	return db.Transaction(func(tx *gorm.DB) error {
+		var rows []casbinRulePO
+		if err := policyScope(tx).Where("v1 = ? AND v2 = ?", sourcePath, sourceMethod).Find(&rows).Error; err != nil {
+			return err
+		}
+		for _, row := range rows {
+			parsed, err := strconv.ParseUint(row.V0, 10, 64)
+			if err != nil {
+				continue
+			}
+			authorityID := uint(parsed)
+			exists, err := policyExists(tx, authorityID, targetPath, targetMethod)
+			if err != nil {
+				return err
+			}
+			if !exists {
+				rule := newPolicyRule(authorityID, targetPath, targetMethod)
+				if err := tx.Create(&rule).Error; err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	})
+}
+
+// GrantMenuAPIs makes a visible administration menu usable by granting only
+// its explicitly supplied API set to authorities that already own the menu.
+func GrantMenuAPIs(db *gorm.DB, menuName string, apis []platformmodule.API) error {
+	if db == nil || !db.Migrator().HasTable(&menuPO{}) || !db.Migrator().HasTable(&authorityMenuPO{}) || !db.Migrator().HasTable(&casbinRulePO{}) {
+		return nil
+	}
+	return db.Transaction(func(tx *gorm.DB) error {
+		var menu menuPO
+		if err := tx.Where("name = ?", menuName).First(&menu).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return nil
+			}
+			return err
+		}
+		var links []authorityMenuPO
+		if err := tx.Where("sys_base_menu_id = ?", menu.ID).Find(&links).Error; err != nil {
+			return err
+		}
+		for _, link := range links {
+			for _, api := range apis {
+				method := strings.ToUpper(api.Method)
+				exists, err := policyExists(tx, link.SysAuthorityAuthorityID, api.Path, method)
+				if err != nil {
+					return err
+				}
+				if !exists {
+					rule := newPolicyRule(link.SysAuthorityAuthorityID, api.Path, method)
+					if err := tx.Create(&rule).Error; err != nil {
+						return err
+					}
+				}
+			}
+		}
+		return nil
+	})
+}

internal/data/system/surface_upgrade_test.go

@@ -0,0 +1,109 @@
+package system
+
+import (
+	"testing"
+
+	platformmodule "kra/pkg/module"
+)
+
+func TestEnsureAdminSurfaceAndPolicyInheritance(t *testing.T) {
+	db, err := openWithDriver("sqlite", "file:"+t.Name()+"?mode=memory&cache=shared")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = migrateAll(db); err != nil {
+		t.Fatal(err)
+	}
+	parent := menuPO{Name: "extensions", Path: "extensions", Title: "扩展功能"}
+	if err = db.Create(&parent).Error; err != nil {
+		t.Fatal(err)
+	}
+	rootParent := uint(0)
+	if err = db.Create(&[]authorityPO{
+		{AuthorityID: 888, AuthorityName: "root", ParentID: &rootParent},
+		{AuthorityID: 999, AuthorityName: "operator", ParentID: &rootParent},
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err = db.Create(&[]casbinRulePO{
+		newPolicyRule(999, "/payment/orders", "GET"),
+		newPolicyRule(999, "/payment/orders/:provider/:tradeNo", "GET"),
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+	surface := platformmodule.Surface{
+		Menus: []platformmodule.Menu{
+			{Name: "paymentOrders", Path: "paymentOrders", ParentName: "extensions", Component: "view/payment/orders.vue", Title: "支付订单", Sort: 6},
+			{Name: "paymentConfig", Path: "paymentConfig", ParentName: "extensions", Component: "view/payment/config.vue", Title: "支付配置", Sort: 7},
+		},
+		APIs: []platformmodule.API{
+			{Path: "/payment/orders", Method: "GET", Group: "支付", Description: "订单列表"},
+			{Path: "/payment/orders/summary", Method: "GET", Group: "支付", Description: "订单汇总"},
+			{Path: "/payment/orders/:provider/:tradeNo", Method: "GET", Group: "支付", Description: "订单详情"},
+			{Path: "/payment/orders/:provider/:tradeNo/events", Method: "GET", Group: "支付", Description: "订单事件"},
+			{Path: "/payment/refund", Method: "POST", Group: "支付", Description: "退款"},
+		},
+	}
+	for attempt := 0; attempt < 2; attempt++ {
+		if err = EnsureAdminSurface(db, surface, 888); err != nil {
+			t.Fatal(err)
+		}
+		var paymentMenu menuPO
+		if err = db.Where("name = ?", "paymentOrders").First(&paymentMenu).Error; err != nil {
+			t.Fatal(err)
+		}
+		var linkCount int64
+		if err = db.Model(&authorityMenuPO{}).Where("sys_authority_authority_id = ? AND sys_base_menu_id = ?", 999, paymentMenu.ID).Count(&linkCount).Error; err != nil {
+			t.Fatal(err)
+		}
+		if linkCount == 0 {
+			if err = db.Create(&authorityMenuPO{SysAuthorityAuthorityID: 999, SysBaseMenuID: paymentMenu.ID}).Error; err != nil {
+				t.Fatal(err)
+			}
+		}
+		if err = InheritAPIPolicy(db, "/payment/orders", "GET", "/payment/orders/summary", "GET"); err != nil {
+			t.Fatal(err)
+		}
+		if err = InheritAPIPolicy(db, "/payment/orders/:provider/:tradeNo", "GET", "/payment/orders/:provider/:tradeNo/events", "GET"); err != nil {
+			t.Fatal(err)
+		}
+		if err = GrantMenuAPIs(db, "paymentOrders", surface.APIs[:4]); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, test := range []struct {
+		authority uint
+		path      string
+		method    string
+		want      bool
+	}{
+		{888, "/payment/orders", "GET", true},
+		{888, "/payment/refund", "POST", true},
+		{999, "/payment/orders/summary", "GET", true},
+		{999, "/payment/orders", "GET", true},
+		{999, "/payment/orders/:provider/:tradeNo/events", "GET", true},
+		{999, "/payment/refund", "POST", false},
+	} {
+		exists, checkErr := policyExists(db, test.authority, test.path, test.method)
+		if checkErr != nil {
+			t.Fatal(checkErr)
+		}
+		if exists != test.want {
+			t.Fatalf("policy %d %s %s = %v, want %v", test.authority, test.method, test.path, exists, test.want)
+		}
+	}
+	var apiCount int64
+	if err = db.Model(&apiPO{}).Where("path LIKE ?", "/payment/%").Count(&apiCount).Error; err != nil {
+		t.Fatal(err)
+	}
+	if apiCount != int64(len(surface.APIs)) {
+		t.Fatalf("payment APIs = %d, want %d", apiCount, len(surface.APIs))
+	}
+	var rootLinks int64
+	if err = db.Model(&authorityMenuPO{}).Where("sys_authority_authority_id = ?", 888).Count(&rootLinks).Error; err != nil {
+		t.Fatal(err)
+	}
+	if rootLinks != int64(len(surface.Menus)) {
+		t.Fatalf("root menu links = %d, want %d", rootLinks, len(surface.Menus))
+	}
+}