fix: 会员充值链路加固（体验资格、积分分红、czjilu审计、余额抵扣）

Co-authored-by: Cursor <cursoragent@cursor.com>

products/views/chongzhi_payment.py

@@ -879,6 +879,7 @@ class DsqrgmdhView(APIView):
     permission_classes = [permissions.IsAuthenticated]
 
     def post(self, request):
+        from jituan.services.member_recharge import MemberRechargeError
         try:
             leixing = request.data.get('leixing')
             shenfen_id = request.data.get('shenfen_id')
@@ -969,6 +970,7 @@ class DsqrgmdhView(APIView):
                 return Response({'code': 400, 'msg': f'{identity["name"]}余额不足，需要{required}元，当前{balance}元'}, status=status.HTTP_400_BAD_REQUEST)
 
             try:
+                fulfill_error = None
                 with transaction.atomic():
                     locked_profile = identity['model'].objects.select_for_update().get(id=profile.id)
                     current_balance = getattr(locked_profile, identity['balance_field'])
@@ -995,7 +997,8 @@ class DsqrgmdhView(APIView):
                     shuoming = f"{identity['name']}抵扣 {action_desc}，抵扣金额{required}元"
                     cz_leixing = leixing
                     cz_club_id = club_id
-                    cz_zhuangtai = 1
+                    from jituan.services.member_recharge import MEMBER_PENDING_STATUS, MEMBER_FAILED_STATUS, MEMBER_PAID_STATUS
+                    cz_zhuangtai = MEMBER_PENDING_STATUS
                     if leixing == 4:
                         from jituan.services.club_penalty import penalty_cz_club_id
                         from products.czjilu_types import (
@@ -1031,35 +1034,52 @@ class DsqrgmdhView(APIView):
 
                     czjilu = Czjilu.query.create(**czjilu_kwargs)
 
-                    response_data = {}
+                    response_data = {'dingdan_id': dingdan_id}
+                    fulfill_error = None
 
                     if leixing == 1:
-                        from jituan.services.member_recharge import fulfill_member_balance_purchase
-                        huiyuan_record, is_first_buy = fulfill_member_balance_purchase(
-                            czjilu, huiyuan, club_id=club_id,
+                        from jituan.services.member_recharge import (
+                            fulfill_member_balance_purchase,
+                            validate_member_purchase,
                         )
-                        response_data['huiyuan'] = {
-                            'huiyuanid': huiyuan_id,
-                            'huiyuanming': huiyuan.jieshao,
-                            'daoqi': huiyuan_record.daoqi_time.strftime('%Y-%m-%d %H:%M:%S') if hasattr(huiyuan_record, 'daoqi_time') else '',
-                        }
-                        if is_first_buy:
-                            try:
-                                dashou = UserDashou.query.get(user=user)
-                                dashou.jifen += 10
-                                dashou.save(update_fields=['jifen'])
-                                response_data['jifen'] = dashou.jifen
-                            except UserDashou.DoesNotExist:
-                                pass
+                        try:
+                            ok, err_msg, _, _ = validate_member_purchase(
+                                yonghuid, huiyuan_id, club_id, is_trial=False,
+                            )
+                            if not ok:
+                                raise MemberRechargeError(err_msg or '会员不可购买', 'purchase_not_allowed')
+                            huiyuan_record, new_jifen = fulfill_member_balance_purchase(
+                                czjilu, huiyuan, club_id=club_id,
+                            )
+                            response_data['huiyuan'] = {
+                                'huiyuanid': huiyuan_id,
+                                'huiyuanming': huiyuan.jieshao,
+                                'daoqi': huiyuan_record.daoqi_time.strftime('%Y-%m-%d %H:%M:%S') if hasattr(huiyuan_record, 'daoqi_time') else '',
+                            }
+                            response_data['jifen'] = new_jifen
+                        except MemberRechargeError as exc:
+                            setattr(locked_profile, identity['balance_field'], current_balance)
+                            locked_profile.save(update_fields=[identity['balance_field']])
+                            czjilu.zhuangtai = MEMBER_FAILED_STATUS
+                            czjilu.shuoming = f"{shuoming} | 履约失败:{str(exc)[:40]}"[:100]
+                            czjilu.save(update_fields=['zhuangtai', 'shuoming'])
+                            fulfill_error = exc
 
                     elif leixing == 2:
                         try:
                             dashou = UserDashou.objects.select_for_update().get(user=user)
                             dashou.yajin += yajin_jine
                             dashou.save(update_fields=['yajin'])
+                            czjilu.zhuangtai = MEMBER_PAID_STATUS
+                            czjilu.save(update_fields=['zhuangtai'])
                             response_data['yajin'] = dashou.yajin
                         except UserDashou.DoesNotExist:
-                            return Response({'code': 500, 'msg': '打手信息不存在，无法充值押金'}, status=status.HTTP_500_INTERNAL_SERVER_ERROR)
+                            setattr(locked_profile, identity['balance_field'], current_balance)
+                            locked_profile.save(update_fields=[identity['balance_field']])
+                            czjilu.zhuangtai = MEMBER_FAILED_STATUS
+                            czjilu.shuoming = f"{shuoming} | 履约失败:打手不存在"[:100]
+                            czjilu.save(update_fields=['zhuangtai', 'shuoming'])
+                            fulfill_error = MemberRechargeError('打手信息不存在，无法充值押金', 'dashou_not_found')
 
                     elif leixing == 4:
                         if fadan_obj.Status not in [1, 3]:
@@ -1082,14 +1102,29 @@ class DsqrgmdhView(APIView):
                             new_jifen = dashou.jifen + INTEGRAL_INCREMENT
                             dashou.jifen = min(new_jifen, MAX_INTEGRAL)
                             dashou.save(update_fields=['jifen'])
+                            czjilu.zhuangtai = MEMBER_PAID_STATUS
+                            czjilu.save(update_fields=['zhuangtai'])
                             response_data['jifen'] = dashou.jifen
                         except UserDashou.DoesNotExist:
-                            return Response({'code': 500, 'msg': '打手信息不存在，无法补充积分'}, status=status.HTTP_500_INTERNAL_SERVER_ERROR)
+                            setattr(locked_profile, identity['balance_field'], current_balance)
+                            locked_profile.save(update_fields=[identity['balance_field']])
+                            czjilu.zhuangtai = MEMBER_FAILED_STATUS
+                            czjilu.shuoming = f"{shuoming} | 履约失败:打手不存在"[:100]
+                            czjilu.save(update_fields=['zhuangtai', 'shuoming'])
+                            fulfill_error = MemberRechargeError('打手信息不存在，无法补充积分', 'dashou_not_found')
 
             except Exception as e:
                 logger.error(f"事务处理异常: {str(e)}", exc_info=True)
                 return Response({'code': 500, 'msg': f'支付处理失败: {str(e)}'}, status=status.HTTP_500_INTERNAL_SERVER_ERROR)
 
+            if fulfill_error:
+                logger.warning('余额抵扣履约失败 dingdan=%s err=%s', dingdan_id, fulfill_error)
+                return Response({
+                    'code': 400,
+                    'msg': str(fulfill_error),
+                    'data': response_data,
+                }, status=status.HTTP_400_BAD_REQUEST)
+
             final_profile = identity['model'].query.get(user=user)
             response_data['balance'] = str(getattr(final_profile, identity['balance_field']))