1

server/app/services/auth_service.py

@@ -362,6 +362,11 @@ async def login(db: AsyncSession, redis: aioredis.Redis, req, ip: str) -> dict:
     user.last_login_ip = ip
     await db.commit()
 
+    # 单点登录：新设备登录即踢掉其它设备。
+    # 递增令牌纪元使旧 access token 立即失效（deps 每次请求校验 ep），
+    # 清空 refresh 白名单使旧 refresh 无法刷新；随后签发的新 Token 带新纪元。
+    await redis.incr(f"auth:epoch:{user.id}")
+    await redis.delete(f"auth:refresh:{user.id}")
     tokens = await _issue_tokens(redis, user.id)
     return {"user_id": user.id, **tokens, "user": await _user_brief(db, user)}
 

server/app/services/settle_service.py

@@ -8,10 +8,11 @@ import logging
 from datetime import datetime, timedelta
 from decimal import Decimal
 
+import httpx
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.config import biz_config
+from app.config import biz_config, settings
 from app.database import SessionFactory
 from app.models.billing import RechargeOrder, WatchRecord
 from app.models.incentive import Referral, VideoEarning
@@ -27,6 +28,10 @@ BATCH_SIZE = 500
 INTERVAL_REFERRAL = 600   # 推荐激活结算 10min
 INTERVAL_EARNINGS = 300   # 创作收益结算 5min
 INTERVAL_ORDER_CLOSE = 60  # 订单超时关单 1min
+INTERVAL_USDT_POLL = 15    # USDT 链上流水轮询 15s
+
+# USDT-TRC20 主网合约地址
+USDT_CONTRACT = "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t"
 
 
 def _referral_cfg() -> dict:
@@ -128,17 +133,111 @@ async def settle_video_earnings(db: AsyncSession) -> dict:
 # ---------- 订单超时关单 ----------
 
 async def close_expired_orders(db: AsyncSession) -> dict:
-    """待支付订单超过 expire_at → 已关闭"""
+    """待支付订单超过 expire_at → 已关闭。
+
+    USDT 订单额外留 10 分钟宽限：用户在有效期末尾转账时，区块固化可能晚于
+    订单过期时间，若立即关单会导致已付款无法自动入账（只能人工补单）。
+    """
+    usdt_cfg = (biz_config.get("recharge") or {}).get("usdt") or {}
+    grace_min = int(usdt_cfg.get("confirm_grace_min", 10))
+    now = datetime.now()
     rows = (await db.execute(
         select(RechargeOrder)
-        .where(RechargeOrder.status == 0, RechargeOrder.expire_at < datetime.now())
+        .where(RechargeOrder.status == 0, RechargeOrder.expire_at < now)
         .order_by(RechargeOrder.id)
         .limit(BATCH_SIZE)
     )).scalars().all()
+    closed = 0
     for o in rows:
+        if o.pay_method == 3 and o.expire_at > now - timedelta(minutes=grace_min):
+            continue  # USDT 待确认宽限期
         o.status = 2
+        closed += 1
     await db.commit()
-    return {"closed": len(rows)}
+    return {"closed": closed}
+
+
+# ---------- USDT 链上自动对账 ----------
+
+async def poll_usdt_deposits(db: AsyncSession) -> dict:
+    """USDT 自动对账：轮询收款地址的 TRC20 流水，四要素匹配后幂等入账。
+
+    匹配条件：to=收款地址 + 金额(含尾差)精确相等 + 转账时间在订单有效期内
+    + 交易已固化（only_confirmed，波场固化块即已被 ≥19 个 SR 确认）。
+    入账走 payment_service.settle_order（tx_hash 写 third_trade_no，唯一索引幂等）。
+    双 worker 会同时跑本任务：settle_order 的行锁保证只有一方入账成功。
+    """
+    from app.services import payment_service
+
+    cfg = (biz_config.get("recharge") or {}).get("usdt") or {}
+    address = cfg.get("address") or ""
+    if not address:
+        return {}
+    expire_min = int(cfg.get("order_expire_min", 30))
+    now = datetime.now()
+
+    # 有效期内的待支付 USDT 订单
+    orders = (await db.execute(
+        select(RechargeOrder).where(
+            RechargeOrder.pay_method == 3,
+            RechargeOrder.status == 0,
+            RechargeOrder.created_at >= now - timedelta(minutes=expire_min),
+        )
+    )).scalars().all()
+    if not orders:
+        return {}
+
+    min_ts = int(min(o.created_at for o in orders).timestamp() * 1000)
+    headers = {"TRON-PRO-API-KEY": settings.tron_api_key} if settings.tron_api_key else {}
+    async with httpx.AsyncClient(timeout=20) as client:
+        resp = await client.get(
+            f"https://api.trongrid.io/v1/accounts/{address}/transactions/trc20",
+            params={
+                "only_to": "true",            # 只要转入
+                "only_confirmed": "true",     # 只要已固化（等价确认数≥19）
+                "contract_address": USDT_CONTRACT,
+                "min_timestamp": min_ts,
+                "limit": 200,
+            },
+            headers=headers,
+        )
+        resp.raise_for_status()
+        txs = resp.json().get("data") or []
+
+    matched = 0
+    used_txs: set[str] = set()  # 同一笔流水只允许命中一个订单（防同金额订单重复入账）
+    # 先快照订单关键字段：settle_order 失败时 rollback 会让 ORM 对象过期，
+    # 继续遍历原对象会触发异步懒加载错误
+    snapshots = [
+        (o.order_no, o.usdt_amount, o.created_at)
+        for o in orders if o.usdt_amount is not None
+    ]
+    for order_no, usdt_amount, created_at in snapshots:
+        start_ms = created_at.timestamp() * 1000
+        end_ms = (created_at + timedelta(minutes=expire_min)).timestamp() * 1000
+        for tx in txs:
+            tx_hash = tx.get("transaction_id") or ""
+            if not tx_hash or tx_hash in used_txs:
+                continue
+            if tx.get("to") != address:
+                continue
+            # USDT 6 位小数：链上整数 → Decimal 精确比对（含随机尾差）
+            if Decimal(tx.get("value") or "0") / Decimal(1_000_000) != usdt_amount:
+                continue
+            ts = int(tx.get("block_timestamp") or 0)
+            if not (start_ms <= ts <= end_ms):
+                continue
+            try:
+                await payment_service.settle_order(db, order_no, tx_hash)
+                used_txs.add(tx_hash)
+                matched += 1
+                logger.info("USDT 订单 %s 自动到账: tx=%s amount=%s",
+                            order_no, tx_hash, usdt_amount)
+            except Exception:
+                await db.rollback()
+                logger.exception("USDT 订单 %s 入账失败", order_no)
+            break
+    return {"usdt_orders": len(snapshots), "matched": matched} if matched else {}
 
 
 # ---------- 周期协程（lifespan 挂载） ----------
@@ -163,4 +262,5 @@ def start_periodic_tasks() -> list[asyncio.Task]:
         asyncio.create_task(_run_loop("推荐激活结算", settle_referral_activations, INTERVAL_REFERRAL)),
         asyncio.create_task(_run_loop("创作收益结算", settle_video_earnings, INTERVAL_EARNINGS)),
         asyncio.create_task(_run_loop("订单超时关单", close_expired_orders, INTERVAL_ORDER_CLOSE)),
+        asyncio.create_task(_run_loop("USDT 链上对账", poll_usdt_deposits, INTERVAL_USDT_POLL)),
     ]