支付基础设施与风险分析

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43import { psp, db, ledger } from './infra';/** * One charge, end to end. Every step here exists because of a specific way * payments fail in production — not because the SDK's README suggested it. */export async function charge(order: Order, idemKey: string) {  // Idempotency first. Networks time out, clients retry, and a retry must  // never become a second charge on someone's card.  const prior = await db.payment.findUnique({ where: { idemKey } });  if (prior) return prior;  // Reserve in our own ledger BEFORE calling the provider, so a crash between  // the two leaves a pending row to reconcile rather than money we cannot see.  const pending = await ledger.reserve({    orderId: order.id,    amountMinor: order.totalMinor,    currency: order.currency,    idemKey,  });  // Pass our key through so the provider deduplicates on its side too. Two  // independent guards, because either one alone has a window.  const intent = await psp.charges.create(    {      amountMinor: order.totalMinor,      currency: order.currency,      method: order.paymentMethodId,    },    { idempotencyKey: idemKey }  );  // Settle from the provider's answer, never from our assumption about it.  // "Requires action" is strong customer authentication, which means not  // finished — a different thing entirely from failed.  if (intent.status === 'requires_action') {    return ledger.hold(pending.id, intent.clientSecret);  }  return intent.status === 'succeeded'    ? ledger.settle(pending.id, intent.id)    : ledger.fail(pending.id, intent.lastError?.code);}