aps撤销订单 订单校验

src/main/java/au/com/royalpay/payment/manage/merchants/web/PartnerViewController.java

@@ -4,6 +4,7 @@ import au.com.royalpay.payment.core.cancelorder.service.CancelOrderService;
 import au.com.royalpay.payment.core.cancelorder.service.impl.CancelOrderServiceImpl;
 import au.com.royalpay.payment.core.exceptions.ParamInvalidException;
 import au.com.royalpay.payment.manage.kyc.core.KycService;
+import au.com.royalpay.payment.manage.mappers.payment.OrderMapper;
 import au.com.royalpay.payment.manage.mappers.system.ClientComplianceCompanyMapper;
 import au.com.royalpay.payment.manage.merchants.beans.ClientAuthFilesInfo;
 import au.com.royalpay.payment.manage.merchants.beans.ClientRegisterInfo;
@@ -33,6 +34,7 @@ import com.alibaba.fastjson.JSONObject;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
+import org.springframework.util.Assert;
 import org.springframework.validation.Errors;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
@@ -70,6 +72,9 @@ public class PartnerViewController {
     @Resource
     private CancelOrderService cancelOrderService;
 
+    @Resource
+    private OrderMapper orderMapper;
+
     @RequestMapping(method = RequestMethod.GET)
     @RequirePartner
     @ResponseBody
@@ -689,7 +694,16 @@ public class PartnerViewController {
     @RequirePartner
     public JSONObject cancel(@ModelAttribute(CommonConsts.PARTNER_STATUS) JSONObject account, @RequestBody JSONObject order, Errors errors) {
         System.out.println("=====>cancel_order");
+         order = orderMapper.getOrderDetail(order.getString("orderId"));
+        Assert.notNull(order, "Order Not Exists!");
+        int clientId = order.getIntValue("client_id");
+        JSONObject client = clientManager.getClientInfo(clientId);
+        int accountClientId = account.getIntValue("client_id");
+        Assert.isTrue(accountClientId == client.getIntValue("client_id") || accountClientId == client.getIntValue("parent_client_id")
+                        || clientManager.listLevel3Client(accountClientId).contains(client.getIntValue("parent_client_id")),
+                "This order is not belong to current merchant");
+
         //暂时未给运营端使用，仅商户端使用
-        return cancelOrderService.cancelOrderOrNot(order.getString("orderId"),account.getIntValue("client_id"));
+        return cancelOrderService.cancelOrderOrNot(order.getString("order_id"));
     }
 }

src/main/ui/static/payment/tradelog/templates/partner_trade_logs.html

@@ -779,7 +779,7 @@
                                             <i class="fa fa-undo"></i>
                                         </a>
                                         <a role="button"
-                                           ng-if="trade.is_today&&(trade.channel=='ApsInStore'||trade.channel=='ApsCashier') && trade.status==5 && trade.confirm_time!=null && trade.clearing_status<2 && trade.client_id==currentUser.client_id && currentUser.client.enable_refund"
+                                           ng-if="trade.is_today&&(trade.channel=='ApsInStore'||trade.channel=='ApsCashier') && trade.status==5 && trade.confirm_time!=null && trade.clearing_status<2 && currentUser.client.enable_refund"
                                            class="text-bold text-danger" ng-click="cancelOrder(trade.order_id)"
                                            title="Cancel">
                                             <i class="fa fa-close"></i>