fix(health): 穷尽审计修复 — 3 CRITICAL + 3 HIGH + 2 MEDIUM
Some checks failed
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled

CRITICAL:
- earn_points 日上限检查用 patient_id 比对 account_id 字段,上限永远不会触发
- verify_order 用 check_version(v, v) 旁路乐观锁,并发核销可能重复
- admin_checkin_event 同样的乐观锁旁路

HIGH:
- FIFO 消费循环改用数据库级 CAS 替代应用层 update_many
- 兑换流程账户余额/库存扣减全部改用 CAS 防并发超卖
- verify_order 改用 update_many + version filter 的原子操作

MEDIUM:
- points_checkin entity 补全 updated_at/updated_by/deleted_at/version 字段
- 新增迁移 m20260425_000055 添加列
- daily_checkin 打卡记录+积分获取+阶梯奖励合并为同一事务
- 删除废弃的 check_streak_bonus 独立函数(被 check_streak_bonus_in_txn 替代)
This commit is contained in:
iven
2026-04-25 19:44:46 +08:00
parent 17085a3e61
commit e8a794ff69
4 changed files with 187 additions and 34 deletions

View File

@@ -11,6 +11,11 @@ pub struct Model {
pub checkin_date: chrono::NaiveDate,
pub consecutive_days: i32,
pub created_at: DateTimeUtc,
pub updated_at: DateTimeUtc,
pub created_by: Option<Uuid>,
pub updated_by: Option<Uuid>,
pub deleted_at: Option<DateTimeUtc>,
pub version: i32,
}
#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]