fix: 添加用户取消订单 + 管理员手动退款端点

src/handlers/admin.rs

@@ -81,7 +81,6 @@ pub async fn admin_force_confirm_order(
     let order_no = path.into_inner();
     tracing::info!("管理员强制确认订单: {}", order_no);
 
-    // 验证当前用户是否为管理员
     let current_user = db::get_user_by_id(pool.get_ref(), claims.user_id).await?;
     if !current_user.is_admin {
         return Err(AppError::Forbidden("无权限执行此操作".to_string()));
@@ -97,3 +96,27 @@ pub async fn admin_force_confirm_order(
         }
     })))
 }
+
+/// POST /api/admin/orders/{order_no}/refund
+/// 管理员手动退款（标记订单 + 重新计算会员）
+#[post("/api/admin/orders/{order_no}/refund")]
+pub async fn admin_refund_order(
+    path: web::Path<String>,
+    pool: web::Data<PgPool>,
+    claims: web::ReqData<Claims>,
+) -> Result<HttpResponse, AppError> {
+    let order_no = path.into_inner();
+    tracing::info!("管理员退款订单: {}", order_no);
+
+    let current_user = db::get_user_by_id(pool.get_ref(), claims.user_id).await?;
+    if !current_user.is_admin {
+        return Err(AppError::Forbidden("无权限执行此操作".to_string()));
+    }
+
+    db::admin_refund_order(pool.get_ref(), &order_no, claims.user_id).await?;
+
+    Ok(HttpResponse::Ok().json(serde_json::json!({
+        "success": true,
+        "message": "订单已退款"
+    })))
+}

src/handlers/mod.rs

@@ -19,6 +19,7 @@ pub static TEMPLATES_DIR: Dir = include_dir!("$CARGO_MANIFEST_DIR/templates");
 pub use admin::admin_get_user;
 pub use admin::admin_update_user_payment;
 pub use admin::admin_force_confirm_order;
+pub use admin::admin_refund_order;
 pub use auth::login;
 pub use auth::mock_login;
 pub use auth::refresh_token;
@@ -40,6 +41,7 @@ pub use weather::post_weather_data;
 pub use payment::alipay_notify;
 pub use payment::alipay_pay_page;
 pub use payment::alipay_refund_notify;
+pub use payment::cancel_order;
 pub use payment::create_order;
 pub use payment::generate_code;
 pub use payment::get_user_quota;

src/handlers/payment.rs

@@ -1003,6 +1003,25 @@ pub async fn sync_order(
     })))
 }
 
+/// POST /api/payment/cancel-order — 用户主动取消待支付订单
+#[derive(Debug, Deserialize)]
+pub struct CancelOrderRequest {
+    pub order_id: String,
+}
+
+#[post("/api/payment/cancel-order")]
+pub async fn cancel_order(
+    pool: web::Data<PgPool>,
+    claims: web::ReqData<Claims>,
+    body: web::Json<CancelOrderRequest>,
+) -> Result<HttpResponse, AppError> {
+    db::cancel_payment_order(pool.get_ref(), &body.order_id, claims.user_id).await?;
+    Ok(HttpResponse::Ok().json(serde_json::json!({
+        "success": true,
+        "message": "订单已取消"
+    })))
+}
+
 /// GET /api/payment/orders — 获取当前用户的订单记录
 #[get("/api/payment/orders")]
 pub async fn get_user_orders(