fix: sync-order仅查询状态不确认订单(防止误激活)

src/handlers/payment.rs

@@ -980,7 +980,7 @@ pub async fn mock_confirm(
 
 /// POST /api/payment/sync-order — 根据订单号强制同步会员状态
 ///
-/// 用户支付完成后，若前端会员状态未刷新，可调用此接口同步确认订单并获取最新状态。
+/// 查询订单和会员的当前最新状态（不执行确认操作，仅查询）
 #[post("/api/payment/sync-order")]
 pub async fn sync_order(
     pool: web::Data<PgPool>,
@@ -990,12 +990,18 @@ pub async fn sync_order(
     check_payment_maintenance()?;
     let user_id = claims.user_id;
 
-    // 尝试确认订单（幂等），失败时记录日志
-    if let Err(e) = db::confirm_payment_order(pool.get_ref(), &body.order_id, user_id).await {
-        tracing::warn!("确认订单失败（可能已被异步回调处理）: {}", e);
-    }
+    // 查询订单当前状态（不执行确认，防止误确认未支付订单）
+    let order_status: Option<String> = sqlx::query_scalar(
+        r#"SELECT status FROM payment_orders WHERE order_no = $1 AND user_id = $2"#,
+    )
+    .bind(&body.order_id)
+    .bind(user_id)
+    .fetch_optional(pool.get_ref())
+    .await
+    .map_err(|e| AppError::Database(format!("查询订单失败: {}", e)))?
+    .unwrap_or_default();
 
-    // 查询最新状态
+    // 查询会员最新状态
     let user = sqlx::query_as::<_, (bool, Option<chrono::DateTime<chrono::Utc>>)>(
         r#"SELECT is_paid, paid_expires_at FROM users WHERE id = $1"#,
     )
@@ -1011,6 +1017,7 @@ pub async fn sync_order(
     Ok(HttpResponse::Ok().json(serde_json::json!({
         "success": true,
         "data": {
+            "order_status": order_status,
             "is_paid": is_paid,
             "is_paid_active": is_paid_active,
             "paid_expires_at": paid_expires_at,