feat(payment): 接入支付宝沙箱环境 (alipay.trade.page.pay)

src/db.rs

@@ -392,6 +392,49 @@ pub async fn confirm_payment_order(
     Ok(expires_at)
 }
 
+/// 确认订单支付（支付宝异步回调用，通过 order_no 查找，不校验 user_id）
+pub async fn confirm_payment_order_by_orderno(
+    pool: &PgPool,
+    order_no: &str,
+) -> Result<(), AppError> {
+    let row = sqlx::query_as::<_, (i32, String, Option<chrono::DateTime<chrono::Utc>>)>(
+        r#"SELECT user_id, status, expires_at FROM payment_orders WHERE order_no = $1"#,
+    )
+    .bind(order_no)
+    .fetch_optional(pool)
+    .await
+    .map_err(|e| AppError::Database(format!("查询订单失败: {}", e)))?;
+
+    let (user_id, status, expires_at) = match row {
+        Some(r) => r,
+        None => return Err(AppError::NotFound("订单不存在".to_string())),
+    };
+
+    if status != "pending" {
+        // 已支付直接返回成功（幂等）
+        return Ok(());
+    }
+
+    let mut tx = pool.begin().await.map_err(|e| AppError::Database(e.to_string()))?;
+
+    sqlx::query(r#"UPDATE payment_orders SET status = 'paid', paid_at = NOW() WHERE order_no = $1"#)
+        .bind(order_no)
+        .execute(&mut *tx)
+        .await
+        .map_err(|e| AppError::Database(format!("更新订单状态失败: {}", e)))?;
+
+    sqlx::query(r#"UPDATE users SET is_paid = true, paid_expires_at = $1 WHERE id = $2"#)
+        .bind(expires_at)
+        .bind(user_id)
+        .execute(&mut *tx)
+        .await
+        .map_err(|e| AppError::Database(format!("更新用户付费状态失败: {}", e)))?;
+
+    tx.commit().await.map_err(|e| AppError::Database(e.to_string()))?;
+
+    Ok(())
+}
+
 /// 获取用户配额信息
 ///
 /// 返回 (已用条数, 是否付费活跃, 到期时间)