Files
sub2api/backend/internal/service/batch_image_billing_hold.go
T
shaw 80a229bce5 fix(batch-image): 修复审计发现的计费死锁、状态机与队列原子性缺陷
修复 PR #3768 批量图像 MVP 合并后审计报告中的全部问题:

结算与计费(高危):
- 所有 SETTLEMENT_* 失败(超冻结/计数非法/manifest 冲突/定价缺失/扣费失败)
  统一计入 retry_count 并在耗尽时释放冻结转 failed,消灭 settling 无限
  requeue 导致的冻结余额永久锁死
- 耗尽出口的释放指纹统一为 RequestHash,与 processor/Cancel/recovery 一致;
  release 遇同 request id 指纹冲突视为幂等成功,治愈历史毒消息
- 管理端校验 hold_multiplier >= discount_multiplier,定价快照对存量脏数据钳制
- 释放前校验 per-job hold claim(dedup+归档表),杜绝幻影释放

索引对账(高危):
- provider 输出与提交 custom_id 集对账:未知条目丢弃并记事件,
  漏项补 PROVIDER_RESULT_MISSING 失败行,保证 success+fail == item_count

提交与恢复(高危):
- 提交前转 uploading 并在 provider.Submit 期间心跳刷新 updated_at;
  恢复扫描改为原子复核(FailStaleUnsubmittedBatchImageJob),
  消灭慢提交被误杀退款而上游任务照常计费的孤儿场景
- 上游任务创建成功但本地状态推进失败时,尽力取消上游并清理输入
- recovery 释放失败时入队交由 worker releaseTerminalHold 兜底重试

队列与并发(中危):
- Enqueue(SetNX+LPush)与 Reserve(BRPop+ZAdd)均改为 Lua 原子脚本,
  消灭崩溃窗口导致 job 脱离队列、被 7 天 inflight 键锁死
- 锁冲突按 LockConflictDelay 重新入队(原直接丢弃需等 10 分钟 stale 恢复)
- 处理期间心跳:active zset 续期(ZAddXX 防幽灵成员)+ 锁 TTL 续期
- ReplaceBatchImageItemsForJob 增加 indexing 状态守卫,防掉队 worker 重写账目

存量回归(中危):
- image-only 定价条目(仅图片价无 token 价)恢复 token 计费 fail-closed,
  不再按 $0 计费;图片计费路径不受影响
- 鉴权余额门槛恢复 balance <= 0 语义,MinimumBalanceReserve 不再作硬 403

加固:
- ZIP max_items 钳制到管理员上限;Submit 补齐 Platform==Gemini 校验;
  gemini downloadUri 跟随前做 host 白名单校验
- 批量客户端改用共享 httpclient(拨号/TLS/响应头超时有界)
- 审计点名的忽略错误(MarkDownloaded/SettlementFailed/AppendEvent 等)改为记日志
2026-07-07 18:53:56 +08:00

117 lines
3.7 KiB
Go

package service
import (
"context"
"errors"
"strings"
"github.com/Wei-Shaw/sub2api/internal/pkg/logger"
"go.uber.org/zap"
)
const (
batchImageHoldRequestPrefix = "batch_image_hold:"
batchImageCaptureRequestPrefix = "batch_image_capture:"
batchImageReleaseRequestPrefix = "batch_image_release:"
)
func BatchImageHoldRequestID(batchID string) string {
return batchImageHoldRequestPrefix + strings.TrimSpace(batchID)
}
func BatchImageCaptureRequestID(batchID string) string {
return batchImageCaptureRequestPrefix + strings.TrimSpace(batchID)
}
func BatchImageReleaseRequestID(batchID string) string {
return batchImageReleaseRequestPrefix + strings.TrimSpace(batchID)
}
func buildBatchImageHoldCommand(job *BatchImageJob, requestID string, actualAmount float64, payloadHash string) (*BatchImageBalanceHoldCommand, error) {
if job == nil {
return nil, ErrBatchImageBillingHoldFailed
}
if job.APIKeyID == nil || *job.APIKeyID <= 0 {
return nil, ErrBatchImageSettlementMissingAPIKeyID
}
holdAmount := job.EstimatedCost
if job.HoldAmount != nil {
holdAmount = *job.HoldAmount
}
if holdAmount < 0 {
holdAmount = 0
}
if actualAmount < 0 {
actualAmount = 0
}
return &BatchImageBalanceHoldCommand{
RequestID: requestID,
APIKeyID: *job.APIKeyID,
UserID: job.UserID,
BatchID: job.BatchID,
HoldAmount: holdAmount,
ActualAmount: actualAmount,
RequestPayloadHash: strings.TrimSpace(payloadHash),
}, nil
}
func reserveBatchImageBalanceHold(ctx context.Context, repo UsageBillingRepository, job *BatchImageJob, payloadHash string) error {
if repo == nil {
return ErrBatchImageBillingHoldFailed.WithCause(errors.New("batch image billing repository is not configured"))
}
cmd, err := buildBatchImageHoldCommand(job, BatchImageHoldRequestID(job.BatchID), 0, payloadHash)
if err != nil {
return err
}
if cmd.HoldAmount <= 0 {
return nil
}
if _, err := repo.ReserveBatchImageBalance(ctx, cmd); err != nil {
if errors.Is(err, ErrBatchImageInsufficientBalance) {
return ErrBatchImageInsufficientBalance
}
return ErrBatchImageBillingHoldFailed.WithCause(err)
}
return nil
}
func captureBatchImageBalanceHold(ctx context.Context, repo UsageBillingRepository, job *BatchImageJob, actualAmount float64, payloadHash string) error {
if repo == nil {
return ErrBatchImageSettlementBillingFailed.WithCause(errors.New("batch image billing repository is not configured"))
}
cmd, err := buildBatchImageHoldCommand(job, BatchImageCaptureRequestID(job.BatchID), actualAmount, payloadHash)
if err != nil {
return err
}
if _, err := repo.CaptureBatchImageBalance(ctx, cmd); err != nil {
return ErrBatchImageSettlementBillingFailed.WithCause(err)
}
return nil
}
func releaseBatchImageBalanceHold(ctx context.Context, repo UsageBillingRepository, job *BatchImageJob, payloadHash string) error {
if repo == nil || job == nil {
return nil
}
cmd, err := buildBatchImageHoldCommand(job, BatchImageReleaseRequestID(job.BatchID), 0, payloadHash)
if err != nil {
return err
}
if cmd.HoldAmount <= 0 {
return nil
}
if _, err := repo.ReleaseBatchImageBalance(ctx, cmd); err != nil {
// 同一 release request id 出现指纹冲突,说明此前已有一次携带不同
// payloadHash 的释放成功提交(资金已归还)。视为幂等成功,
// 避免历史指纹不一致的 job 永远卡在释放失败的毒消息循环里。
if errors.Is(err, ErrUsageBillingRequestConflict) {
logger.L().Warn("batch_image.release_fingerprint_conflict_treated_as_released",
zap.String("batch_id", job.BatchID),
)
return nil
}
return ErrBatchImageBillingHoldFailed.WithCause(err)
}
return nil
}