diff --git a/internal/service/user/address_share.go b/internal/service/user/address_share.go index 987a4df..4405f2e 100755 --- a/internal/service/user/address_share.go +++ b/internal/service/user/address_share.go @@ -569,16 +569,6 @@ func (s *service) RedeemInventoryToPoints(ctx context.Context, userID int64, inv return 0, err } - // 校验转赠来源:通过转赠获得的资产不允许兑换积分(防薅积分漏洞) - // 使用写库查询,避免主从延迟导致校验被绕过 - var transferCnt int64 - if err := s.repo.GetDbW().Raw("SELECT COUNT(*) FROM user_inventory_transfers WHERE inventory_id = ? AND to_user_id = ?", inventoryID, userID).Scan(&transferCnt).Error; err != nil { - return 0, err - } - if transferCnt > 0 { - return 0, fmt.Errorf("transfer_inventory_cannot_redeem") - } - valueCents := inv.ValueCents valueSource := inv.ValueSource valueSnapshotAt := inv.ValueSnapshotAt @@ -659,31 +649,6 @@ func (s *service) RedeemInventoriesToPoints(ctx context.Context, userID int64, i return 0, fmt.Errorf("no_valid_inventory") } - // 3.5 排除通过转赠获得的资产(防薅积分漏洞) - // 使用写库查询,避免主从延迟导致校验被绕过 - invIDs := make([]int64, 0, len(invList)) - for _, inv := range invList { - invIDs = append(invIDs, inv.ID) - } - var transferredInvs []*model.UserInventoryTransfers - if err := s.repo.GetDbW().Raw("SELECT * FROM user_inventory_transfers WHERE inventory_id IN ? AND to_user_id = ?", invIDs, userID).Scan(&transferredInvs).Error; err != nil { - return 0, err - } - transferredSet := make(map[int64]struct{}, len(transferredInvs)) - for _, t := range transferredInvs { - transferredSet[t.InventoryID] = struct{}{} - } - filteredInvList := make([]*model.UserInventory, 0, len(invList)) - for _, inv := range invList { - if _, isTransferred := transferredSet[inv.ID]; !isTransferred { - filteredInvList = append(filteredInvList, inv) - } - } - if len(filteredInvList) == 0 { - return 0, fmt.Errorf("transfer_inventory_cannot_redeem") - } - invList = filteredInvList - // 4. 按资产快照计算总积分,缺失快照时回退商品价格并回写 productIDs := make([]int64, 0, len(invList)) productIDSet := make(map[int64]struct{})