fix(user): 注销账号前置校验资金余额 + 释放微信/邀请码唯一约束

- delete_account 端点: 有可提现现金余额 / 在审提现单(reviewing)时拒绝注销(409), 防余额锁死在 deleted 行无法退出; pending 提现已在途不拦(对账 worker 不依赖 user.status)
- soft_delete_account: 注销连带清 wechat_openid/nickname/avatar(释放微信绑定槽, 否则该微信永久无法再被任何账号绑定→提现通道锁死) + invite_code(释放邀请码唯一槽)
- wallet 新增 get_cash_balance_cents(只读, 不建账户) 供注销前置校验; 复用 has_reviewing_withdraw
- 新增 tests/test_delete_account.py

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/admin/main.py

@@ -14,6 +14,7 @@ from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
 from app.admin.routers.ad_audit import router as ad_audit_router
+from app.admin.routers.ad_config import router as ad_config_router
 from app.admin.routers.ad_revenue import router as ad_revenue_router
 from app.admin.routers.admins import router as admins_router
 from app.admin.routers.audit import router as audit_router
@@ -95,4 +96,5 @@ admin_app.include_router(config_router)
 admin_app.include_router(comparison_router)
 admin_app.include_router(cps_router)
 admin_app.include_router(ad_audit_router)
+admin_app.include_router(ad_config_router)
 admin_app.include_router(ad_revenue_router)

app/admin/routers/ad_config.py

@@ -0,0 +1,45 @@
+"""admin 广告配置:读/写穿山甲 app_id / 各场景广告位ID / 验签密钥 / 各场景开关。
+
+存在 app_config 表的 ad_config dict(见 repositories/app_config.get_ad_config/set_ad_config)。
+客户端经 /api/v1/platform/ad-config 拉取(不含 reward_mkey)。权限 operator/finance + 审计。
+"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.schemas.ad_config import AdConfigOut, AdConfigUpdate
+from app.models.admin import AdminUser
+from app.repositories import app_config
+
+router = APIRouter(
+    prefix="/admin/api/ad-config",
+    tags=["admin-ad-config"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("", response_model=AdConfigOut, summary="广告配置(穿山甲ID/验签密钥/各场景开关)")
+def get_ad_config(db: AdminDb) -> AdConfigOut:
+    return AdConfigOut(**app_config.get_ad_config(db))
+
+
+@router.patch("", response_model=AdConfigOut, summary="改广告配置(部分更新,带审计)")
+def update_ad_config(
+    body: AdConfigUpdate,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator", "finance"))],
+    db: AdminDb,
+) -> AdConfigOut:
+    data = body.model_dump(exclude_none=True)
+    app_config.set_ad_config(db, data, admin_id=admin.id, commit=False)
+    # 审计只记改了哪些字段,不记 mkey 明文(机密)
+    write_audit(
+        db, admin, action="ad_config.set", target_type="ad_config", target_id="ad_config",
+        detail={"changed": sorted(data.keys())}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return AdConfigOut(**app_config.get_ad_config(db))

app/admin/schemas/ad_config.py

@@ -0,0 +1,30 @@
+"""admin 广告配置 schemas(穿山甲 app_id/各位ID/验签密钥/各场景开关)。"""
+from __future__ import annotations
+
+from pydantic import BaseModel
+
+
+class AdConfigOut(BaseModel):
+    """admin 读到的完整广告配置(含 reward_mkey;admin 有权见,但绝不经 /platform 下发客户端)。"""
+
+    app_id: str
+    reward_code_id: str
+    compare_feed_code_id: str
+    coupon_feed_code_id: str
+    reward_mkey: str
+    reward_enabled: bool
+    compare_ad_enabled: bool
+    coupon_ad_enabled: bool
+
+
+class AdConfigUpdate(BaseModel):
+    """部分更新:只改传入(非 None)字段。空串是合法值(如清空 mkey 回退 .env)。"""
+
+    app_id: str | None = None
+    reward_code_id: str | None = None
+    compare_feed_code_id: str | None = None
+    coupon_feed_code_id: str | None = None
+    reward_mkey: str | None = None
+    reward_enabled: bool | None = None
+    compare_ad_enabled: bool | None = None
+    coupon_ad_enabled: bool | None = None

app/api/v1/ad.py

@@ -24,6 +24,7 @@ from app.repositories import ad_ecpm as crud_ecpm
 from app.repositories import ad_feed_reward as crud_feed
 from app.repositories import ad_reward as crud_ad
 from app.repositories import ad_watch as crud_watch
+from app.repositories import app_config
 from app.repositories import signin as crud_signin
 from app.schemas.ad import (
     AdRewardStatusOut,
@@ -80,14 +81,22 @@ def pangle_callback(request: Request, db: DbSession) -> PangleCallbackOut:
     验签失败 403(留给真请求重试);参数缺/坏或 user 不存在 → is_verify=false + reason(不发,不重试)。
     granted / capped → is_verify=true + reason=0。
     """
-    if not settings.pangle_callback_configured:
+    if not settings.PANGLE_CALLBACK_ENABLED:
         raise HTTPException(
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail="pangle callback not configured"
         )
 
     params = dict(request.query_params)
 
-    if not pangle.verify_callback_sign_any(params, settings.pangle_reward_secrets):
+    # 验签密钥:admin 后台配的 reward_mkey 优先,.env 的 PANGLE_REWARD_SECRET* 兜底(兼容/过渡)。
+    # 换激励位时后台同步换 mkey 即可,无需改 .env。两者都空才视为未配置。
+    ad_mkey = app_config.get_ad_config(db).get("reward_mkey") or ""
+    secrets = ([ad_mkey] if ad_mkey else []) + settings.pangle_reward_secrets
+    if not secrets:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail="pangle callback not configured"
+        )
+    if not pangle.verify_callback_sign_any(params, secrets):
         logger.warning("pangle callback bad sign trans_id=%s", params.get("trans_id"))
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="bad sign")
 

app/api/v1/platform.py

@@ -17,6 +17,7 @@ from app.repositories import app_config
 from app.repositories import ops_marquee as marquee_crud
 from app.repositories import ops_stat as crud
 from app.schemas.platform import (
+    AdConfigPublicOut,
     AppFlagsOut,
     AppVersionOut,
     PlatformStatsOut,
@@ -54,6 +55,22 @@ def flags(db: DbSession) -> AppFlagsOut:
     )
 
 
+@router.get("/ad-config", response_model=AdConfigPublicOut, summary="客户端拉广告配置(穿山甲ID+场景开关,不鉴权)")
+def ad_config(db: DbSession) -> AdConfigPublicOut:
+    """客户端启动/每场广告前拉,缓存后用:app_id + 各位ID + 各场景开关。
+    不含验签密钥;空库回退默认(=客户端内置值,维持现状)。"""
+    c = app_config.get_ad_config(db)
+    return AdConfigPublicOut(
+        app_id=c["app_id"],
+        reward_code_id=c["reward_code_id"],
+        compare_feed_code_id=c["compare_feed_code_id"],
+        coupon_feed_code_id=c["coupon_feed_code_id"],
+        reward_enabled=c["reward_enabled"],
+        compare_ad_enabled=c["compare_ad_enabled"],
+        coupon_ad_enabled=c["coupon_ad_enabled"],
+    )
+
+
 @router.get("/app-version", response_model=AppVersionOut, summary="最新 App 版本(OTA 检查更新,不鉴权)")
 def app_version(db: DbSession) -> AppVersionOut:
     """客户端启动 / 手动检查更新时拉取。不鉴权:版本信息非敏感,且检查更新可能在登录前。

app/api/v1/user.py

@@ -18,6 +18,7 @@ from app.api.deps import CurrentUser, DbSession
 from app.core import media
 from app.repositories import onboarding as onboarding_repo
 from app.repositories import user as user_repo
+from app.repositories import wallet as wallet_repo
 from app.schemas.auth import UserOut
 from app.schemas.user import (
     OkResponse,
@@ -87,6 +88,17 @@ def onboarding_status(
 
 @router.delete("", response_model=OkResponse, summary="注销账号(软删除)")
 def delete_account(user: CurrentUser, db: DbSession) -> OkResponse:
+    # 资金前置校验:注销是软删 + 匿名化,余额一旦留在 deleted 行就锁死(既退不出、新号也
+    # 拿不回)。有可提现现金 / 在审提现单 → 拒绝注销,引导用户先把钱处理掉。
+    # (pending 提现转账已在途、对账 worker 不依赖 user.status 照常到账,故不拦 pending。)
+    if wallet_repo.get_cash_balance_cents(db, user.id) > 0:
+        raise HTTPException(
+            status_code=409, detail="账户还有未提现的现金余额,请先提现后再注销"
+        )
+    if wallet_repo.has_reviewing_withdraw(db, user.id):
+        raise HTTPException(
+            status_code=409, detail="有提现正在审核中,请等审核完成后再注销"
+        )
     media.delete_avatar(user.avatar_url)
     user_repo.soft_delete_account(db, user)
     logger.info("delete account user_id=%d", user.id)

app/repositories/app_config.py

@@ -91,3 +91,51 @@ def set_app_version(db: Session, data: dict, *, commit: bool = True) -> AppConfi
     else:
         db.flush()
     return row
+
+
+# ── 穿山甲广告配置(admin 可配,客户端动态拉)──────────────────────────────────
+# 同 app_version:结构化 dict,复用 AppConfig 表不进 CONFIG_DEFS(它是一组关联配置,不是散项)。
+# 默认值 = 客户端当前内置的硬编码 ID(AdConfig.kt),空库时下发默认 = 维持现状。
+# reward_mkey 是 GroMore S2S 验签密钥(机密),只后端验签用、绝不下发客户端(见 platform/ad-config)。
+AD_CONFIG_KEY = "ad_config"
+_AD_CONFIG_DEFAULTS: dict[str, Any] = {
+    "app_id": "5830519",                  # 穿山甲应用ID(正式)
+    "reward_code_id": "104099389",        # 福利页激励视频位
+    "compare_feed_code_id": "104090333",  # 比价信息流位
+    "coupon_feed_code_id": "104090333",   # 领券信息流位(初始同比价,运营可拆)
+    "reward_mkey": "",                    # 激励位 GroMore 验签密钥(空则回退 .env PANGLE_REWARD_SECRET*)
+    "reward_enabled": True,               # 福利激励视频开关
+    "compare_ad_enabled": True,           # 比价广告开关
+    "coupon_ad_enabled": True,            # 领券广告开关
+}
+
+
+def get_ad_config(db: Session) -> dict:
+    """读广告配置。DB 无则返回默认(=客户端内置值,维持现状);DB 有则与默认 merge
+    (新增字段向后兼容,老记录缺的字段用默认补)。"""
+    row = db.get(AppConfig, AD_CONFIG_KEY)
+    merged = dict(_AD_CONFIG_DEFAULTS)
+    if row is not None and isinstance(row.value, dict):
+        merged.update(row.value)
+    return merged
+
+
+def set_ad_config(db: Session, data: dict, *, admin_id: int, commit: bool = True) -> AppConfig:
+    """admin 写广告配置。与现有值 merge(部分更新),只接受已知字段(防脏键)。"""
+    row = db.get(AppConfig, AD_CONFIG_KEY)
+    merged = dict(_AD_CONFIG_DEFAULTS)
+    if row is not None and isinstance(row.value, dict):
+        merged.update(row.value)
+    merged.update({k: v for k, v in data.items() if k in _AD_CONFIG_DEFAULTS})
+    if row is None:
+        row = AppConfig(key=AD_CONFIG_KEY, value=merged, updated_by_admin_id=admin_id)
+        db.add(row)
+    else:
+        row.value = merged
+        row.updated_by_admin_id = admin_id
+    if commit:
+        db.commit()
+        db.refresh(row)
+    else:
+        db.flush()
+    return row

app/repositories/user.py

@@ -111,14 +111,27 @@ def set_avatar_url(db: Session, user: User, *, avatar_url: str) -> User:
 
 
 def soft_delete_account(db: Session, user: User) -> None:
-    """注销账号:软删除 + 匿名化。
+    """注销账号:软删除 + 匿名化 + 释放唯一约束/外部绑定。
 
-    把 phone 改成 `deleted_<id>` 释放唯一约束,允许同号码重新注册成全新账号;
+    把 phone 改成 `deleted_<id>` 释放手机号唯一约束,允许同号码重新注册成全新账号;
     清空 PII(昵称/头像),保留行用于审计。status=deleted 后将无法再登录该行
     (登录接口校验 status==active)。
+
+    ⚠️ 注销必须连同释放 user 上其余唯一约束/外部身份,否则 deleted 行永久占着槽位,
+    对应资源再也无法被复用:
+      - wechat_openid: 不清 → 这个微信再也无法被任何账号绑定(提现通道彻底锁死);
+      - invite_code:   不清 → 邀请码槽位被占 + 裸查仍命中死号(发奖已被 bind 的
+        status==active 校验兜住,清掉更干净)。
+    资金安全(未提现现金 / 在审提现单)由调用方 delete_account 端点前置校验,这里只匿名化。
     """
     user.status = "deleted"
     user.phone = f"deleted_{user.id}"
     user.nickname = None
     user.avatar_url = None
+    # 等价"解绑微信":释放 openid 唯一槽 + 清微信昵称头像
+    user.wechat_openid = None
+    user.wechat_nickname = None
+    user.wechat_avatar_url = None
+    # 释放邀请码唯一槽
+    user.invite_code = None
     db.commit()

app/repositories/wallet.py

@@ -340,6 +340,15 @@ def bind_wechat_openid(db: Session, user_id: int, code: str) -> dict:
     return info
 
 
+def get_cash_balance_cents(db: Session, user_id: int) -> int:
+    """只读查现金余额(分)。账户不存在返回 0,**不创建账户**——注销前置校验用,
+    不该给一个即将被删除的用户凭空建一行空账户(get_or_create_account 会建)。"""
+    val = db.execute(
+        select(CoinAccount.cash_balance_cents).where(CoinAccount.user_id == user_id)
+    ).scalar_one_or_none()
+    return val or 0
+
+
 def has_reviewing_withdraw(db: Session, user_id: int) -> bool:
     """用户是否有「待审核(reviewing)」的提现单。
 

app/schemas/platform.py

@@ -30,6 +30,21 @@ class AppFlagsOut(BaseModel):
     comparing_ad_enabled: bool  # 比价/领券期是否展示信息流广告(远程 kill-switch)
 
 
+class AdConfigPublicOut(BaseModel):
+    """下发给客户端的穿山甲广告配置(不鉴权,客户端缓存后用)。
+
+    ⚠️ 不含 reward_mkey(GroMore 验签密钥,机密,只后端验签用,绝不下发)。
+    """
+
+    app_id: str  # 穿山甲应用ID(改了客户端需冷启才生效,SDK init 一次性读)
+    reward_code_id: str  # 福利页激励视频位
+    compare_feed_code_id: str  # 比价信息流位
+    coupon_feed_code_id: str  # 领券信息流位
+    reward_enabled: bool  # 福利激励视频开关
+    compare_ad_enabled: bool  # 比价广告开关
+    coupon_ad_enabled: bool  # 领券广告开关
+
+
 class AppVersionOut(BaseModel):
     """最新 App 版本信息(OTA 检查更新,不鉴权)。
 

tests/test_delete_account.py

@@ -0,0 +1,141 @@
+"""注销账号(DELETE /api/v1/user):软删 + 释放唯一约束 + 资金前置校验。
+
+覆盖:
+  - 干净注销:status=deleted + phone 匿名化 + wechat_openid/invite_code 等唯一槽全部释放
+  - 回归原始 bug:注销释放 openid 后,别的账号能绑同一个微信
+  - 资金前置闸:有可提现现金 / 在审提现单 → 409 拒绝注销,账号不被删
+  - 注销后旧 token 即时失效(status==active 闸)
+"""
+from __future__ import annotations
+
+from sqlalchemy import select
+
+from app.db.session import SessionLocal
+from app.models.user import User
+from app.models.wallet import CoinAccount
+
+
+def _login(client, phone: str) -> str:
+    client.post("/api/v1/auth/sms/send", json={"phone": phone})
+    r = client.post("/api/v1/auth/sms/login", json={"phone": phone, "code": "123456"})
+    assert r.status_code == 200, r.text
+    return r.json()["access_token"]
+
+
+def _auth(token: str) -> dict[str, str]:
+    return {"Authorization": f"Bearer {token}"}
+
+
+def _patch_userinfo(monkeypatch, openid: str) -> None:
+    monkeypatch.setattr(
+        "app.integrations.wxpay.code_to_userinfo",
+        lambda code: {"openid": openid, "nickname": "微信昵称", "avatar_url": "https://x/a.png", "raw": {}},
+    )
+
+
+def _seed_cash(client, token: str, phone: str, cents: int) -> None:
+    """先访问 /account 触发建账户,再用 DB 直接灌现金余额。"""
+    client.get("/api/v1/wallet/account", headers=_auth(token))
+    db = SessionLocal()
+    try:
+        user = db.execute(select(User).where(User.phone == phone)).scalar_one()
+        acc = db.get(CoinAccount, user.id)
+        acc.cash_balance_cents = cents
+        db.commit()
+    finally:
+        db.close()
+
+
+def _get_user(phone: str) -> User | None:
+    db = SessionLocal()
+    try:
+        return db.execute(select(User).where(User.phone == phone)).scalar_one_or_none()
+    finally:
+        db.close()
+
+
+def test_delete_clean_account_releases_all_unique_slots(client) -> None:
+    phone = "13900000001"
+    token = _login(client, phone)
+    # 预置:给该用户造昵称 + 邀请码(占 invite_code 唯一槽),验证注销时一并释放
+    db = SessionLocal()
+    try:
+        u = db.execute(select(User).where(User.phone == phone)).scalar_one()
+        u.nickname = "张三"
+        u.invite_code = "INVCODE0001"
+        db.commit()
+        uid = u.id
+    finally:
+        db.close()
+
+    r = client.delete("/api/v1/user", headers=_auth(token))
+    assert r.status_code == 200, r.text
+
+    u = _get_user(f"deleted_{uid}")
+    assert u is not None
+    assert u.status == "deleted"
+    assert u.phone == f"deleted_{uid}"
+    assert u.nickname is None
+    assert u.avatar_url is None
+    assert u.wechat_openid is None
+    assert u.wechat_nickname is None
+    assert u.wechat_avatar_url is None
+    assert u.invite_code is None
+
+
+def test_delete_releases_wechat_so_another_account_can_bind(client, monkeypatch) -> None:
+    """原始 bug 回归:A 绑微信 → 注销,B 必须能绑同一个 openid(修复前会 409)。"""
+    openid = "openid_delreuse_a1"  # 独特值,避免跨测试共享库污染(如 test_withdraw 也用 openid_shared_xyz)
+    # A 绑微信
+    _patch_userinfo(monkeypatch, openid)
+    token_a = _login(client, "13900000002")
+    r = client.post("/api/v1/wallet/bind-wechat", json={"code": "ca"}, headers=_auth(token_a))
+    assert r.status_code == 200, r.text
+    # A 注销(无现金、无提现单 → 允许)
+    r = client.delete("/api/v1/user", headers=_auth(token_a))
+    assert r.status_code == 200, r.text
+    # B 绑同一个 openid → 必须成功(修复前会 409 "该微信已绑定其他账号")
+    token_b = _login(client, "13900000003")
+    r = client.post("/api/v1/wallet/bind-wechat", json={"code": "cb"}, headers=_auth(token_b))
+    assert r.status_code == 200, r.text
+    assert r.json()["bound"] is True
+
+
+def test_delete_blocked_when_cash_balance_positive(client) -> None:
+    phone = "13900000004"
+    token = _login(client, phone)
+    _seed_cash(client, token, phone, 100)  # 1 元未提现
+    r = client.delete("/api/v1/user", headers=_auth(token))
+    assert r.status_code == 409, r.text
+    assert "现金" in r.json()["detail"]
+    u = _get_user(phone)  # 账号未被删
+    assert u is not None and u.status == "active"
+
+
+def test_delete_blocked_when_reviewing_withdraw_exists(client, monkeypatch) -> None:
+    """cash 提光(=0)但有在审提现单 → 仍拒绝(命中 reviewing 闸,非 cash 闸)。"""
+    phone = "13900000005"
+    _patch_userinfo(monkeypatch, "openid_delrev_b2")
+    token = _login(client, phone)
+    _seed_cash(client, token, phone, 50)
+    client.post("/api/v1/wallet/bind-wechat", json={"code": "c"}, headers=_auth(token))
+    # 提光 50 → cash 归 0,单进 reviewing
+    r = client.post("/api/v1/wallet/withdraw", json={"amount_cents": 50}, headers=_auth(token))
+    assert r.status_code == 200 and r.json()["status"] == "reviewing", r.text
+    assert r.json()["cash_balance_cents"] == 0
+
+    r = client.delete("/api/v1/user", headers=_auth(token))
+    assert r.status_code == 409, r.text
+    assert "审核" in r.json()["detail"]
+    u = _get_user(phone)
+    assert u is not None and u.status == "active"
+
+
+def test_deleted_user_old_token_is_rejected(client) -> None:
+    phone = "13900000006"
+    token = _login(client, phone)
+    r = client.delete("/api/v1/user", headers=_auth(token))
+    assert r.status_code == 200, r.text
+    # 注销后旧 token 立即失效(get_current_user 校验 status==active)
+    r = client.get("/api/v1/user/onboarding/status", params={"device_id": "d"}, headers=_auth(token))
+    assert r.status_code == 401, r.text