fix: enforce application limits and signature format

api/src/send-chain/send-chain.service.spec.ts

@@ -300,6 +300,7 @@ function createPrismaMock() {
     globalBlacklist: {
       findMany: jest.fn().mockResolvedValue([]),
     },
+    $queryRaw: jest.fn().mockResolvedValue([{ dailyLimit: 100000, usedCount: 2 }]),
     $transaction: jest.fn((operations) => Promise.all(operations)),
   };
 }
@@ -364,6 +365,23 @@ describe('SendChainService', () => {
     expect(service.enqueueBatchTask).toHaveBeenCalledWith('task-1');
   });
 
+  it('rejects the whole batch atomically when the application daily send limit would be exceeded', async () => {
+    const { service, prisma, billing } = createService();
+    prisma.$queryRaw.mockResolvedValueOnce([{ dailyLimit: 1, usedCount: null }]);
+
+    await expect(service.createBatchTask({
+      tenantId: 'tenant-1',
+      applicationId: 'app-1',
+      templateId: 'tpl-1',
+      content: 'hello',
+      phones: ['13800000001', '13800000002'],
+    })).rejects.toThrow('应用当日发送上限1条');
+
+    expect(prisma.smsBatchTask.create).not.toHaveBeenCalled();
+    expect(prisma.smsMessageRecord.createMany).not.toHaveBeenCalled();
+    expect(billing.freeze).not.toHaveBeenCalled();
+  });
+
   it('recognizes an approved template for public HTTP content and reads back the api task', async () => {
     const { service, prisma, riskReview } = createService();
     service.enqueueBatchTask = jest.fn().mockResolvedValue({ taskId: 'task-1', enqueued: 1 });
@@ -832,6 +850,31 @@ describe('SendChainService', () => {
     expect(prisma.cmppDownstreamDelivery.create).toHaveBeenCalledTimes(2);
   });
 
+  it('rejects every destination in one CMPP Submit with auditable receipts when the daily limit is exceeded', async () => {
+    const { service, prisma, billing } = createService();
+    prisma.$queryRaw.mockResolvedValueOnce([{ dailyLimit: 1, usedCount: null }]);
+    let taskIndex = 0;
+    prisma.smsBatchTask.create.mockImplementation(({ data }) => Promise.resolve({ id: `task-${++taskIndex}`, ...data }));
+    let messageIndex = 0;
+    prisma.smsMessageRecord.create.mockImplementation(({ data }) => Promise.resolve({ id: `record-${++messageIndex}`, ...data }));
+
+    const result = await service.submitInboundMessage({
+      account: '100001',
+      phoneNumbers: ['13800000001', '13900000002'],
+      content: 'hello',
+      sequenceId: 88,
+      remoteIp: '127.0.0.1',
+    });
+
+    expect(result).toEqual(expect.objectContaining({ accepted: true, phoneCount: 2 }));
+    expect(prisma.smsMessageRecord.create).toHaveBeenCalledTimes(2);
+    expect(prisma.smsReceiptRecord.create).toHaveBeenCalledTimes(2);
+    expect(prisma.smsReceiptRecord.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({ errorCode: 'DAILY_LIMIT', receiptStatus: 'undelivered' }),
+    });
+    expect(billing.freeze).not.toHaveBeenCalled();
+  });
+
   it('rejects a multi-destination CMPP Submit before persistence when any destination is invalid', async () => {
     const { service, prisma } = createService();