fix: enforce application limits and signature format

api/src/send-chain/send-chain.service.ts

@@ -1,4 +1,4 @@
-import { BadRequestException, forwardRef, Inject, Injectable, Logger, NotFoundException, OnModuleDestroy, OnModuleInit, Optional } from '@nestjs/common';
+import { BadRequestException, forwardRef, HttpException, HttpStatus, Inject, Injectable, Logger, NotFoundException, OnModuleDestroy, OnModuleInit, Optional } from '@nestjs/common';
 import { Prisma } from '@prisma/client';
 import { Queue, Worker } from 'bullmq';
 import IORedis from 'ioredis';
@@ -366,6 +366,9 @@ export class SendChainService implements OnModuleInit, OnModuleDestroy {
         throw new BadRequestException('企业账户余额不足');
       }
     }
+    if (data.applicationId && risk.status !== 'rejected') {
+      await this.reserveDailySendQuota(data.applicationId, phones.length);
+    }
     const task = await this.prisma.smsBatchTask.create({
       data: {
         tenantId: data.tenantId,
@@ -2020,6 +2023,15 @@ export class SendChainService implements OnModuleInit, OnModuleDestroy {
       throw new BadRequestException('CMPP submit phone number is invalid');
     }
 
+    const application = await this.findInboundApplication(data.account);
+    if (!application) {
+      throw new BadRequestException('CMPP account is invalid');
+    }
+    const dailyQuota = await this.tryReserveDailySendQuota(application.id, phoneNumbers.length);
+    const dailyLimitFailure = dailyQuota.reserved
+      ? undefined
+      : `应用当日发送上限${dailyQuota.dailyLimit}条，本次${phoneNumbers.length}条超出剩余配额`;
+
     const submitGroupMessageId = `MSG-${randomUUID()}`;
     const submissions = phoneNumbers.map((phoneNumber, index) => ({
       phoneNumber,
@@ -2033,7 +2045,7 @@ export class SendChainService implements OnModuleInit, OnModuleDestroy {
         ...data,
         phoneNumber: submission.phoneNumber,
         phoneNumbers: undefined,
-      }, submission.messageId, submitGroupMessageId))));
+      }, submission.messageId, submitGroupMessageId, dailyLimitFailure))));
     }
     const first = results[0];
     return {
@@ -2053,6 +2065,7 @@ export class SendChainService implements OnModuleInit, OnModuleDestroy {
     data: GatewayInboundSubmitDto & { phoneNumber: string },
     messageId: string,
     submitGroupMessageId: string,
+    dailyLimitFailure?: string,
   ) {
     const application = await this.findInboundApplication(data.account);
     if (!application) {
@@ -2190,7 +2203,9 @@ export class SendChainService implements OnModuleInit, OnModuleDestroy {
       });
       await this.enqueueBatchTask(task.id);
     };
-    if (application.status !== 'active' || application.tenant.status !== 'active') {
+    if (dailyLimitFailure) {
+      await reject('DAILY_LIMIT', dailyLimitFailure);
+    } else if (application.status !== 'active' || application.tenant.status !== 'active') {
       await reject('ACCOUNT', '企业或短信应用已停用');
     } else if (!application.interfaceEnabled) {
       await reject('INTERFACE', '短信应用 CMPP 接口已停用');
@@ -2908,6 +2923,58 @@ export class SendChainService implements OnModuleInit, OnModuleDestroy {
     }
   }
 
+  private async reserveDailySendQuota(applicationId: string, requestedCount: number) {
+    const result = await this.tryReserveDailySendQuota(applicationId, requestedCount);
+    if (!result.reserved) {
+      throw new HttpException({
+        code: 'DAILY_SEND_LIMIT_EXCEEDED',
+        message: `应用当日发送上限${result.dailyLimit}条，本次${requestedCount}条超出剩余配额`,
+        dailyLimit: result.dailyLimit,
+        requestedCount,
+      }, HttpStatus.TOO_MANY_REQUESTS);
+    }
+    return result;
+  }
+
+  private async tryReserveDailySendQuota(applicationId: string, requestedCount: number) {
+    if (!Number.isInteger(requestedCount) || requestedCount <= 0) {
+      throw new BadRequestException('发送号码数量必须为正整数');
+    }
+    const usageDate = shanghaiDateKey();
+    const reservationId = randomUUID();
+    const rows = await this.prisma.$queryRaw<Array<{ dailyLimit: number; usedCount: number | null }>>(Prisma.sql`
+      WITH application_limit AS (
+        SELECT id, COALESCE("dailyLimit", 100000)::integer AS "dailyLimit"
+        FROM "SmsApplication"
+        WHERE id = ${applicationId}
+      ), reservation AS (
+        INSERT INTO "SmsApplicationDailyUsage" (
+          id, "applicationId", "usageDate", "usedCount", "createdAt", "updatedAt"
+        )
+        SELECT ${reservationId}, id, ${usageDate}::date, ${requestedCount}, NOW(), NOW()
+        FROM application_limit
+        WHERE ${requestedCount} <= "dailyLimit"
+        ON CONFLICT ("applicationId", "usageDate") DO UPDATE
+          SET "usedCount" = "SmsApplicationDailyUsage"."usedCount" + EXCLUDED."usedCount",
+              "updatedAt" = NOW()
+          WHERE "SmsApplicationDailyUsage"."usedCount" + EXCLUDED."usedCount"
+                <= (SELECT "dailyLimit" FROM application_limit)
+        RETURNING "usedCount"
+      )
+      SELECT application_limit."dailyLimit", reservation."usedCount"
+      FROM application_limit
+      LEFT JOIN reservation ON TRUE
+    `);
+    if (rows.length === 0) {
+      throw new NotFoundException('短信应用不存在');
+    }
+    return {
+      dailyLimit: Number(rows[0].dailyLimit),
+      usedCount: rows[0].usedCount == null ? null : Number(rows[0].usedCount),
+      reserved: rows[0].usedCount != null,
+    };
+  }
+
   private async chargeAcceptedMessage(message: {
     tenantId: string;
     applicationId?: string | null;
@@ -3697,6 +3764,17 @@ function positiveInteger(value: string | undefined, fallback: number) {
   return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
 }
 
+function shanghaiDateKey(now = new Date()) {
+  const parts = new Intl.DateTimeFormat('en-CA', {
+    timeZone: 'Asia/Shanghai',
+    year: 'numeric',
+    month: '2-digit',
+    day: '2-digit',
+  }).formatToParts(now);
+  const values = Object.fromEntries(parts.map((part) => [part.type, part.value]));
+  return `${values.year}-${values.month}-${values.day}`;
+}
+
 function bullmqConnection() {
   const redisUrl = new URL(process.env.REDIS_URL ?? 'redis://127.0.0.1:6379');
   return {