feat: 完善会员资金明细与退款转账逻辑，新增支付密码组件与资金流水界面

application/api/controller/Member.php

@@ -157,8 +157,12 @@ class Member extends V1
         $isBalance = $payType === 'balance';
 
         // 余额校验必须在落订单之前：否则余额不足时已插入一条 status=paid 的假订单
-        if ($isBalance && (float)$user['money'] < $amount) {
-            $this->fail('余额不足');
+        if ($isBalance) {
+            if ((float)$user['money'] < $amount) {
+                $this->fail('余额不足');
+            }
+            // 后台开启支付密码时，余额支付需校验
+            $this->verifyPayPassword($user);
         }
 
         $orderNo = $this->orderNo('MO');
@@ -206,6 +210,9 @@ class Member extends V1
                     $grant = $this->grantMembership(Db::name('fc_order')->where('id', $orderId)->find());
                     // 券核销（微信支付在 OrderFulfill 里核销）
                     \app\common\library\CouponService::markUsed($orderNo);
+                    // 钱包流水（fa_user.money 减）→ 余额中心「余额明细」
+                    $balance = round((float)Db::name('user')->where('id', (int)$user['id'])->value('money'), 2);
+                    $this->walletFlow($user['id'], 'expense', '会员开通', $amount, $balance, $orderId, (string)$plan['name']);
                 }
             });
         } catch (\Throwable $e) {
@@ -289,7 +296,7 @@ class Member extends V1
 
         $amount = round((float)(isset($order['amount']) ? $order['amount'] : 0), 2);
         $orderId = (int)(isset($order['id']) ? $order['id'] : 0);
-        $this->flow('income', '会员开通', $amount, 0, $orderId);
+        $this->flow('income', '会员开通', $amount, 0, $orderId, '', $userId);
         $this->notify(
             $userId,
             'system',
@@ -397,10 +404,104 @@ class Member extends V1
         }
 
         $this->ok([
-            'balance'     => (float)$user['money'],
-            'coupons'     => $coupons,
-            'couponCount' => count($coupons),
-            'points'      => (int)$user['score'],
+            'balance'           => (float)$user['money'],
+            'coupons'           => $coupons,
+            'couponCount'       => count($coupons),
+            'points'            => (int)$user['score'],
+            'payPasswordEnabled' => (int)$this->cfg('pay.payPasswordEnabled', 0) === 1,
+            'hasPayPassword'    => (string)$this->ext($user['id'])['pay_password'] !== '',
         ]);
     }
+
+    /**
+     * 余额明细（余额中心交易记录）
+     * GET /api/v1/member/flows  {page,size,type}  →  {list:[...],page,size,total,hasMore}
+     * type 筛选：recharge=充值 / expense=消费 / refund=退款，缺省=全部
+     * 数据源：fc_wallet_flow（用户钱包流水，仅记录 fa_user.money 增减；
+     *         fc_finance_flow 是平台对账口径，含微信收入等非钱包变动，不在此展示）
+     */
+    public function flows()
+    {
+        $user = $this->auth();
+
+        $type = (string)$this->input('type', '');
+        list($rows, $total, $page, $size) = $this->pageQuery(function ($forCount) use ($user, $type) {
+            // TP5.0 禁止复用同一 Query 先 count 再 select，必须走 pageQuery 重建
+            $q = Db::name('fc_wallet_flow')->where('user_id', $user['id']);
+            if ($type === 'recharge') {
+                // 充值：微信充值入账与后台充值
+                $q->where('scene', 'in', ['余额充值', '后台充值']);
+            } elseif ($type === 'expense') {
+                // 消费：会员开通 / 发布付费 / 付费查看 / 充值退款扣回等支出
+                $q->where('type', 'expense');
+            } elseif ($type === 'refund') {
+                // 退款：订单退款（余额原路退回）
+                $q->where('scene', 'like', '%退款%');
+            }
+            return $forCount ? $q : $q->order('id desc');
+        }, 15);
+
+        $list = [];
+        foreach ($rows as $row) {
+            $list[] = [
+                'flowNo'    => (string)$row['flow_no'],
+                'type'      => (string)$row['type'],
+                'scene'     => (string)$row['scene'],
+                'amount'    => round((float)$row['amount'], 2),
+                'balance'   => round((float)$row['balance'], 2),
+                'remark'    => (string)$row['remark'],
+                'createdAt' => !empty($row['createtime']) ? $this->iso((int)$row['createtime']) : null,
+            ];
+        }
+
+        $this->ok($this->paginate($list, $total, $page, $size));
+    }
+
+    /**
+     * 设置/修改支付密码（6 位数字）
+     * POST /api/v1/member/pay-password/set  {password, oldPassword?}
+     * 首次设置无需 oldPassword；已设置时必须携带正确的 oldPassword（找回走人工/后续 SMS）。
+     */
+    public function setPayPassword()
+    {
+        $user = $this->auth();
+        $this->rateLimit('payswd:' . $user['id'], 10, 60);
+
+        $password = trim((string)$this->input('password', ''));
+        $oldPassword = trim((string)$this->input('oldPassword', ''));
+
+        if (!preg_match('/^\d{6}$/', $password)) {
+            $this->fail('支付密码必须是 6 位数字');
+        }
+
+        $ext = $this->ext($user['id']);
+        $hash = (string)(isset($ext['pay_password']) ? $ext['pay_password'] : '');
+
+        if ($hash !== '') {
+            // 修改密码：必须验证旧密码
+            $old = trim((string)$oldPassword);
+            if ($old === '') {
+                $this->fail('请输入原支付密码');
+            }
+            if (!preg_match('/^\d{6}$/', $old) || !password_verify($old, $hash)) {
+                $this->fail('原支付密码错误');
+            }
+            if ($old === $password) {
+                $this->fail('新密码不能与原密码相同');
+            }
+        }
+
+        // 弱密码拦截：6 位连号/同号（如 123456 / 888888）
+        if (preg_match('/^(\d)\1{5}$/', $password)
+            || in_array($password, ['012345', '123456', '234567', '345678', '456789', '987654', '876543'], true)) {
+            $this->fail('支付密码过于简单，请更换');
+        }
+
+        Db::name('fc_user_ext')->where('user_id', $user['id'])->update([
+            'pay_password' => password_hash($password, PASSWORD_DEFAULT),
+            'updatetime'   => time(),
+        ]);
+
+        $this->ok(['hasPayPassword' => true]);
+    }
 }