修改

1、微信回调签名验证绕过问题
2、联系请求竞态条件问题
3、contact列表count过滤bug
4、核心业务表索引添加

video-gen-api/app/api/v1/payments.py

@@ -127,30 +127,32 @@ async def wechat_callback(request: Request, db: AsyncSession = Depends(get_db)):
         signature = headers.get("wechatpay-signature", "")
         serial_no = headers.get("wechatpay-serial", "")
         
+        # 安全要求：非mock模式下必须验证签名，配置缺失直接拒绝
+        if not public_key:
+            logger.error("WeChat platform public key not configured, cannot verify callback signature")
+            return {"code": "FAIL", "message": "Platform public key not configured"}
+        if not serial_no:
+            logger.error("Wechatpay-Serial header missing in callback")
+            return {"code": "FAIL", "message": "Missing Wechatpay-Serial header"}
+        if not timestamp or not nonce or not signature:
+            logger.error("WeChat callback missing required signature headers")
+            return {"code": "FAIL", "message": "Missing signature headers"}
         
         # 验证签名：使用平台公钥验证
-        if public_key and serial_no:
-            try:
-                # 构造签名串：timestamp + "\n" + nonce + "\n" + body + "\n"
-                # 符合微信支付官方文档规范：https://pay.weixin.qq.com/doc/v3/merchant/4013053249
-                is_verified = rsa_verify(
-                    timestamp=timestamp,
-                    nonce=nonce,
-                    body=body_str,
-                    signature=signature,
-                    public_key=load_public_key(public_key)
-                )
-                if not is_verified:
-                    logger.warning(f"WeChat callback signature verification failed: serial={serial_no}")
-                    raise HTTPException(status_code=400, detail="签名验证失败")
-            except Exception as e:
-                logger.warning(f"WeChat signature verification error: {e}, serial={serial_no}")
-                raise HTTPException(status_code=400, detail="签名验证失败")
-        else:
-            if not public_key:
-                logger.warning("WeChat platform public key not configured, skipping signature verification")
-            if not serial_no:
-                logger.warning("Wechatpay-Serial header missing, skipping signature verification")
+        try:
+            is_verified = rsa_verify(
+                timestamp=timestamp,
+                nonce=nonce,
+                body=body_str,
+                signature=signature,
+                public_key=load_public_key(public_key)
+            )
+            if not is_verified:
+                logger.warning(f"WeChat callback signature verification failed: serial={serial_no}")
+                return {"code": "FAIL", "message": "Signature verification failed"}
+        except Exception as e:
+            logger.warning(f"WeChat signature verification error: {e}, serial={serial_no}")
+            return {"code": "FAIL", "message": "Signature verification error"}
         
         # 解密回调数据：使用 API v3 key
         # 官方文档：https://pay.weixin.qq.com/doc/v3/merchant/4012071382