# laic-backend

低空智控平台 后端 Go 服务。

## 生产部署

部署脚本参考 `D:/GoProject/roller-service/roller-manage/publish-prod.sh`，使用 Supervisor 管理服务。

### 服务器准备

在生产服务器安装 Supervisor。生产配置保存在仓库根目录的 `config-prod.yaml`，部署脚本会将它上传为服务器部署目录中的 `config.yaml`：

```bash
sudo apt update
sudo apt install supervisor -y
sudo systemctl enable --now supervisor
```

生产配置至少包含：

```yaml
oss:
  endpoint: https://obs.cn-east-2.myhuaweicloud.com
  access-key: 实际的华为云 OBS AK
  secret-key: 实际的华为云 OBS SK
  bucket: gcs-edu
  region: cn-east-2
  use-ssl: true
```

后端启动时直接读取部署目录下的 `config.yaml`。本地开发不设置 `LAIC_CONFIG_FILE` 时读取本地 `config.yaml`；Supervisor 显式设置 `LAIC_CONFIG_FILE=config.yaml`。

### 执行部署

修改 `publish-prod.sh` 顶部的 `REMOTE`、`REMOTE_DIR` 和服务参数，然后执行：

```bash
chmod +x publish-prod.sh
./publish-prod.sh
```

脚本会完成：

1. 交叉编译 Linux amd64 二进制。
2. 创建远程部署目录、日志目录和备份目录。
3. 备份旧二进制和 `config.yaml`（首次部署没有旧文件时跳过）。
4. 将本地 `config-prod.yaml` 上传为远程 `config.yaml`。
5. 更新 Supervisor 配置、重启服务并检查状态。
6. 启动失败时自动恢复最近的旧二进制。

首次部署前确认远程服务器已安装并运行 Supervisor：

```bash
sudo apt update
sudo apt install supervisor -y
sudo systemctl enable --now supervisor
```

查看状态和日志：

```bash
sudo supervisorctl status laic-backend-prod
sudo tail -f /usr/local/laic-backend-prod/log/info.log
sudo tail -f /usr/local/laic-backend-prod/log/err.log
```

部署目录和服务名可以在 `publish-prod.sh` 顶部调整。回滚时，脚本会使用远程 `backup/` 目录中最近的二进制备份；也可以手工恢复后执行：

```bash
sudo supervisorctl restart laic-backend-prod
```

## Payment and SIM schema reconciliation

If a production database was upgraded from an older partial release, back it
up first and then run `sql/019_reconcile_payment_schema.sql`. The migration is
repeatable and fills missing `traffic_order.updated_at`, payment fields, pending
order guards, and normalizes legacy empty payment idempotency keys. It also
creates the payment/SIM tables. It does not create orders, charge users, or
create SIM cards. Verify the schema and platform resource pool after it finishes, then
restart the backend before retrying payment.

AGPay returns the WeChat QR code as binary `image/png`. The backend converts it
to a JSON-safe `providerPayload` data URI (`data:image/png;base64,...`); clients
should use that value directly as the image `src` and must not UTF-8 decode the
original response body.

## Test traffic grant

For QA environments, set the following configuration explicitly (it defaults
to disabled):

```yaml
testing:
  allow-traffic-grant: true
```

An authenticated administrator can then credit a regular user without creating
a payment order:

```http
POST /v1/admin/traffic/test-grants
Content-Type: application/json

{"userId":8243938201600,"amountGb":10,"reason":"live test"}
```

The operation updates the user snapshot, appends a `test_grant` traffic ledger
entry, invalidates the Redis balance cache, and writes an operation log. Keep
the switch disabled in production after testing.