Merge pull request #37 from GMWalletApp/dev-runtime

Dev runtime

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,111 @@
+name: Bug 反馈
+description: 有一个 bug 需要解决
+title: "发现bug："
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        # 提 ISSUE 须知
+
+        请先阅读文档：
+        - [epusdt 文档](https://epusdt.com/)
+
+        如果仍有问题，请先在 issue 列表中搜索是否已有相同问题：
+        - [Issue 列表](https://github.com/GMWalletApp/epusdt/issues)
+
+        如果没有找到相关问题，请按下面格式尽量完整填写，便于我们快速排查。
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: 提交前检查
+      options:
+        - label: 我已阅读文档并检查常见问题
+          required: true
+        - label: 我已搜索现有 issue，确认不是重复问题
+          required: true
+        - label: 我已尽量提供可复现信息（代码、配置、日志）
+          required: true
+
+  - type: textarea
+    id: epusdt_version
+    attributes:
+      label: 1. epusdt 版本
+      description: 请提供版本号或 commit hash，避免只写“最新版”
+      placeholder: |
+        例如：
+        - v1.2.3
+        - commit: abcdef1
+    validations:
+      required: true
+
+  - type: textarea
+    id: runtime
+    attributes:
+      label: 2. 运行环境版本
+      description: 请提供语言/运行时及相关依赖版本
+      placeholder: |
+        例如：
+        - Go/Python/Node 版本：
+        - 数据库及版本：
+        - Docker 版本（如有）：
+    validations:
+      required: true
+
+  - type: textarea
+    id: os_info
+    attributes:
+      label: 3. 操作系统信息
+      description: Windows / Linux / macOS 或其他系统，请写明版本
+      placeholder: |
+        例如：
+        - Ubuntu 22.04
+        - macOS 14.6
+        - Windows Server 2022
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro_code
+    attributes:
+      label: 4. 可复现代码/配置
+      description: 请提供最小可复现代码、请求参数或配置（敏感信息请脱敏）
+      render: shell
+      placeholder: |
+        # 最小复现步骤
+        1. ...
+        2. ...
+        3. ...
+
+        # 关键请求/配置（脱敏后）
+        curl -X POST https://xxx/api/...
+        -H "Authorization: Bearer ***"
+        -d '{"amount":100,"order_id":"test-001"}'
+    validations:
+      required: true
+
+  - type: textarea
+    id: stacktrace
+    attributes:
+      label: 5. 错误日志 / 堆栈信息
+      description: 请粘贴完整报错信息、状态码、关键日志
+      render: shell
+      placeholder: |
+        例如：
+        - HTTP 状态码：
+        - 错误码：
+        - 错误堆栈：
+        - 关键日志片段：
+    validations:
+      required: true
+
+  - type: textarea
+    id: extra
+    attributes:
+      label: 补充信息
+      description: 可补充截图、发生时间、复现概率、已尝试修复动作等
+      placeholder: 其他你认为有帮助的信息（可选）
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 安全漏洞报告
+    url: https://github.com/ginta/epusdt/security/advisories/new
+    about: 请不要公开提交安全漏洞，请通过 GitHub Security Advisory 私下报告

README.md

@@ -37,6 +37,7 @@ Deploy it privately, integrate via HTTP API, and start receiving **crypto paymen
 |------|------|
 | **TRC20** (Tron) | USDT、TRX|
 | **ERC20** (Ethereum) | USDT、USDC、ETH |
+| **Solana** | USDT、USDC |
 | **BEP20** (BSC) | USDT、USDC、BNB |
 | **Polygon** | USDT、USDC |
 | **更多** | 持续扩展中… |

src/.env.example

@@ -1,14 +1,14 @@
 app_name=epusdt
-app_uri=https://dujiaoka.com
+app_uri=https://epusdt.com
 log_level=info
 http_access_log=false
 sql_debug=false
 http_listen=:8000
 
 static_path=/static
-runtime_root_path=/runtime
+runtime_root_path=./runtime
 
-log_save_path=/logs
+log_save_path=./logs
 log_max_size=32
 log_max_age=7
 max_backups=3
@@ -50,22 +50,10 @@ queue_concurrency=10
 queue_poll_interval_ms=1000
 callback_retry_base_seconds=5
 
-tg_bot_token=
-tg_proxy=
-tg_manage=
-
-api_auth_token=
-
 order_expiration_time=10
 order_notice_max_retry=0
-forced_usdt_rate=
+
 api_rate_url=
-tron_grid_api_key=
-solana_rpc_url=
 
-ethereum_ws_url=wss://ethereum.publicnode.com
+# Set to true to re-run the install wizard on next startup.
-
+install=true
-
-# epay
-epay_pid=
-epay_key=

src/bootstrap/bootstrap.go

@@ -5,10 +5,13 @@ import (
 
 	"github.com/assimon/luuu/config"
 	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/data"
 	"github.com/assimon/luuu/mq"
 	"github.com/assimon/luuu/task"
 	"github.com/assimon/luuu/telegram"
+	appjwt "github.com/assimon/luuu/util/jwt"
 	"github.com/assimon/luuu/util/log"
+	"github.com/gookit/color"
 )
 
 var initOnce sync.Once
@@ -18,6 +21,46 @@ func InitApp() {
 		config.Init()
 		log.Init()
 		dao.Init()
+		// Wire settings-table lookups into the config package so
+		// GetRateApiUrl / GetUsdtRate prefer DB-backed overrides.
+		config.SettingsGetString = func(key string) string {
+			return data.GetSettingString(key, "")
+		}
+		// Seed rate.api_url from .env into the settings table on first run
+		// so the admin UI can display and change it without a code restart.
+		// Only written if the key is not already present in the DB.
+		if data.GetSettingString("rate.api_url", "") == "" {
+			if envURL := config.GetRateApiUrlFromEnv(); envURL != "" {
+				if err := data.SetSetting("rate", "rate.api_url", envURL, "string"); err != nil {
+					color.Red.Printf("[bootstrap] seed rate.api_url err=%s\n", err)
+				}
+			}
+		}
+		// config.Init() computes RateApiUrl before SettingsGetString is
+		// installed, so refresh the cache once DB-backed settings are available.
+		config.RateApiUrl = config.GetRateApiUrl()
+		// Seed admin account and JWT secret so the management console is
+		// immediately usable on a fresh install. Both are idempotent.
+		adminPwd, isNew, err := data.EnsureDefaultAdmin()
+		if err != nil {
+			color.Red.Printf("[bootstrap] ensure default admin err=%s\n", err)
+		}
+		if isNew {
+			color.Yellow.Println("╔════════════════════════════════════════════════════════════════════════╗")
+			color.Yellow.Println("║  Default admin account created. Change the password via admin console! ║")
+			color.Yellow.Printf("║  Username: admin                                                       ║\n")
+			color.Yellow.Printf("║  Password: %-60s ║\n", adminPwd)
+			color.Yellow.Println("╚════════════════════════════════════════════════════════════════════════╝")
+		}
+		if _, err := appjwt.EnsureSecret(); err != nil {
+			color.Red.Printf("[bootstrap] ensure jwt secret err=%s\n", err)
+		}
+		// Seed one universal default API key on fresh installs. The seeded
+		// key (PID=1000) works for all three gateway flows.
+		_, err = data.EnsureDefaultApiKey()
+		if err != nil {
+			color.Red.Printf("[bootstrap] ensure default api key err=%s\n", err)
+		}
 		mq.Start()
 		go telegram.BotStart()
 		go task.Start()

src/command/http_server.go

@@ -5,10 +5,12 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"time"
 
 	"github.com/assimon/luuu/bootstrap"
 	"github.com/assimon/luuu/config"
+	"github.com/assimon/luuu/install"
 	"github.com/assimon/luuu/middleware"
 	"github.com/assimon/luuu/route"
 	"github.com/assimon/luuu/util/constant"
@@ -37,6 +39,14 @@ var startCmd = &cobra.Command{
 	Short: "start",
 	Long:  "start http service",
 	Run: func(cmd *cobra.Command, args []string) {
+		// If no config file exists, or if install=true is set in the config,
+		// run the first-run install API on the same port as the main server.
+		// The wizard writes the .env (with install=false) and shuts itself
+		// down so bootstrap.InitApp() can read it normally on the same port.
+		if config.NeedsInstall() {
+			envPath, _ := config.ResolveConfigPath()
+			install.RunInstallServer(install.DefaultInstallAddr, envPath)
+		}
 		bootstrap.InitApp()
 		printBanner()
 		HttpServerStart()
@@ -53,6 +63,20 @@ func HttpServerStart() {
 	route.RegisterRoute(e)
 	e.Static(config.StaticPath, config.StaticFilePath)
 
+	// Resolve www/ relative to the executable so SPA routes work regardless
+	// of the working directory. main.go extracts www/ next to the binary.
+	wwwRoot := "./www"
+	if exePath, err := os.Executable(); err == nil {
+		if exePath, err = filepath.EvalSymlinks(exePath); err == nil {
+			wwwRoot = filepath.Join(filepath.Dir(exePath), "www")
+		}
+	}
+	e.Use(echoMiddleware.StaticWithConfig(echoMiddleware.StaticConfig{
+		HTML5: true,
+		Index: "index.html",
+		Root:  wwwRoot,
+	}))
+
 	httpListen := viper.GetString("http_listen")
 	go func() {
 		if err = e.Start(httpListen); err != http.ErrServerClosed {
@@ -86,13 +110,28 @@ func customHTTPErrorHandler(err error, e echo.Context) {
 		Message:    msg,
 		RequestID:  e.Request().Header.Get(echo.HeaderXRequestID),
 	}
+	// echo.HTTPError carries a real HTTP status (401 for auth failures,
+	// 404 for missing routes, etc.). Propagate it instead of flattening
+	// everything to 200 — clients rely on the status code.
 	if he, ok := err.(*echo.HTTPError); ok {
-		e.String(http.StatusOK, he.Message.(string))
+		resp.StatusCode = he.Code
+		if s, ok := he.Message.(string); ok {
+			resp.Message = s
+		} else if he.Message != nil {
+			resp.Message = http.StatusText(he.Code)
+		}
+		_ = e.JSON(he.Code, resp)
 		return
 	}
+	// Internal RspError: propagate Code as both the JSON status_code and
+	// the real HTTP status when it maps to one (400/401/...); business
+	// codes (>=1000) map to HTTP 400 so clients get a proper 4xx while
+	// still reading the granular code from the body.
 	if he, ok := err.(*constant.RspError); ok {
 		resp.StatusCode = he.Code
 		resp.Message = he.Msg
+		_ = e.JSON(he.HttpStatus(), resp)
+		return
 	}
-	_ = e.JSON(http.StatusOK, resp)
+	_ = e.JSON(http.StatusInternalServerError, resp)
 }

src/config/config.go

@@ -7,6 +7,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"time"
 
@@ -15,6 +16,12 @@ import (
 	"github.com/tidwall/gjson"
 )
 
+// parseFloat is the minimal helper used by the settings bridge; kept
+// here so settings_bridge.go stays import-free.
+func parseFloat(s string) (float64, error) {
+	return strconv.ParseFloat(strings.TrimSpace(s), 64)
+}
+
 var (
 	HTTPAccessLog      bool
 	SQLDebug           bool
@@ -124,6 +131,57 @@ func resolveConfigFilePath() (string, error) {
 	return normalizeConfiguredPath(".env")
 }
 
+// NeedsInstall returns true when the first-run install wizard should run.
+// It returns true if the config file does not exist yet, or if the file
+// exists and contains install=true (an explicit reset flag).
+// Existing installs that have no install key are NOT affected.
+func NeedsInstall() bool {
+	envPath, exists := ResolveConfigPath()
+	if !exists {
+		return true
+	}
+	// Read just the install key without triggering full Init().
+	v := viper.New()
+	v.SetConfigFile(envPath)
+	if err := v.ReadInConfig(); err != nil {
+		// Unreadable config → treat as needing install.
+		return true
+	}
+	return strings.EqualFold(strings.TrimSpace(v.GetString("install")), "true")
+}
+
+// ResolveConfigPath returns the absolute path to the .env file and whether
+// it currently exists on disk. Unlike resolveConfigFilePath it does not
+// return an error when the file is absent — callers (e.g. the install
+// wizard) need the target path even before the file is written.
+func ResolveConfigPath() (path string, exists bool) {
+	candidate := explicitConfigPath
+	if candidate == "" {
+		if e := strings.TrimSpace(os.Getenv("EPUSDT_CONFIG")); e != "" {
+			candidate = e
+		} else {
+			candidate = ".env"
+		}
+	}
+	// Resolve relative paths against cwd.
+	p := strings.TrimSpace(candidate)
+	if !filepath.IsAbs(p) {
+		cwd, err := os.Getwd()
+		if err == nil {
+			p = filepath.Join(cwd, p)
+		}
+	}
+	info, err := os.Stat(p)
+	if err == nil && info.IsDir() {
+		p = filepath.Join(p, ".env")
+		info, err = os.Stat(p)
+	}
+	if err != nil {
+		return p, false
+	}
+	return p, true
+}
+
 func normalizeConfiguredPath(input string) (string, error) {
 	path := strings.TrimSpace(input)
 	if path == "" {
@@ -178,11 +236,19 @@ func GetAppUri() string {
 	return viper.GetString("app_uri")
 }
 
-func GetApiAuthToken() string {
+func GetRateApiUrl() string {
-	return viper.GetString("api_auth_token")
+	// settings table wins (admin-configurable); .env and env var remain
+	// as fallbacks for smooth migration from the old layout.
+	if db := settingsRateApiUrl(); db != "" {
+		return db
+	}
+	return GetRateApiUrlFromEnv()
 }
 
-func GetRateApiUrl() string {
+// GetRateApiUrlFromEnv returns the rate API URL read only from the
+// .env / environment variables, bypassing the settings table. Used
+// by bootstrap to seed the settings table from the initial .env value.
+func GetRateApiUrlFromEnv() string {
 	rateURL := viper.GetString("api_rate_url")
 	if rateURL == "" {
 		rateURL = os.Getenv("API_RATE_URL")
@@ -190,7 +256,6 @@ func GetRateApiUrl() string {
 	if rateURL == "" {
 		log.Println("api_rate_url is empty")
 	}
-	RateApiUrl = rateURL
 	return rateURL
 }
 
@@ -250,6 +315,11 @@ func GetRateForCoin(coin string, base string) float64 {
 }
 
 func GetUsdtRate() float64 {
+	// Prefer the DB-backed override (admin-configurable). Fall back to
+	// the legacy .env var, then the hardcoded 6.4 default.
+	if forced := settingsForcedUsdtRate(); forced > 0 {
+		return forced
+	}
 	forcedUsdtRate := viper.GetFloat64("forced_usdt_rate")
 	if forcedUsdtRate > 0 {
 		return forcedUsdtRate
@@ -340,11 +410,3 @@ func GetSolanaRpcUrl() string {
 func GetEthereumWsUrl() string {
 	return strings.TrimSpace(viper.GetString("ethereum_ws_url"))
 }
-
-func GetEpayPid() int {
-	return viper.GetInt("epay_pid")
-}
-
-func GetEpayKey() string {
-	return viper.GetString("epay_key")
-}

src/config/settings_bridge.go

@@ -0,0 +1,34 @@
+package config
+
+// Settings lookups are injected at runtime by bootstrap (after DB init)
+// to keep the config package free of a `model/data` import, which would
+// create a cycle via `model/dao -> config`.
+//
+// If unset (e.g. during early startup or tests) the getters return the
+// zero string / 0 and callers fall through to the .env / default path.
+
+// SettingsGetString is installed by bootstrap.Init with a closure that
+// reads from the settings table. Runtime-only.
+var SettingsGetString func(key string) string
+
+func settingsRateApiUrl() string {
+	if SettingsGetString == nil {
+		return ""
+	}
+	return SettingsGetString("rate.api_url")
+}
+
+func settingsForcedUsdtRate() float64 {
+	if SettingsGetString == nil {
+		return 0
+	}
+	raw := SettingsGetString("rate.forced_usdt_rate")
+	if raw == "" {
+		return 0
+	}
+	f, err := parseFloat(raw)
+	if err != nil {
+		return 0
+	}
+	return f
+}

src/controller/admin/api_key_controller.go

@@ -0,0 +1,310 @@
+package admin
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"strconv"
+	"strings"
+
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/labstack/echo/v4"
+)
+
+// CreateApiKeyRequest is the payload for creating an API key.
+// A single key is valid for both gateway flows (epay/gmpay); there is
+// no gateway_type. PID is auto-generated (incrementing from 1000);
+// no manual override.
+type CreateApiKeyRequest struct {
+	Name        string `json:"name" validate:"required|maxLen:128" example:"My API Key"`
+	IpWhitelist string `json:"ip_whitelist" example:""`
+	NotifyUrl   string `json:"notify_url" example:"https://example.com/notify"`
+}
+
+// CreateApiKeyResponse is the response for a newly created API key.
+type CreateApiKeyResponse struct {
+	ID   uint64 `json:"id" example:"1"`
+	Name string `json:"name" example:"My API Key"`
+	Pid  string `json:"pid" example:"1003"`
+	// SecretKey is returned ONCE on creation. After that, fetch via
+	// GET /api-keys/:id/secret or rotate to generate a new one.
+	SecretKey string `json:"secret_key" example:"secret123abc456"`
+}
+
+// UpdateApiKeyRequest is the payload for updating an API key.
+type UpdateApiKeyRequest struct {
+	Name        *string `json:"name" example:"Updated Key Name"`
+	IpWhitelist *string `json:"ip_whitelist" example:"10.0.0.1,192.168.0.0/24"`
+	NotifyUrl   *string `json:"notify_url" example:"https://example.com/notify"`
+}
+
+// ChangeApiKeyStatusRequest is the payload for toggling API key status.
+type ChangeApiKeyStatusRequest struct {
+	// 状态 1=启用 2=禁用
+	Status int `json:"status" validate:"required|in:1,2" enums:"1,2" example:"1"`
+}
+
+// ListApiKeys returns all api_keys rows. SecretKey is stripped by the
+// mdb.ApiKey json tag (`json:"-"`).
+// @Summary      List API keys
+// @Description  Returns all API keys
+// @Tags         Admin API Keys
+// @Security     AdminJWT
+// @Produce      json
+// @Success      200 {object} response.ApiResponse{data=[]mdb.ApiKey}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/api-keys [get]
+func (c *BaseAdminController) ListApiKeys(ctx echo.Context) error {
+	rows, err := data.ListApiKeys()
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, rows)
+}
+
+// CreateApiKey mints a new universal key. PID is auto-incremented from
+// the highest existing numeric PID (starting at 1000). Secret is
+// randomly generated and returned once.
+// @Summary      Create API key
+// @Description  Create a new universal API key. Usable for both gateway flows (epay/gmpay). PID auto-incremented; secret returned once.
+// @Tags         Admin API Keys
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        request body admin.CreateApiKeyRequest true "API key payload"
+// @Success      200 {object} response.ApiResponse{data=admin.CreateApiKeyResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/api-keys [post]
+func (c *BaseAdminController) CreateApiKey(ctx echo.Context) error {
+	req := new(CreateApiKeyRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+
+	// Retry on unique-index violation: two concurrent creates could
+	// both see the same max PID from NextPid() and race on INSERT.
+	// The loser re-reads and retries with the now-higher max.
+	const maxAttempts = 5
+	secret := randomHex(32)
+	var row *mdb.ApiKey
+	for attempt := 0; attempt < maxAttempts; attempt++ {
+		pid, err := data.NextPid()
+		if err != nil {
+			return c.FailJson(ctx, err)
+		}
+		row = &mdb.ApiKey{
+			Name:        req.Name,
+			Pid:         strconv.Itoa(pid),
+			SecretKey:   secret,
+			IpWhitelist: req.IpWhitelist,
+			NotifyUrl:   req.NotifyUrl,
+			Status:      mdb.ApiKeyStatusEnable,
+		}
+		err = data.CreateApiKey(row)
+		if err == nil {
+			break
+		}
+		if attempt == maxAttempts-1 || !isUniqueViolation(err) {
+			return c.FailJson(ctx, err)
+		}
+	}
+	return c.SucJson(ctx, CreateApiKeyResponse{
+		ID:        row.ID,
+		Name:      row.Name,
+		Pid:       row.Pid,
+		SecretKey: secret,
+	})
+}
+
+// isUniqueViolation matches the driver-specific strings for a unique-
+// index collision across SQLite / MySQL / PostgreSQL. Good enough for
+// the PID retry loop; a cleaner approach would be a typed error but
+// GORM doesn't surface one portably.
+func isUniqueViolation(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := strings.ToLower(err.Error())
+	return strings.Contains(msg, "unique") ||
+		strings.Contains(msg, "duplicate") ||
+		strings.Contains(msg, "constraint failed")
+}
+
+// UpdateApiKey patches name / ip_whitelist / notify_url. Secret rotation
+// and enable/disable have their own endpoints.
+// @Summary      Update API key
+// @Description  Patch API key name / ip_whitelist / notify_url
+// @Tags         Admin API Keys
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        id path int true "API key ID"
+// @Param        request body admin.UpdateApiKeyRequest true "Fields to update"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/api-keys/{id} [patch]
+func (c *BaseAdminController) UpdateApiKey(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	req := new(UpdateApiKeyRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	fields := map[string]interface{}{}
+	if req.Name != nil {
+		fields["name"] = *req.Name
+	}
+	if req.IpWhitelist != nil {
+		fields["ip_whitelist"] = *req.IpWhitelist
+	}
+	if req.NotifyUrl != nil {
+		fields["notify_url"] = *req.NotifyUrl
+	}
+	if err := data.UpdateApiKeyFields(id, fields); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// ChangeApiKeyStatus toggles enable/disable.
+// @Summary      Change API key status
+// @Description  Toggle enable/disable for an API key (1=enabled, 2=disabled)
+// @Tags         Admin API Keys
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        id path int true "API key ID"
+// @Param        request body admin.ChangeApiKeyStatusRequest true "Status payload"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/api-keys/{id}/status [post]
+func (c *BaseAdminController) ChangeApiKeyStatus(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	req := new(ChangeApiKeyStatusRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := data.UpdateApiKeyFields(id, map[string]interface{}{"status": req.Status}); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// RotateApiKeySecret issues a fresh secret_key. Returned only this time.
+// @Summary      Rotate API key secret
+// @Description  Generate a new secret_key. Returned only once.
+// @Tags         Admin API Keys
+// @Security     AdminJWT
+// @Produce      json
+// @Param        id path int true "API key ID"
+// @Success      200 {object} response.ApiResponse{data=admin.RotateSecretResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/api-keys/{id}/rotate-secret [post]
+func (c *BaseAdminController) RotateApiKeySecret(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	secret := randomHex(32)
+	if err := data.UpdateApiKeyFields(id, map[string]interface{}{"secret_key": secret}); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, map[string]string{"secret_key": secret})
+}
+
+// DeleteApiKey soft-deletes a row. Orders created with this key will
+// fail to callback (resolveOrderApiKey returns a clear error) — prefer
+// disabling via /status over deletion if there are live orders.
+// @Summary      Delete API key
+// @Description  Soft-delete an API key
+// @Tags         Admin API Keys
+// @Security     AdminJWT
+// @Produce      json
+// @Param        id path int true "API key ID"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/api-keys/{id} [delete]
+func (c *BaseAdminController) DeleteApiKey(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := data.DeleteApiKeyByID(id); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// GetApiKeyStats returns usage stats for one key. Currently thin — just
+// the stored call_count and last_used_at — since we don't persist per-
+// call telemetry. Expanded later if/when we add a request log table.
+// @Summary      Get API key stats
+// @Description  Returns usage stats (call_count, last_used_at) for an API key
+// @Tags         Admin API Keys
+// @Security     AdminJWT
+// @Produce      json
+// @Param        id path int true "API key ID"
+// @Success      200 {object} response.ApiResponse{data=admin.ApiKeyStatsResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/api-keys/{id}/stats [get]
+func (c *BaseAdminController) GetApiKeyStats(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	row, err := data.GetApiKeyByID(id)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if row.ID == 0 {
+		return c.FailJson(ctx, errors.New("api key not found"))
+	}
+	return c.SucJson(ctx, map[string]interface{}{
+		"call_count":   row.CallCount,
+		"last_used_at": row.LastUsedAt,
+	})
+}
+
+// GetApiKeySecret returns the secret_key for one API key. Requires
+// admin JWT authentication.
+// @Summary      View API key secret
+// @Description  Returns the secret_key for an API key (admin only)
+// @Tags         Admin API Keys
+// @Security     AdminJWT
+// @Produce      json
+// @Param        id path int true "API key ID"
+// @Success      200 {object} response.ApiResponse{data=map[string]string}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/api-keys/{id}/secret [get]
+func (c *BaseAdminController) GetApiKeySecret(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	row, err := data.GetApiKeyByID(id)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if row.ID == 0 {
+		return c.FailJson(ctx, errors.New("api key not found"))
+	}
+	return c.SucJson(ctx, map[string]string{"secret_key": row.SecretKey})
+}
+
+func randomHex(n int) string {
+	b := make([]byte, n)
+	_, _ = rand.Read(b)
+	return hex.EncodeToString(b)
+}

src/controller/admin/auth_controller.go

@@ -0,0 +1,157 @@
+package admin
+
+import (
+	"errors"
+
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	appjwt "github.com/assimon/luuu/util/jwt"
+	"github.com/labstack/echo/v4"
+)
+
+// LoginRequest is the payload for admin login.
+type LoginRequest struct {
+	Username string `json:"username" validate:"required" example:"admin"`
+	Password string `json:"password" validate:"required" example:"password123"`
+}
+
+// LoginResponse is the response for a successful login.
+type LoginResponse struct {
+	Token    string `json:"token" example:"eyJhbGciOiJIUzI1NiIs..."`
+	Username string `json:"username" example:"admin"`
+	UserID   uint64 `json:"user_id" example:"1"`
+}
+
+// ChangePasswordRequest is the payload for changing admin password.
+type ChangePasswordRequest struct {
+	OldPassword string `json:"old_password" validate:"required" example:"old_pass"`
+	NewPassword string `json:"new_password" validate:"required|minLen:6" example:"new_pass123"`
+}
+
+// MeResponse wraps AdminUser with a default-password flag.
+type MeResponse struct {
+	mdb.AdminUser
+	PasswordIsDefault bool `json:"password_is_default" example:"true"`
+}
+
+// Login verifies credentials, stamps last_login_at, returns a signed JWT.
+// @Summary      Admin login
+// @Description  Verify credentials and return a signed JWT token
+// @Tags         Admin Auth
+// @Accept       json
+// @Produce      json
+// @Param        request body admin.LoginRequest true "Login credentials"
+// @Success      200 {object} response.ApiResponse{data=admin.LoginResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/auth/login [post]
+func (c *BaseAdminController) Login(ctx echo.Context) error {
+	req := new(LoginRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	user, err := data.GetAdminUserByUsername(req.Username)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if user.ID == 0 || !data.VerifyPassword(user.PasswordHash, req.Password) {
+		return c.FailJson(ctx, errors.New("invalid username or password"))
+	}
+	if user.Status != mdb.AdminUserStatusEnable {
+		return c.FailJson(ctx, errors.New("user disabled"))
+	}
+	token, err := appjwt.Sign(user.ID, user.Username)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	err = data.TouchAdminUserLastLogin(user.ID)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, LoginResponse{
+		Token:    token,
+		Username: user.Username,
+		UserID:   user.ID,
+	})
+}
+
+// Logout is a no-op stub — tokens are stateless and the frontend
+// discards them. Kept for API symmetry with the documented spec.
+// @Summary      Admin logout
+// @Description  Logout (no-op, frontend discards token)
+// @Tags         Admin Auth
+// @Security     AdminJWT
+// @Produce      json
+// @Success      200 {object} response.ApiResponse
+// @Router       /admin/api/v1/auth/logout [post]
+func (c *BaseAdminController) Logout(ctx echo.Context) error {
+	return c.SucJson(ctx, nil)
+}
+
+// Me returns the currently authenticated admin user profile.
+// @Summary      Get current admin profile
+// @Description  Returns the currently authenticated admin user
+// @Tags         Admin Auth
+// @Security     AdminJWT
+// @Produce      json
+// @Success      200 {object} response.ApiResponse{data=admin.MeResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/auth/me [get]
+func (c *BaseAdminController) Me(ctx echo.Context) error {
+	uid := currentAdminUserID(ctx)
+	if uid == 0 {
+		return c.FailJson(ctx, errors.New("unauthorized"))
+	}
+	user, err := data.GetAdminUserByID(uid)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if user.ID == 0 {
+		return c.FailJson(ctx, errors.New("user not found"))
+	}
+	// Warn the frontend when the operator hasn't changed the default
+	// password so the UI can show a prominent reminder.
+	isDefault := data.VerifyPassword(user.PasswordHash, "admin")
+	return c.SucJson(ctx, MeResponse{
+		AdminUser:         *user,
+		PasswordIsDefault: isDefault,
+	})
+}
+
+// ChangePassword requires the old password, updates to the new one.
+// @Summary      Change admin password
+// @Description  Change the current admin user's password
+// @Tags         Admin Auth
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        request body admin.ChangePasswordRequest true "Password payload"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/auth/password [post]
+func (c *BaseAdminController) ChangePassword(ctx echo.Context) error {
+	uid := currentAdminUserID(ctx)
+	if uid == 0 {
+		return c.FailJson(ctx, errors.New("unauthorized"))
+	}
+	req := new(ChangePasswordRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	user, err := data.GetAdminUserByID(uid)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if user.ID == 0 || !data.VerifyPassword(user.PasswordHash, req.OldPassword) {
+		return c.FailJson(ctx, errors.New("old password incorrect"))
+	}
+	if err := data.UpdateAdminUserPassword(uid, req.NewPassword); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}

src/controller/admin/base.go

@@ -0,0 +1,26 @@
+package admin
+
+import (
+	"github.com/assimon/luuu/controller"
+	"github.com/assimon/luuu/middleware"
+	"github.com/labstack/echo/v4"
+)
+
+// Ctrl is the singleton admin controller. Keeps parity with comm.Ctrl.
+var Ctrl = &BaseAdminController{}
+
+// BaseAdminController aggregates admin-domain handlers. Split across
+// *_controller.go files in this package; all receive methods hang off
+// this type so a single router registration is enough.
+type BaseAdminController struct {
+	controller.BaseController
+}
+
+// currentAdminUserID returns the admin user id injected by CheckAdminJWT.
+// Returns 0 if the middleware is missing (treat as auth bug upstream).
+func currentAdminUserID(ctx echo.Context) uint64 {
+	if v, ok := ctx.Get(middleware.AdminUserIDKey).(uint64); ok {
+		return v
+	}
+	return 0
+}

src/controller/admin/chain_controller.go

@@ -0,0 +1,71 @@
+package admin
+
+import (
+	"github.com/assimon/luuu/model/data"
+	"github.com/labstack/echo/v4"
+)
+
+// UpdateChainRequest is the payload for updating chain settings.
+type UpdateChainRequest struct {
+	Enabled          *bool   `json:"enabled" example:"true"`
+	MinConfirmations *int    `json:"min_confirmations" example:"20"`
+	ScanIntervalSec  *int    `json:"scan_interval_sec" example:"5"`
+	DisplayName      *string `json:"display_name" example:"Tron"`
+}
+
+// ListChains returns the chains table (tron/ethereum/solana seeded; new
+// networks like bsc/polygon inserted manually once supported).
+// @Summary      List chains
+// @Description  Returns all supported blockchain networks
+// @Tags         Admin Chains
+// @Security     AdminJWT
+// @Produce      json
+// @Success      200 {object} response.ApiResponse{data=[]mdb.Chain}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/chains [get]
+func (c *BaseAdminController) ListChains(ctx echo.Context) error {
+	rows, err := data.ListChains()
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, rows)
+}
+
+// UpdateChain toggles enabled / tweaks scan params. Scanners re-read the
+// chains table on every poll tick, so changes take effect within one
+// cycle without a restart.
+// @Summary      Update chain
+// @Description  Toggle enabled / tweak scan params for a chain
+// @Tags         Admin Chains
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        network path string true "Network name (e.g. tron, ethereum, solana)"
+// @Param        request body admin.UpdateChainRequest true "Chain settings"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/chains/{network} [patch]
+func (c *BaseAdminController) UpdateChain(ctx echo.Context) error {
+	network := ctx.Param("network")
+	req := new(UpdateChainRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	fields := map[string]interface{}{}
+	if req.Enabled != nil {
+		fields["enabled"] = *req.Enabled
+	}
+	if req.MinConfirmations != nil {
+		fields["min_confirmations"] = *req.MinConfirmations
+	}
+	if req.ScanIntervalSec != nil {
+		fields["scan_interval_sec"] = *req.ScanIntervalSec
+	}
+	if req.DisplayName != nil {
+		fields["display_name"] = *req.DisplayName
+	}
+	if err := data.UpdateChainFields(network, fields); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}

src/controller/admin/chain_token_controller.go

@@ -0,0 +1,181 @@
+package admin
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/labstack/echo/v4"
+)
+
+// CreateChainTokenRequest is the payload for creating a chain token.
+type CreateChainTokenRequest struct {
+	Network         string  `json:"network" validate:"required" example:"tron"`
+	Symbol          string  `json:"symbol" validate:"required|maxLen:32" example:"USDT"`
+	ContractAddress string  `json:"contract_address" example:"TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t"`
+	Decimals        int     `json:"decimals" example:"6"`
+	Enabled         *bool   `json:"enabled" example:"true"`
+	MinAmount       float64 `json:"min_amount" example:"1.0"`
+}
+
+// UpdateChainTokenRequest is the payload for updating a chain token.
+type UpdateChainTokenRequest struct {
+	ContractAddress *string  `json:"contract_address" example:"TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t"`
+	Decimals        *int     `json:"decimals" example:"6"`
+	Enabled         *bool    `json:"enabled" example:"true"`
+	MinAmount       *float64 `json:"min_amount" example:"1.0"`
+}
+
+// ChangeChainTokenStatusRequest is the payload for toggling chain token status.
+type ChangeChainTokenStatusRequest struct {
+	Enabled bool `json:"enabled" example:"true"`
+}
+
+// ListChainTokens returns rows, optionally filtered by network.
+// @Summary      List chain tokens
+// @Description  Returns chain tokens, optionally filtered by network
+// @Tags         Admin Chain Tokens
+// @Security     AdminJWT
+// @Produce      json
+// @Param        network query string false "Network filter"
+// @Success      200 {object} response.ApiResponse{data=[]mdb.ChainToken}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/chain-tokens [get]
+func (c *BaseAdminController) ListChainTokens(ctx echo.Context) error {
+	network := strings.ToLower(strings.TrimSpace(ctx.QueryParam("network")))
+	rows, err := data.ListChainTokens(network)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, rows)
+}
+
+// CreateChainToken inserts a new row. Default decimals=6 when 0 passed.
+// @Summary      Create chain token
+// @Description  Create a new chain token entry
+// @Tags         Admin Chain Tokens
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        request body admin.CreateChainTokenRequest true "Chain token payload"
+// @Success      200 {object} response.ApiResponse{data=mdb.ChainToken}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/chain-tokens [post]
+func (c *BaseAdminController) CreateChainToken(ctx echo.Context) error {
+	req := new(CreateChainTokenRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	decimals := req.Decimals
+	if decimals == 0 {
+		decimals = 6
+	}
+	enabled := true
+	if req.Enabled != nil {
+		enabled = *req.Enabled
+	}
+	row := &mdb.ChainToken{
+		Network:         strings.ToLower(strings.TrimSpace(req.Network)),
+		Symbol:          strings.ToUpper(strings.TrimSpace(req.Symbol)),
+		ContractAddress: strings.TrimSpace(req.ContractAddress),
+		Decimals:        decimals,
+		Enabled:         enabled,
+		MinAmount:       req.MinAmount,
+	}
+	if err := data.CreateChainToken(row); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, row)
+}
+
+// UpdateChainToken patches mutable columns.
+// @Summary      Update chain token
+// @Description  Patch chain token fields
+// @Tags         Admin Chain Tokens
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        id path int true "Chain token ID"
+// @Param        request body admin.UpdateChainTokenRequest true "Fields to update"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/chain-tokens/{id} [patch]
+func (c *BaseAdminController) UpdateChainToken(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	req := new(UpdateChainTokenRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	fields := map[string]interface{}{}
+	if req.ContractAddress != nil {
+		fields["contract_address"] = *req.ContractAddress
+	}
+	if req.Decimals != nil {
+		fields["decimals"] = *req.Decimals
+	}
+	if req.Enabled != nil {
+		fields["enabled"] = *req.Enabled
+	}
+	if req.MinAmount != nil {
+		fields["min_amount"] = *req.MinAmount
+	}
+	if err := data.UpdateChainTokenFields(id, fields); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// ChangeChainTokenStatus toggles enable/disable.
+// @Summary      Change chain token status
+// @Description  Toggle enable/disable for a chain token
+// @Tags         Admin Chain Tokens
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        id path int true "Chain token ID"
+// @Param        request body admin.ChangeChainTokenStatusRequest true "Status payload"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/chain-tokens/{id}/status [post]
+func (c *BaseAdminController) ChangeChainTokenStatus(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	req := new(ChangeChainTokenStatusRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := data.UpdateChainTokenFields(id, map[string]interface{}{"enabled": req.Enabled}); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// DeleteChainToken soft-deletes the row.
+// @Summary      Delete chain token
+// @Description  Soft-delete a chain token
+// @Tags         Admin Chain Tokens
+// @Security     AdminJWT
+// @Produce      json
+// @Param        id path int true "Chain token ID"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/chain-tokens/{id} [delete]
+func (c *BaseAdminController) DeleteChainToken(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := data.DeleteChainTokenByID(id); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}

src/controller/admin/dashboard_controller.go

@@ -0,0 +1,288 @@
+package admin
+
+import (
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/assimon/luuu/model/data"
+	"github.com/labstack/echo/v4"
+)
+
+// OverviewResponse is the dashboard top-card response.
+type OverviewResponse struct {
+	TotalAsset      float64 `json:"total_asset" example:"12345.6789"`
+	Volume          float64 `json:"volume" example:"100.5"`
+	OrderCount      int64   `json:"order_count" example:"42"`
+	SuccessRate     float64 `json:"success_rate" example:"0.85"`
+	SevenDayVolume  float64 `json:"seven_day_volume" example:"700.25"`
+	ActiveAddresses int64   `json:"active_addresses" example:"5"`
+	OnlineChains    int64   `json:"online_chains" example:"3"`
+}
+
+// OrderStatsResponse is the order statistics response.
+type OrderStatsResponse struct {
+	OrderCount         int64   `json:"order_count" example:"100"`
+	SuccessCount       int64   `json:"success_count" example:"85"`
+	SuccessRate        float64 `json:"success_rate" example:"0.85"`
+	AvgPaymentSeconds  float64 `json:"avg_payment_seconds" example:"120.5"`
+	ExpiredUnpaidCount int64   `json:"expired_unpaid_count" example:"10"`
+}
+
+// RpcHealthCheckResponse is the response for a health check probe.
+type RpcHealthCheckResponse struct {
+	// 健康状态 unknown=未知 ok=正常 down=异常
+	Status        string `json:"status" example:"ok" enums:"unknown,ok,down"`
+	LastLatencyMs int    `json:"last_latency_ms" example:"120"`
+}
+
+// ApiKeyStatsResponse is the response for API key usage stats.
+type ApiKeyStatsResponse struct {
+	CallCount  int64  `json:"call_count" example:"342"`
+	LastUsedAt string `json:"last_used_at" example:"2026-04-14T08:30:00+00:00"`
+}
+
+// RotateSecretResponse is returned when rotating an API key secret.
+type RotateSecretResponse struct {
+	SecretKey string `json:"secret_key" example:"newSecret123abc456"`
+}
+
+// BatchImportResult is one row in the batch import response.
+type BatchImportResult struct {
+	Address string `json:"address" example:"TTestTronAddress001"`
+	OK      bool   `json:"ok" example:"true"`
+	Error   string `json:"error,omitempty" example:""`
+}
+
+// SettingsUpsertResult is one row in the settings upsert response.
+type SettingsUpsertResult struct {
+	Key   string `json:"key" example:"rate.api_url"`
+	OK    bool   `json:"ok" example:"true"`
+	Error string `json:"error,omitempty" example:""`
+}
+
+// Overview returns the top-card numbers for the dashboard landing page.
+// All values are computed with on-demand SQL — no cache — per the design.
+// The selected time range (range / start_at / end_at) is applied to
+// volume, order_count, success_rate and active_addresses.
+// seven_day_volume always covers the rolling past 7 days.
+// total_asset and online_chains are time-independent.
+// @Summary      Dashboard overview
+// @Description  Returns top-card numbers: total asset, volume, success rate, active addresses, etc. Supports ?range= for filtering.
+// @Tags         Admin Dashboard
+// @Security     AdminJWT
+// @Produce      json
+// @Param        range    query string false "Time range: today, 7d, 30d, custom" default(today)
+// @Param        start_at query int    false "Start time (Unix seconds, for custom range)"
+// @Param        end_at   query int    false "End time (Unix seconds, for custom range)"
+// @Success      200 {object} response.ApiResponse{data=admin.OverviewResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/dashboard/overview [get]
+func (c *BaseAdminController) Overview(ctx echo.Context) error {
+	start, end := parseRange(ctx)
+
+	now := time.Now()
+	sevenDaysAgo := startOfDay(now).AddDate(0, 0, -6)
+
+	totalActual, _ := data.SumPaidActualAmount()
+
+	orderCount, successCount, volume, _ := data.PaidStatsInRange(start, end)
+	var successRate float64
+	if orderCount > 0 {
+		successRate = float64(successCount) / float64(orderCount)
+	}
+
+	_, _, sevenDayActual, _ := data.PaidStatsInRange(sevenDaysAgo, now)
+
+	activeAddr, _ := data.ActiveAddressCountInRange(start, end)
+	onlineChains, _ := data.CountEnabledChains()
+
+	return c.SucJson(ctx, map[string]interface{}{
+		"total_asset":      totalActual,
+		"volume":           volume,
+		"order_count":      orderCount,
+		"success_rate":     successRate,
+		"seven_day_volume": sevenDayActual,
+		"active_addresses": activeAddr,
+		"online_chains":    onlineChains,
+	})
+}
+
+// isHourlyRange returns true when the time window spans ≤ 1 day,
+// so callers can choose hourly vs daily granularity.
+func isHourlyRange(start, end time.Time) bool {
+	return end.Sub(start) <= 24*time.Hour
+}
+
+// AssetTrend returns per-day actual_amount for paid orders. group_by=
+// "total" yields one series; "address" yields rows keyed by
+// receive_address for the stacked chart.
+// Granularity: hourly when range ≤ 1 day, daily otherwise.
+// Missing buckets are always zero-filled.
+// @Summary      Asset trend
+// @Description  Returns per-period actual_amount for paid orders. Hourly for ≤1-day ranges, daily otherwise. Missing buckets are zero-filled.
+// @Tags         Admin Dashboard
+// @Security     AdminJWT
+// @Produce      json
+// @Param        range query string false "Time range: today, 7d, 30d, custom" default(today)
+// @Param        start_at query int false "Start time (Unix seconds, for custom range)"
+// @Param        end_at query int false "End time (Unix seconds, for custom range)"
+// @Param        group_by query string false "Group by: total or address" default(total)
+// @Success      200 {object} response.ApiResponse{data=[]data.DailyStat}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/dashboard/asset-trend [get]
+func (c *BaseAdminController) AssetTrend(ctx echo.Context) error {
+	start, end := parseRange(ctx)
+	groupBy := strings.ToLower(strings.TrimSpace(ctx.QueryParam("group_by")))
+	hourly := isHourlyRange(start, end)
+	if groupBy == "address" {
+		var rows interface{}
+		var err error
+		if hourly {
+			rows, err = data.HourlyAssetByAddress(start, end)
+		} else {
+			rows, err = data.DailyAssetByAddress(start, end)
+		}
+		if err != nil {
+			return c.FailJson(ctx, err)
+		}
+		return c.SucJson(ctx, rows)
+	}
+	var rows interface{}
+	var err error
+	if hourly {
+		rows, err = data.HourlyOrderStats(start, end)
+	} else {
+		rows, err = data.DailyOrderStats(start, end)
+	}
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, rows)
+}
+
+// RevenueTrend mirrors the daily stats view used for revenue charts.
+// Same data shape as AssetTrend(group_by=total) but kept as its own
+// endpoint so the frontend can evolve each chart independently.
+// Granularity: hourly when range ≤ 1 day, daily otherwise.
+// Missing buckets are always zero-filled.
+// @Summary      Revenue trend
+// @Description  Returns per-period revenue stats for charts. Hourly for ≤1-day ranges, daily otherwise. Missing buckets are zero-filled.
+// @Tags         Admin Dashboard
+// @Security     AdminJWT
+// @Produce      json
+// @Param        range query string false "Time range: today, 7d, 30d, custom" default(today)
+// @Param        start_at query int false "Start time (Unix seconds, for custom range)"
+// @Param        end_at query int false "End time (Unix seconds, for custom range)"
+// @Success      200 {object} response.ApiResponse{data=[]data.DailyStat}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/dashboard/revenue-trend [get]
+func (c *BaseAdminController) RevenueTrend(ctx echo.Context) error {
+	start, end := parseRange(ctx)
+	var rows interface{}
+	var err error
+	if isHourlyRange(start, end) {
+		rows, err = data.HourlyOrderStats(start, end)
+	} else {
+		rows, err = data.DailyOrderStats(start, end)
+	}
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, rows)
+}
+
+// OrderStats returns aggregate order figures for the selected window:
+// total count, success rate, average payment duration (seconds), and
+// expired-unpaid count.
+// @Summary      Order statistics
+// @Description  Returns aggregate order figures: count, success rate, avg payment time, expired count
+// @Tags         Admin Dashboard
+// @Security     AdminJWT
+// @Produce      json
+// @Param        range query string false "Time range: today, 7d, 30d, custom" default(today)
+// @Param        start_at query int false "Start time (Unix seconds, for custom range)"
+// @Param        end_at query int false "End time (Unix seconds, for custom range)"
+// @Success      200 {object} response.ApiResponse{data=admin.OrderStatsResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/dashboard/order-stats [get]
+func (c *BaseAdminController) OrderStats(ctx echo.Context) error {
+	start, end := parseRange(ctx)
+	total, success, _, err := data.PaidStatsInRange(start, end)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	avg, _ := data.AveragePaymentDurationSeconds(start, end)
+	expired, _ := data.CountExpiredInRange(start, end)
+
+	var rate float64
+	if total > 0 {
+		rate = float64(success) / float64(total)
+	}
+	return c.SucJson(ctx, map[string]interface{}{
+		"order_count":          total,
+		"success_count":        success,
+		"success_rate":         rate,
+		"avg_payment_seconds":  avg,
+		"expired_unpaid_count": expired,
+	})
+}
+
+// RecentOrders returns the last N orders for the dashboard list card.
+// @Summary      Recent orders
+// @Description  Returns the last N orders for the dashboard
+// @Tags         Admin Dashboard
+// @Security     AdminJWT
+// @Produce      json
+// @Param        limit query int false "Number of orders to return" default(20)
+// @Success      200 {object} response.ApiResponse{data=[]mdb.Orders}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/dashboard/recent-orders [get]
+func (c *BaseAdminController) RecentOrders(ctx echo.Context) error {
+	limit := 20
+	if s := ctx.QueryParam("limit"); s != "" {
+		if n, err := strconv.Atoi(s); err == nil {
+			limit = n
+		}
+	}
+	rows, err := data.RecentOrders(limit)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, rows)
+}
+
+// parseRange maps the ?range=... shorthand to a concrete [start, end].
+// Accepted: today / 7d / 30d / custom (with start_at/end_at Unix secs).
+// Defaults to today.
+func parseRange(ctx echo.Context) (time.Time, time.Time) {
+	rng := strings.ToLower(strings.TrimSpace(ctx.QueryParam("range")))
+	now := time.Now()
+	todayStart := startOfDay(now)
+	switch rng {
+	case "7d":
+		return todayStart.AddDate(0, 0, -6), now
+	case "30d":
+		return todayStart.AddDate(0, 0, -29), now
+	case "custom":
+		start := todayStart
+		end := now
+		if s := ctx.QueryParam("start_at"); s != "" {
+			if n, err := strconv.ParseInt(s, 10, 64); err == nil {
+				start = time.Unix(n, 0)
+			}
+		}
+		if s := ctx.QueryParam("end_at"); s != "" {
+			if n, err := strconv.ParseInt(s, 10, 64); err == nil {
+				end = time.Unix(n, 0)
+			}
+		}
+		return start, end
+	default:
+		return todayStart, now
+	}
+}
+
+func startOfDay(t time.Time) time.Time {
+	return time.Date(t.Year(), t.Month(), t.Day(), 0, 0, 0, 0, t.Location())
+}

src/controller/admin/notification_controller.go

@@ -0,0 +1,314 @@
+package admin
+
+import (
+	"encoding/json"
+	"errors"
+	"strconv"
+	"strings"
+
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/assimon/luuu/notify"
+	"github.com/assimon/luuu/telegram"
+	"github.com/labstack/echo/v4"
+)
+
+// CreateNotificationChannelRequest is the payload for creating a notification channel.
+type CreateNotificationChannelRequest struct {
+	Type    string                 `json:"type" validate:"required|in:telegram,webhook,email" enums:"telegram,webhook,email" example:"telegram"`
+	Name    string                 `json:"name" validate:"required|maxLen:128" example:"主通知群"`
+	Config  map[string]interface{} `json:"config" validate:"required"`
+	Events  interface{}            `json:"events"`
+	Enabled *bool                  `json:"enabled" example:"true"`
+}
+
+// UpdateNotificationChannelRequest is the payload for updating a notification channel.
+type UpdateNotificationChannelRequest struct {
+	Name    *string                `json:"name" example:"更新后的名称"`
+	Config  map[string]interface{} `json:"config"`
+	Events  interface{}            `json:"events"`
+	Enabled *bool                  `json:"enabled" example:"true"`
+}
+
+// ChangeChannelStatusRequest is the payload for toggling notification channel status.
+type ChangeChannelStatusRequest struct {
+	Enabled bool `json:"enabled" example:"true"`
+}
+
+// ListNotificationChannels lists rows, optionally filtered by type.
+// @Summary      List notification channels
+// @Description  Returns notification channels, optionally filtered by type
+// @Tags         Admin Notifications
+// @Security     AdminJWT
+// @Produce      json
+// @Param        type query string false "Channel type: telegram, webhook, email"
+// @Success      200 {object} response.ApiResponse{data=[]mdb.NotificationChannel}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/notification-channels [get]
+func (c *BaseAdminController) ListNotificationChannels(ctx echo.Context) error {
+	channelType := strings.ToLower(strings.TrimSpace(ctx.QueryParam("type")))
+	rows, err := data.ListNotificationChannels(channelType)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, rows)
+}
+
+// CreateNotificationChannel validates Config shape per type (only
+// telegram is strongly validated today) and inserts a row.
+// @Summary      Create notification channel
+// @Description  Create a new notification channel
+// @Tags         Admin Notifications
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        request body admin.CreateNotificationChannelRequest true "Channel payload"
+// @Success      200 {object} response.ApiResponse{data=mdb.NotificationChannel}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/notification-channels [post]
+func (c *BaseAdminController) CreateNotificationChannel(ctx echo.Context) error {
+	req := new(CreateNotificationChannelRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	req.Type = strings.ToLower(strings.TrimSpace(req.Type))
+	if err := c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := validateChannelConfig(req.Type, req.Config); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	eventsMap, err := normalizeChannelEvents(req.Events)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	configJSON, _ := json.Marshal(req.Config)
+	eventsJSON, _ := json.Marshal(eventsMap)
+
+	enabled := true
+	if req.Enabled != nil {
+		enabled = *req.Enabled
+	}
+	row := &mdb.NotificationChannel{
+		Type:    req.Type,
+		Name:    req.Name,
+		Config:  string(configJSON),
+		Events:  string(eventsJSON),
+		Enabled: enabled,
+	}
+	if err := data.CreateNotificationChannel(row); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if strings.ToLower(strings.TrimSpace(row.Type)) == mdb.NotificationTypeTelegram {
+		telegram.ReloadBotAsync("admin create telegram channel")
+	}
+	return c.SucJson(ctx, row)
+}
+
+// UpdateNotificationChannel patches name/config/events/enabled.
+// @Summary      Update notification channel
+// @Description  Patch notification channel fields
+// @Tags         Admin Notifications
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        id path int true "Channel ID"
+// @Param        request body admin.UpdateNotificationChannelRequest true "Fields to update"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/notification-channels/{id} [patch]
+func (c *BaseAdminController) UpdateNotificationChannel(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	existing, err := data.GetNotificationChannelByID(id)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	isTelegram := existing != nil && existing.ID > 0 && strings.ToLower(strings.TrimSpace(existing.Type)) == mdb.NotificationTypeTelegram
+
+	req := new(UpdateNotificationChannelRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	fields := map[string]interface{}{}
+	if req.Name != nil {
+		fields["name"] = *req.Name
+	}
+	if req.Config != nil {
+		configJSON, _ := json.Marshal(req.Config)
+		fields["config"] = string(configJSON)
+	}
+	if req.Events != nil {
+		eventsMap, err := normalizeChannelEvents(req.Events)
+		if err != nil {
+			return c.FailJson(ctx, err)
+		}
+		eventsJSON, _ := json.Marshal(eventsMap)
+		fields["events"] = string(eventsJSON)
+	}
+	if req.Enabled != nil {
+		fields["enabled"] = *req.Enabled
+	}
+	if err := data.UpdateNotificationChannelFields(id, fields); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if isTelegram {
+		telegram.ReloadBotAsync("admin update telegram channel")
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// ChangeNotificationChannelStatus toggles enabled.
+// @Summary      Change notification channel status
+// @Description  Toggle enable/disable for a notification channel
+// @Tags         Admin Notifications
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        id path int true "Channel ID"
+// @Param        request body admin.ChangeChannelStatusRequest true "Status payload"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/notification-channels/{id}/status [post]
+func (c *BaseAdminController) ChangeNotificationChannelStatus(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	existing, err := data.GetNotificationChannelByID(id)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	isTelegram := existing != nil && existing.ID > 0 && strings.ToLower(strings.TrimSpace(existing.Type)) == mdb.NotificationTypeTelegram
+
+	req := new(ChangeChannelStatusRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := data.UpdateNotificationChannelFields(id, map[string]interface{}{"enabled": req.Enabled}); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if isTelegram {
+		telegram.ReloadBotAsync("admin change telegram channel status")
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// DeleteNotificationChannel soft-deletes the row.
+// @Summary      Delete notification channel
+// @Description  Soft-delete a notification channel
+// @Tags         Admin Notifications
+// @Security     AdminJWT
+// @Produce      json
+// @Param        id path int true "Channel ID"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/notification-channels/{id} [delete]
+func (c *BaseAdminController) DeleteNotificationChannel(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	existing, err := data.GetNotificationChannelByID(id)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	isTelegram := existing != nil && existing.ID > 0 && strings.ToLower(strings.TrimSpace(existing.Type)) == mdb.NotificationTypeTelegram
+
+	if err := data.DeleteNotificationChannelByID(id); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if isTelegram {
+		telegram.ReloadBotAsync("admin delete telegram channel")
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// validateChannelConfig enforces minimum shape. Telegram needs bot_token
+// + chat_id; webhook/email kept loose until those senders exist.
+func validateChannelConfig(channelType string, cfg map[string]interface{}) error {
+	if cfg == nil {
+		return errors.New("config required")
+	}
+	if channelType == mdb.NotificationTypeTelegram {
+		configJSON, _ := json.Marshal(cfg)
+		if _, err := notify.ParseTelegramConfig(string(configJSON)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func normalizeChannelEvents(raw interface{}) (map[string]bool, error) {
+	if raw == nil {
+		return map[string]bool{}, nil
+	}
+
+	toFlag := func(v interface{}) (bool, error) {
+		switch t := v.(type) {
+		case bool:
+			return t, nil
+		case float64:
+			return t != 0, nil
+		case string:
+			s := strings.ToLower(strings.TrimSpace(t))
+			switch s {
+			case "", "0", "false", "off", "no":
+				return false, nil
+			case "1", "true", "on", "yes":
+				return true, nil
+			default:
+				return false, errors.New("invalid boolean string")
+			}
+		default:
+			return false, errors.New("invalid event value type")
+		}
+	}
+
+	trimKey := func(s string) string {
+		return strings.TrimSpace(s)
+	}
+
+	out := make(map[string]bool)
+	switch t := raw.(type) {
+	case map[string]bool:
+		for k, v := range t {
+			k = trimKey(k)
+			if k == "" {
+				continue
+			}
+			out[k] = v
+		}
+		return out, nil
+	case map[string]interface{}:
+		for k, v := range t {
+			k = trimKey(k)
+			if k == "" {
+				continue
+			}
+			flag, err := toFlag(v)
+			if err != nil {
+				return nil, err
+			}
+			out[k] = flag
+		}
+		return out, nil
+	case []interface{}:
+		for _, v := range t {
+			s, ok := v.(string)
+			if !ok {
+				return nil, errors.New("events array must contain strings")
+			}
+			s = trimKey(s)
+			if s == "" {
+				continue
+			}
+			out[s] = true
+		}
+		return out, nil
+	default:
+		return nil, errors.New("events must be object or string array")
+	}
+}

src/controller/admin/order_controller.go

@@ -0,0 +1,393 @@
+package admin
+
+import (
+	"encoding/csv"
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/assimon/luuu/model/request"
+	"github.com/assimon/luuu/model/service"
+	"github.com/labstack/echo/v4"
+)
+
+// MarkPaidRequest is the payload for manually marking an order as paid.
+type MarkPaidRequest struct {
+	BlockTransactionId string `json:"block_transaction_id" validate:"required" example:"0xabc123def456..."`
+}
+
+// OrderListResponse wraps the paginated order list.
+type OrderListResponse struct {
+	List     []mdb.Orders `json:"list"`
+	Total    int64        `json:"total" example:"100"`
+	Page     int          `json:"page" example:"1"`
+	PageSize int          `json:"page_size" example:"20"`
+}
+
+// OrderWithSub embeds a parent order together with its child orders.
+type OrderWithSub struct {
+	mdb.Orders
+	SubOrders []mdb.Orders `json:"sub_orders"`
+}
+
+// OrderWithSubListResponse wraps the paginated list-with-sub result.
+type OrderWithSubListResponse struct {
+	List     []OrderWithSub `json:"list"`
+	Total    int64          `json:"total" example:"100"`
+	Page     int            `json:"page" example:"1"`
+	PageSize int            `json:"page_size" example:"20"`
+}
+
+// ListOrders handles the admin order list with filters + pagination.
+// @Summary      List orders
+// @Description  Returns paginated orders with optional filters
+// @Tags         Admin Orders
+// @Security     AdminJWT
+// @Produce      json
+// @Param        network query string false "Network filter"
+// @Param        token query string false "Token filter"
+// @Param        address query string false "Receive address filter"
+// @Param        keyword query string false "Keyword search (trade_id or order_id)"
+// @Param        status query int false "Order status filter"
+// @Param        start_at query int false "Start time (Unix seconds)"
+// @Param        end_at query int false "End time (Unix seconds)"
+// @Param        page query int false "Page number" default(1)
+// @Param        page_size query int false "Page size" default(20)
+// @Success      200 {object} response.ApiResponse{data=admin.OrderListResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/orders [get]
+func (c *BaseAdminController) ListOrders(ctx echo.Context) error {
+	f := parseOrderFilter(ctx)
+	rows, total, err := data.ListOrders(f)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, map[string]interface{}{
+		"list":      rows,
+		"total":     total,
+		"page":      f.Page,
+		"page_size": f.PageSize,
+	})
+}
+
+// GetOrder returns full order detail by trade_id.
+// @Summary      Get order
+// @Description  Returns full order detail by trade_id
+// @Tags         Admin Orders
+// @Security     AdminJWT
+// @Produce      json
+// @Param        trade_id path string true "Trade ID"
+// @Success      200 {object} response.ApiResponse{data=mdb.Orders}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/orders/{trade_id} [get]
+func (c *BaseAdminController) GetOrder(ctx echo.Context) error {
+	tradeID := ctx.Param("trade_id")
+	order, err := data.GetOrderInfoByTradeId(tradeID)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if order.ID == 0 {
+		return c.FailJson(ctx, errors.New("order not found"))
+	}
+	return c.SucJson(ctx, order)
+}
+
+// CloseOrder flips a waiting order to expired and releases its lock.
+// @Summary      Close order
+// @Description  Manually close a waiting order (mark as expired)
+// @Tags         Admin Orders
+// @Security     AdminJWT
+// @Produce      json
+// @Param        trade_id path string true "Trade ID"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/orders/{trade_id}/close [post]
+func (c *BaseAdminController) CloseOrder(ctx echo.Context) error {
+	tradeID := ctx.Param("trade_id")
+	order, err := data.GetOrderInfoByTradeId(tradeID)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if order.ID == 0 {
+		return c.FailJson(ctx, errors.New("order not found"))
+	}
+	if order.Status != mdb.StatusWaitPay {
+		return c.FailJson(ctx, errors.New("order is not waiting payment"))
+	}
+	ok, err := data.CloseOrderManually(tradeID)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if !ok {
+		return c.FailJson(ctx, errors.New("close failed (concurrent state change)"))
+	}
+	// Release the transaction lock so the amount slot becomes reusable.
+	_ = data.UnLockTransaction(order.Network, order.ReceiveAddress, order.Token, order.ActualAmount)
+	return c.SucJson(ctx, nil)
+}
+
+// MarkOrderPaid manually marks an order paid (operator补单). Uses the
+// same OrderProcessing path as on-chain confirmation so downstream
+// callback + notification fire normally.
+// @Summary      Mark order paid
+// @Description  Manually mark a waiting order as paid (operator补单)
+// @Tags         Admin Orders
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        trade_id path string true "Trade ID"
+// @Param        request body admin.MarkPaidRequest true "Block transaction ID"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/orders/{trade_id}/mark-paid [post]
+func (c *BaseAdminController) MarkOrderPaid(ctx echo.Context) error {
+	tradeID := ctx.Param("trade_id")
+	req := new(MarkPaidRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	order, err := data.GetOrderInfoByTradeId(tradeID)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if order.ID == 0 {
+		return c.FailJson(ctx, errors.New("order not found"))
+	}
+	if order.Status != mdb.StatusWaitPay {
+		return c.FailJson(ctx, errors.New("order is not waiting payment"))
+	}
+	err = service.OrderProcessing(&request.OrderProcessingRequest{
+		ReceiveAddress:     order.ReceiveAddress,
+		Currency:           order.Currency,
+		Token:              order.Token,
+		Network:            order.Network,
+		Amount:             order.ActualAmount,
+		TradeId:            order.TradeId,
+		BlockTransactionId: req.BlockTransactionId,
+	})
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// ResendCallback requeues the order callback by flipping
+// callback_confirm back to NO. The mq worker will grab it on the
+// next poll tick.
+// @Summary      Resend callback
+// @Description  Re-queue the order callback notification
+// @Tags         Admin Orders
+// @Security     AdminJWT
+// @Produce      json
+// @Param        trade_id path string true "Trade ID"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/orders/{trade_id}/resend-callback [post]
+func (c *BaseAdminController) ResendCallback(ctx echo.Context) error {
+	tradeID := ctx.Param("trade_id")
+	ok, err := data.ReopenOrderCallback(tradeID)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if !ok {
+		return c.FailJson(ctx, errors.New("order is not paid (callback not applicable)"))
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// ExportOrders streams matching orders as CSV. No pagination — the
+// caller drives what rows to include via filter params. Capped at
+// 10k rows to keep the response bounded.
+// @Summary      Export orders as CSV
+// @Description  Stream matching orders as a CSV file (max 10k rows)
+// @Tags         Admin Orders
+// @Security     AdminJWT
+// @Produce      text/csv
+// @Param        network query string false "Network filter"
+// @Param        token query string false "Token filter"
+// @Param        address query string false "Receive address filter"
+// @Param        keyword query string false "Keyword search"
+// @Param        status query int false "Order status filter"
+// @Param        start_at query int false "Start time (Unix seconds)"
+// @Param        end_at query int false "End time (Unix seconds)"
+// @Success      200 {string} string "CSV file"
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/orders/export [get]
+func (c *BaseAdminController) ExportOrders(ctx echo.Context) error {
+	f := parseOrderFilter(ctx)
+	f.Page = 1
+	f.PageSize = 10000
+	rows, _, err := data.ListOrders(f)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	resp := ctx.Response()
+	resp.Header().Set(echo.HeaderContentType, "text/csv; charset=utf-8")
+	resp.Header().Set(echo.HeaderContentDisposition, "attachment; filename=orders.csv")
+	resp.WriteHeader(http.StatusOK)
+
+	w := csv.NewWriter(resp.Writer)
+	_ = w.Write([]string{"trade_id", "order_id", "amount", "actual_amount", "currency", "token", "network", "receive_address", "status", "block_transaction_id", "created_at"})
+	for _, r := range rows {
+		_ = w.Write([]string{
+			r.TradeId,
+			r.OrderId,
+			fmt.Sprintf("%.4f", r.Amount),
+			fmt.Sprintf("%.4f", r.ActualAmount),
+			r.Currency,
+			r.Token,
+			r.Network,
+			r.ReceiveAddress,
+			strconv.Itoa(r.Status),
+			r.BlockTransactionId,
+			r.CreatedAt.ToDateTimeString(),
+		})
+	}
+	w.Flush()
+	return nil
+}
+
+// parseOrderFilter extracts filter + pagination values from the query
+// string. Time params are Unix seconds.
+func parseOrderFilter(ctx echo.Context) data.OrderListFilter {
+	f := data.OrderListFilter{
+		Network: strings.ToLower(strings.TrimSpace(ctx.QueryParam("network"))),
+		Token:   strings.ToUpper(strings.TrimSpace(ctx.QueryParam("token"))),
+		Address: strings.TrimSpace(ctx.QueryParam("address")),
+		Keyword: strings.TrimSpace(ctx.QueryParam("keyword")),
+	}
+	if s := ctx.QueryParam("status"); s != "" {
+		if n, err := strconv.Atoi(s); err == nil {
+			f.Status = n
+		}
+	}
+	if s := ctx.QueryParam("start_at"); s != "" {
+		if n, err := strconv.ParseInt(s, 10, 64); err == nil {
+			t := time.Unix(n, 0)
+			f.StartAt = &t
+		}
+	}
+	if s := ctx.QueryParam("end_at"); s != "" {
+		if n, err := strconv.ParseInt(s, 10, 64); err == nil {
+			t := time.Unix(n, 0)
+			f.EndAt = &t
+		}
+	}
+	if s := ctx.QueryParam("page"); s != "" {
+		if n, err := strconv.Atoi(s); err == nil {
+			f.Page = n
+		}
+	}
+	if s := ctx.QueryParam("page_size"); s != "" {
+		if n, err := strconv.Atoi(s); err == nil {
+			f.PageSize = n
+		}
+	}
+	if f.Page < 1 {
+		f.Page = 1
+	}
+	if f.PageSize < 1 {
+		f.PageSize = 20
+	}
+	return f
+}
+
+// ListOrdersWithSub returns the same paginated order list as ListOrders but
+// each row has a sub_orders field containing all child orders under it.
+// @Summary      List orders with sub-orders
+// @Description  Returns paginated orders; each item embeds its child orders in sub_orders
+// @Tags         Admin Orders
+// @Security     AdminJWT
+// @Produce      json
+// @Param        network query string false "Network filter"
+// @Param        token query string false "Token filter"
+// @Param        address query string false "Receive address filter"
+// @Param        keyword query string false "Keyword search (trade_id or order_id)"
+// @Param        status query int false "Order status filter"
+// @Param        start_at query int false "Start time (Unix seconds)"
+// @Param        end_at query int false "End time (Unix seconds)"
+// @Param        page query int false "Page number" default(1)
+// @Param        page_size query int false "Page size" default(20)
+// @Success      200 {object} response.ApiResponse{data=admin.OrderWithSubListResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/orders/list-with-sub [get]
+func (c *BaseAdminController) ListOrdersWithSub(ctx echo.Context) error {
+	f := parseOrderFilter(ctx)
+	// Only parent orders at the top level; sub-orders appear nested inside sub_orders.
+	f.ParentOnly = true
+	rows, total, err := data.ListOrders(f)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+
+	// Batch-fetch all sub-orders for the current page in one query.
+	tradeIds := make([]string, 0, len(rows))
+	for _, r := range rows {
+		tradeIds = append(tradeIds, r.TradeId)
+	}
+	subs, err := data.GetSubOrdersByParentTradeIds(tradeIds)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+
+	// Group sub-orders by parent_trade_id.
+	subMap := make(map[string][]mdb.Orders, len(subs))
+	for _, s := range subs {
+		subMap[s.ParentTradeId] = append(subMap[s.ParentTradeId], s)
+	}
+
+	list := make([]OrderWithSub, 0, len(rows))
+	for _, r := range rows {
+		children := subMap[r.TradeId]
+		if children == nil {
+			children = []mdb.Orders{}
+		}
+		list = append(list, OrderWithSub{Orders: r, SubOrders: children})
+	}
+
+	return c.SucJson(ctx, OrderWithSubListResponse{
+		List:     list,
+		Total:    total,
+		Page:     f.Page,
+		PageSize: f.PageSize,
+	})
+}
+
+// GetOrderWithSub returns a single parent order together with all its child
+// orders (any status), regardless of whether the caller passes a parent or
+// child trade_id — if it is a child, the parent is resolved first.
+// @Summary      Get order with sub-orders
+// @Description  Returns an order and its child orders embedded in sub_orders
+// @Tags         Admin Orders
+// @Security     AdminJWT
+// @Produce      json
+// @Param        trade_id path string true "Trade ID"
+// @Success      200 {object} response.ApiResponse{data=admin.OrderWithSub}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/orders/{trade_id}/with-sub [get]
+func (c *BaseAdminController) GetOrderWithSub(ctx echo.Context) error {
+	tradeID := ctx.Param("trade_id")
+	order, err := data.GetOrderInfoByTradeId(tradeID)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if order.ID == 0 {
+		return c.FailJson(ctx, errors.New("order not found"))
+	}
+	subOrders, err := data.GetAllSubOrders(tradeID)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if subOrders == nil {
+		subOrders = []mdb.Orders{}
+	}
+	return c.SucJson(ctx, OrderWithSub{Orders: *order, SubOrders: subOrders})
+}

src/controller/admin/rpc_controller.go

@@ -0,0 +1,190 @@
+package admin
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/assimon/luuu/task"
+	"github.com/labstack/echo/v4"
+)
+
+// CreateRpcNodeRequest is the payload for creating an RPC node.
+type CreateRpcNodeRequest struct {
+	Network string `json:"network" validate:"required" example:"tron"`
+	Url string `json:"url" validate:"required" example:"https://api.trongrid.io"`
+	// 连接类型 http=HTTP请求 ws=WebSocket长连接
+	Type string `json:"type" validate:"required|in:http,ws" enums:"http,ws" example:"http"`
+	Weight  int    `json:"weight" example:"1"`
+	ApiKey  string `json:"api_key" example:""`
+	Enabled *bool  `json:"enabled" example:"true"`
+}
+
+// UpdateRpcNodeRequest is the payload for updating an RPC node.
+type UpdateRpcNodeRequest struct {
+	Url     *string `json:"url" example:"https://api.trongrid.io"`
+	Weight  *int    `json:"weight" example:"1"`
+	ApiKey  *string `json:"api_key" example:"your-api-key"`
+	Enabled *bool   `json:"enabled" example:"true"`
+}
+
+// ListRpcNodes returns rows optionally filtered by network.
+// @Summary      List RPC nodes
+// @Description  Returns RPC nodes, optionally filtered by network
+// @Tags         Admin RPC Nodes
+// @Security     AdminJWT
+// @Produce      json
+// @Param        network query string false "Network filter"
+// @Success      200 {object} response.ApiResponse{data=[]mdb.RpcNode}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/rpc-nodes [get]
+func (c *BaseAdminController) ListRpcNodes(ctx echo.Context) error {
+	network := strings.ToLower(strings.TrimSpace(ctx.QueryParam("network")))
+	rows, err := data.ListRpcNodes(network)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, rows)
+}
+
+// CreateRpcNode inserts a row. Status starts as "unknown" until the
+// health-check task runs.
+// @Summary      Create RPC node
+// @Description  Create a new RPC node
+// @Tags         Admin RPC Nodes
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        request body admin.CreateRpcNodeRequest true "RPC node payload"
+// @Success      200 {object} response.ApiResponse{data=mdb.RpcNode}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/rpc-nodes [post]
+func (c *BaseAdminController) CreateRpcNode(ctx echo.Context) error {
+	req := new(CreateRpcNodeRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	weight := req.Weight
+	if weight < 1 {
+		weight = 1
+	}
+	enabled := true
+	if req.Enabled != nil {
+		enabled = *req.Enabled
+	}
+	row := &mdb.RpcNode{
+		Network:       strings.ToLower(strings.TrimSpace(req.Network)),
+		Url:           strings.TrimSpace(req.Url),
+		Type:          strings.ToLower(strings.TrimSpace(req.Type)),
+		Weight:        weight,
+		ApiKey:        req.ApiKey,
+		Enabled:       enabled,
+		Status:        mdb.RpcNodeStatusUnknown,
+		LastLatencyMs: -1,
+	}
+	if err := data.CreateRpcNode(row); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, row)
+}
+
+// UpdateRpcNode patches url/weight/api_key/enabled.
+// @Summary      Update RPC node
+// @Description  Patch RPC node fields
+// @Tags         Admin RPC Nodes
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        id path int true "RPC node ID"
+// @Param        request body admin.UpdateRpcNodeRequest true "Fields to update"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/rpc-nodes/{id} [patch]
+func (c *BaseAdminController) UpdateRpcNode(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	req := new(UpdateRpcNodeRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	fields := map[string]interface{}{}
+	if req.Url != nil {
+		fields["url"] = *req.Url
+	}
+	if req.Weight != nil {
+		fields["weight"] = *req.Weight
+	}
+	if req.ApiKey != nil {
+		fields["api_key"] = *req.ApiKey
+	}
+	if req.Enabled != nil {
+		fields["enabled"] = *req.Enabled
+	}
+	if err := data.UpdateRpcNodeFields(id, fields); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// DeleteRpcNode soft-deletes the row.
+// @Summary      Delete RPC node
+// @Description  Soft-delete an RPC node
+// @Tags         Admin RPC Nodes
+// @Security     AdminJWT
+// @Produce      json
+// @Param        id path int true "RPC node ID"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/rpc-nodes/{id} [delete]
+func (c *BaseAdminController) DeleteRpcNode(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := data.DeleteRpcNodeByID(id); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// HealthCheckRpcNode performs an on-demand probe and writes the result.
+// For HTTP endpoints this is a GET to the URL with a short timeout; for
+// WS we just attempt a TCP-level check via the same HTTP client (the
+// handshake URL resolves the host identically).
+// @Summary      Health check RPC node
+// @Description  Perform an on-demand health probe on an RPC node
+// @Tags         Admin RPC Nodes
+// @Security     AdminJWT
+// @Produce      json
+// @Param        id path int true "RPC node ID"
+// @Success      200 {object} response.ApiResponse{data=admin.RpcHealthCheckResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/rpc-nodes/{id}/health-check [post]
+func (c *BaseAdminController) HealthCheckRpcNode(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	row, err := data.GetRpcNodeByID(id)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if row.ID == 0 {
+		return c.FailJson(ctx, errors.New("node not found"))
+	}
+	status, latency := task.ProbeNode(row.Url)
+	if err := data.UpdateRpcNodeHealth(id, status, latency); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, map[string]interface{}{
+		"status":          status,
+		"last_latency_ms": latency,
+	})
+}

src/controller/admin/settings_controller.go

@@ -0,0 +1,159 @@
+package admin
+
+import (
+	"strings"
+
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/assimon/luuu/telegram"
+	"github.com/labstack/echo/v4"
+)
+
+// SettingUpsertItem is a single setting entry for batch upsert.
+// Supported groups and keys:
+//
+//   - group=rate:
+//     rate.forced_usdt_rate  (float)  — override USDT exchange rate (0 = use api)
+//     rate.api_url           (string) — external rate API URL
+//     rate.adjust_percent    (float)  — rate adjustment percentage
+//     rate.okx_c2c_enabled   (bool)   — use OKX C2C rate feed
+//
+//   - group=epay:
+//     epay.default_token     (string) — token for EPAY orders, e.g. "usdt" (default)
+//     epay.default_currency  (string) — fiat currency for EPAY orders, e.g. "cny" (default)
+//     epay.default_network   (string) — blockchain network for EPAY orders, e.g. "tron" (default)
+//
+//   - group=brand:
+//     brand.site_name        (string) — site display name
+//     brand.logo_url         (string) — logo image URL
+//     brand.page_title       (string) — payment page title
+//     brand.pay_success_text (string) — text shown on payment success
+//     brand.support_url      (string) — support / help URL
+//
+//   - group=system:
+//     system.order_expiration_time (int) — order expiry in minutes
+type SettingUpsertItem struct {
+	Group string `json:"group" enums:"brand,rate,system,epay" example:"epay"`
+	Key   string `json:"key" example:"epay.default_network"`
+	Value string `json:"value" example:"tron"`
+	Type  string `json:"type" enums:"string,int,bool,json" example:"string"`
+}
+
+// SettingsUpsertRequest is the payload for batch upserting settings.
+type SettingsUpsertRequest struct {
+	Items []SettingUpsertItem `json:"items" validate:"required"`
+}
+
+// ListSettings returns all rows, optionally filtered by group.
+// @Summary      List settings
+// @Description  Returns all settings, optionally filtered by group.
+// @Description  Available groups: brand, rate, system, epay.
+// @Description  See SettingUpsertItem for the full list of supported keys per group.
+// @Tags         Admin Settings
+// @Security     AdminJWT
+// @Produce      json
+// @Param        group query string false "Group filter (brand|rate|system|epay)"
+// @Success      200 {object} response.ApiResponse{data=[]mdb.Setting}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/settings [get]
+func (c *BaseAdminController) ListSettings(ctx echo.Context) error {
+	group := strings.ToLower(strings.TrimSpace(ctx.QueryParam("group")))
+	rows, err := data.ListSettingsByGroup(group)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, rows)
+}
+
+// UpsertSettings batch-inserts / updates rows. Each item is treated
+// independently so a malformed row in the middle doesn't drop earlier
+// ones. Errors are returned per-key so the UI can surface them.
+// @Summary      Upsert settings
+// @Description  Batch insert/update settings. Returns per-key status.
+// @Description  Supported groups: brand, rate, system, epay.
+// @Description  epay group keys: epay.default_token (e.g. "usdt"), epay.default_currency (e.g. "cny"), epay.default_network (e.g. "tron").
+// @Description  rate group keys: rate.forced_usdt_rate, rate.api_url, rate.adjust_percent, rate.okx_c2c_enabled.
+// @Description  brand group keys: brand.site_name, brand.logo_url, brand.page_title, brand.pay_success_text, brand.support_url.
+// @Description  system group keys: system.order_expiration_time.
+// @Tags         Admin Settings
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        request body admin.SettingsUpsertRequest true "Settings payload"
+// @Success      200 {object} response.ApiResponse{data=[]admin.SettingsUpsertResult}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/settings [put]
+func (c *BaseAdminController) UpsertSettings(ctx echo.Context) error {
+	req := new(SettingsUpsertRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	type result struct {
+		Key   string `json:"key"`
+		OK    bool   `json:"ok"`
+		Error string `json:"error,omitempty"`
+	}
+	out := make([]result, 0, len(req.Items))
+	for _, item := range req.Items {
+		key := strings.TrimSpace(item.Key)
+		if key == "" {
+			out = append(out, result{Key: item.Key, OK: false, Error: "key required"})
+			continue
+		}
+		if err := data.SetSetting(item.Group, key, item.Value, item.Type); err != nil {
+			out = append(out, result{Key: key, OK: false, Error: err.Error()})
+			continue
+		}
+		out = append(out, result{Key: key, OK: true})
+	}
+
+	// When telegram credentials are updated via settings, reload the
+	// command bot so operators don't need to restart the process, and
+	// sync the notification_channels row so the notify dispatcher picks
+	// up the new values immediately.
+	telegramKeys := map[string]bool{
+		"system.telegram_bot_token":               true,
+		"system.telegram_chat_id":                 true,
+		"system.telegram_payment_notice_enabled":  true,
+		"system.telegram_abnormal_notice_enabled": true,
+	}
+	for _, item := range req.Items {
+		if telegramKeys[strings.TrimSpace(item.Key)] {
+			telegram.ReloadBotAsync("settings upsert")
+			go dao.SyncTelegramChannelFromSettings()
+			break
+		}
+	}
+
+	return c.SucJson(ctx, out)
+}
+
+// DeleteSetting removes one row. The next read of that key will fall
+// back to the hardcoded default (see settings_data.GetSetting*).
+// @Summary      Delete setting
+// @Description  Remove a setting by key (falls back to default)
+// @Tags         Admin Settings
+// @Security     AdminJWT
+// @Produce      json
+// @Param        key path string true "Setting key"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/settings/{key} [delete]
+func (c *BaseAdminController) DeleteSetting(ctx echo.Context) error {
+	key := strings.TrimSpace(ctx.Param("key"))
+	if key == "" {
+		return c.SucJson(ctx, nil)
+	}
+	if err := data.DeleteSetting(key); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// Public helper for the rate/usdt overrides — used by config package to
+// read settings-backed values without importing the controller package.
+var _ = mdb.SettingKeyRateForcedUsdt // ensure key constants remain referenced

src/controller/admin/wallet_controller.go

@@ -0,0 +1,279 @@
+package admin
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/labstack/echo/v4"
+)
+
+// AdminAddWalletRequest is the payload for adding a wallet via admin.
+type AdminAddWalletRequest struct {
+	Network string `json:"network" validate:"required" example:"tron"`
+	Address string `json:"address" validate:"required" example:"TTestTronAddress001"`
+	Remark  string `json:"remark" example:"主钱包"`
+}
+
+// AdminUpdateWalletRequest is the payload for updating a wallet remark.
+type AdminUpdateWalletRequest struct {
+	Remark *string `json:"remark" example:"已更新的备注"`
+}
+
+// AdminChangeWalletStatusRequest is the payload for toggling wallet status.
+type AdminChangeWalletStatusRequest struct {
+	// 状态 1=启用 2=禁用
+	Status int `json:"status" validate:"required|in:1,2" enums:"1,2" example:"1"`
+}
+
+// AdminBatchImportRequest is the payload for batch importing wallets.
+type AdminBatchImportRequest struct {
+	Network string `json:"network" validate:"required" example:"tron"`
+	// Addresses listed as observation-only wallets. Private-key import
+	// and API-managed modes are out of scope for v1.
+	Addresses []string `json:"addresses" validate:"required" example:"TAddr001,TAddr002,TAddr003"`
+}
+
+// WalletListItem extends WalletAddress with order count.
+type WalletListItem struct {
+	mdb.WalletAddress
+	OrderCount int64 `json:"order_count" example:"5"`
+}
+
+// AdminListWallets extends the read model with per-wallet order counts
+// so the UI can render the "订单数" column without an N+1 follow-up.
+// @Summary      List wallets (admin)
+// @Description  Returns wallets with per-wallet order counts
+// @Tags         Admin Wallets
+// @Security     AdminJWT
+// @Produce      json
+// @Param        network query string false "Network filter"
+// @Param        status query int false "Status filter (1=enabled, 2=disabled)"
+// @Param        keyword query string false "Search by address or remark"
+// @Success      200 {object} response.ApiResponse{data=[]admin.WalletListItem}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/wallets [get]
+func (c *BaseAdminController) AdminListWallets(ctx echo.Context) error {
+	network := strings.ToLower(strings.TrimSpace(ctx.QueryParam("network")))
+	status := strings.TrimSpace(ctx.QueryParam("status"))
+	keyword := strings.TrimSpace(ctx.QueryParam("keyword"))
+
+	tx := dao.Mdb.Model(&mdb.WalletAddress{})
+	if network != "" {
+		tx = tx.Where("network = ?", network)
+	}
+	if status != "" {
+		if s, err := strconv.Atoi(status); err == nil {
+			tx = tx.Where("status = ?", s)
+		}
+	}
+	if keyword != "" {
+		kw := "%" + keyword + "%"
+		tx = tx.Where("address LIKE ? OR remark LIKE ?", kw, kw)
+	}
+	var rows []mdb.WalletAddress
+	if err := tx.Order("id DESC").Find(&rows).Error; err != nil {
+		return c.FailJson(ctx, err)
+	}
+
+	counts, err := data.CountOrdersByAddress()
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	out := make([]WalletListItem, 0, len(rows))
+	for _, r := range rows {
+		out = append(out, WalletListItem{WalletAddress: r, OrderCount: counts[r.Address]})
+	}
+	return c.SucJson(ctx, out)
+}
+
+// AdminAddWallet wraps the existing create with admin-exposed Remark +
+// Source=manual so audit fields are populated.
+// @Summary      Add wallet (admin)
+// @Description  Create a wallet with admin-specific fields (remark, source=manual)
+// @Tags         Admin Wallets
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        request body admin.AdminAddWalletRequest true "Wallet payload"
+// @Success      200 {object} response.ApiResponse{data=mdb.WalletAddress}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/wallets [post]
+func (c *BaseAdminController) AdminAddWallet(ctx echo.Context) error {
+	req := new(AdminAddWalletRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	row, err := data.AddWalletAddressWithNetwork(req.Network, req.Address)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	// Patch remark/source separately to avoid changing the existing
+	// package-level AddWalletAddressWithNetwork signature (used by
+	// Telegram bot + legacy endpoint).
+	fields := map[string]interface{}{"source": mdb.WalletSourceManual}
+	if req.Remark != "" {
+		fields["remark"] = req.Remark
+	}
+	_ = dao.Mdb.Model(&mdb.WalletAddress{}).Where("id = ?", row.ID).Updates(fields).Error
+	row.Remark = req.Remark
+	row.Source = mdb.WalletSourceManual
+	return c.SucJson(ctx, row)
+}
+
+// AdminGetWallet returns detail including order count for one wallet.
+// @Summary      Get wallet (admin)
+// @Description  Returns wallet detail with order count
+// @Tags         Admin Wallets
+// @Security     AdminJWT
+// @Produce      json
+// @Param        id path int true "Wallet ID"
+// @Success      200 {object} response.ApiResponse{data=admin.WalletListItem}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/wallets/{id} [get]
+func (c *BaseAdminController) AdminGetWallet(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	wallet, err := data.GetWalletAddressById(id)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if wallet.ID == 0 {
+		return c.FailJson(ctx, errors.New("wallet not found"))
+	}
+	counts, _ := data.CountOrdersByAddress()
+	return c.SucJson(ctx, WalletListItem{WalletAddress: *wallet, OrderCount: counts[wallet.Address]})
+}
+
+// AdminUpdateWallet only patches remark (status has its own endpoint).
+// @Summary      Update wallet (admin)
+// @Description  Patch wallet remark
+// @Tags         Admin Wallets
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        id path int true "Wallet ID"
+// @Param        request body admin.AdminUpdateWalletRequest true "Fields to update"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/wallets/{id} [patch]
+func (c *BaseAdminController) AdminUpdateWallet(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	req := new(AdminUpdateWalletRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	fields := map[string]interface{}{}
+	if req.Remark != nil {
+		fields["remark"] = *req.Remark
+	}
+	if len(fields) == 0 {
+		return c.SucJson(ctx, nil)
+	}
+	if err := dao.Mdb.Model(&mdb.WalletAddress{}).Where("id = ?", id).Updates(fields).Error; err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// AdminChangeWalletStatus reuses existing helper.
+// @Summary      Change wallet status (admin)
+// @Description  Toggle enable/disable for a wallet (1=enabled, 2=disabled)
+// @Tags         Admin Wallets
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        id path int true "Wallet ID"
+// @Param        request body admin.AdminChangeWalletStatusRequest true "Status payload"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/wallets/{id}/status [post]
+func (c *BaseAdminController) AdminChangeWalletStatus(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	req := new(AdminChangeWalletStatusRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := data.ChangeWalletAddressStatus(id, req.Status); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// AdminDeleteWallet soft-deletes the wallet.
+// @Summary      Delete wallet (admin)
+// @Description  Soft-delete a wallet
+// @Tags         Admin Wallets
+// @Security     AdminJWT
+// @Produce      json
+// @Param        id path int true "Wallet ID"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/wallets/{id} [delete]
+func (c *BaseAdminController) AdminDeleteWallet(ctx echo.Context) error {
+	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
+	if err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := data.DeleteWalletAddressById(id); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	return c.SucJson(ctx, nil)
+}
+
+// AdminBatchImportWallets accepts a list of addresses and creates
+// them all as observation wallets. Per-row failures are collected and
+// returned so the UI can surface which addresses already existed.
+// @Summary      Batch import wallets
+// @Description  Import multiple wallet addresses at once. Per-row status is returned.
+// @Tags         Admin Wallets
+// @Security     AdminJWT
+// @Accept       json
+// @Produce      json
+// @Param        request body admin.AdminBatchImportRequest true "Batch import payload"
+// @Success      200 {object} response.ApiResponse{data=[]admin.BatchImportResult}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /admin/api/v1/wallets/batch-import [post]
+func (c *BaseAdminController) AdminBatchImportWallets(ctx echo.Context) error {
+	req := new(AdminBatchImportRequest)
+	if err := ctx.Bind(req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	if err := c.ValidateStruct(ctx, req); err != nil {
+		return c.FailJson(ctx, err)
+	}
+	type result struct {
+		Address string `json:"address"`
+		OK      bool   `json:"ok"`
+		Error   string `json:"error,omitempty"`
+	}
+	out := make([]result, 0, len(req.Addresses))
+	for _, addr := range req.Addresses {
+		row, err := data.AddWalletAddressWithNetwork(req.Network, addr)
+		if err != nil {
+			out = append(out, result{Address: addr, OK: false, Error: err.Error()})
+			continue
+		}
+		_ = dao.Mdb.Model(&mdb.WalletAddress{}).Where("id = ?", row.ID).
+			Update("source", mdb.WalletSourceImport).Error
+		out = append(out, result{Address: addr, OK: true})
+	}
+	return c.SucJson(ctx, out)
+}

src/controller/comm/order_controller.go

@@ -2,16 +2,47 @@ package comm
 
 import (
 	"encoding/json"
-	"fmt"
+	"net/http"
-	"log"
 
+	"github.com/assimon/luuu/middleware"
+	"github.com/assimon/luuu/model/mdb"
 	"github.com/assimon/luuu/model/request"
 	"github.com/assimon/luuu/model/service"
 	"github.com/assimon/luuu/util/constant"
+	"github.com/assimon/luuu/util/log"
 	"github.com/labstack/echo/v4"
 )
 
+// apiKeyFromContext returns the api_keys row stamped by CheckApiSign.
+// Returns nil when the middleware didn't run (should not happen on authed routes).
+func apiKeyFromContext(ctx echo.Context) *mdb.ApiKey {
+	if v, ok := ctx.Get(middleware.ApiKeyRowKey).(*mdb.ApiKey); ok {
+		return v
+	}
+	return nil
+}
+
 // CreateTransaction 创建交易
+// @Summary      Create transaction
+// @Description  Create a payment transaction order. Accepts JSON body (application/json) or form-encoded body (application/x-www-form-urlencoded).
+// @Tags         Payment
+// @Accept       json
+// @Accept       x-www-form-urlencoded
+// @Produce      json
+// @Param        request body request.CreateTransactionRequest false "Transaction payload (JSON)"
+// @Param        order_id formData string false "Merchant order ID"
+// @Param        currency formData string false "Fiat currency (e.g. cny)"
+// @Param        token formData string false "Crypto token (e.g. usdt)"
+// @Param        network formData string false "Network (e.g. tron)"
+// @Param        amount formData number false "Amount"
+// @Param        notify_url formData string false "Callback URL"
+// @Param        signature formData string false "MD5 signature"
+// @Param        redirect_url formData string false "Redirect URL"
+// @Param        name formData string false "Order name"
+// @Param        payment_type formData string false "Payment type"
+// @Success      200 {object} response.ApiResponse{data=response.CreateTransactionResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /payments/gmpay/v1/order/create-transaction [post]
 func (c *BaseCommController) CreateTransaction(ctx echo.Context) (err error) {
 	req := new(request.CreateTransactionRequest)
 	if err = ctx.Bind(req); err != nil {
@@ -20,7 +51,7 @@ func (c *BaseCommController) CreateTransaction(ctx echo.Context) (err error) {
 	if err = c.ValidateStruct(ctx, req); err != nil {
 		return c.FailJson(ctx, err)
 	}
-	resp, err := service.CreateTransaction(req)
+	resp, err := service.CreateTransaction(req, apiKeyFromContext(ctx))
 	if err != nil {
 		return c.FailJson(ctx, err)
 	}
@@ -28,6 +59,15 @@ func (c *BaseCommController) CreateTransaction(ctx echo.Context) (err error) {
 }
 
 // SwitchNetwork 切换支付网络，创建或返回子订单
+// @Summary      Switch payment network
+// @Description  Switch to a different payment network, creating or returning a sub-order
+// @Tags         Payment
+// @Accept       json
+// @Produce      json
+// @Param        request body request.SwitchNetworkRequest true "Switch network payload"
+// @Success      200 {object} response.ApiResponse
+// @Failure      400 {object} response.ApiResponse
+// @Router       /pay/switch-network [post]
 func (c *BaseCommController) SwitchNetwork(ctx echo.Context) (err error) {
 	req := new(request.SwitchNetworkRequest)
 	if err = ctx.Bind(req); err != nil {
@@ -46,33 +86,60 @@ func (c *BaseCommController) SwitchNetwork(ctx echo.Context) (err error) {
 		return c.FailJson(ctx, err)
 	}
 
-	fmt.Printf("switch network response: \n%s", string(jsonBytes))
+	log.Sugar.Debugf("switch network response: \n%s", string(jsonBytes))
 
 	return c.SucJson(ctx, resp)
 }
 
+// CreateTransactionAndRedirect creates a transaction and redirects to
+// the checkout counter. The route accepts BOTH GET (query string) and
+// POST (form) per the legacy EPAY protocol; swagger documents POST as
+// the canonical form — the GET variant is identical save the transport.
+// @Summary      Create transaction and redirect (EPAY compat)
+// @Description  Legacy EPAY-style endpoint. Accepts GET (querystring) and POST (form). On success, 302 redirects to /pay/checkout-counter/{trade_id}. Signature uses MD5 of sorted params + secret_key of the api_keys row matching the submitted pid.
+// @Tags         Payment
+// @Accept       x-www-form-urlencoded
+// @Produce      html
+// @Param        pid query integer false "API key PID (GET query)"
+// @Param        money query number false "Amount (fiat, GET query)"
+// @Param        out_trade_no query string false "Merchant order ID (GET query)"
+// @Param        notify_url query string false "Callback URL (GET query)"
+// @Param        return_url query string false "Redirect URL after payment (GET query)"
+// @Param        name query string false "Order name (GET query)"
+// @Param        type query string false "Payment type (e.g. alipay, GET query)"
+// @Param        sign query string false "MD5 signature (GET query)"
+// @Param        sign_type query string false "Signature type (MD5, GET query)"
+// @Param        pid formData integer true "API key PID"
+// @Param        money formData number true "Amount (fiat)"
+// @Param        out_trade_no formData string true "Merchant order ID"
+// @Param        notify_url formData string true "Callback URL"
+// @Param        return_url formData string false "Redirect URL after payment"
+// @Param        name formData string false "Order name"
+// @Param        type formData string false "Payment type (e.g. alipay)"
+// @Param        sign formData string true "MD5 signature"
+// @Param        sign_type formData string false "Signature type (MD5)"
+// @Success      302 "Redirect to checkout counter"
+// @Failure      400 {object} response.ApiResponse
+// @Router       /payments/epay/v1/order/create-transaction/submit.php [post]
+// @Router       /payments/epay/v1/order/create-transaction/submit.php [get]
 func (c *BaseCommController) CreateTransactionAndRedirect(ctx echo.Context) (err error) {
 	req := new(request.CreateTransactionRequest)
 	if err = ctx.Bind(req); err != nil {
-		log.Println("bind request error:", err)
+		log.Sugar.Errorf("bind request error: %v", err)
 		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
 	if err = c.ValidateStruct(ctx, req); err != nil {
-		log.Println("validate request error:", err)
+		log.Sugar.Errorf("validate request error: %v", err)
 		return c.FailJson(ctx, err)
 	}
-	resp, err := service.CreateTransaction(req)
+	resp, err := service.CreateTransaction(req, apiKeyFromContext(ctx))
 	if err != nil {
-		log.Println("create transaction error:", err)
+		log.Sugar.Errorf("create transaction error: %v", err)
 		return c.FailJson(ctx, err)
 	}
 
-	fmt.Printf("create transaction response: %+v\n", resp)
+	log.Sugar.Debugf("create transaction response: %+v", resp)
 
 	tradeID := resp.TradeId
-
+	return ctx.Redirect(http.StatusFound, "/pay/checkout-counter/"+tradeID)
-	ctx.Redirect(302, "/pay/checkout-counter/"+tradeID)
-
-	return nil
-
 }

src/controller/comm/pay_controller.go

@@ -1,8 +1,6 @@
 package comm
 
 import (
-	"encoding/json"
-	"fmt"
 	"html/template"
 	"net/http"
 	"path/filepath"
@@ -14,35 +12,47 @@ import (
 )
 
 // CheckoutCounter 收银台
+// @Summary      Checkout counter page
+// @Description  Render the payment checkout counter HTML page for a given trade
+// @Tags         Payment
+// @Produce      html
+// @Param        trade_id path string true "Trade ID"
+// @Success      200 {string} string "HTML page"
+// @Router       /pay/checkout-counter/{trade_id} [get]
 func (c *BaseCommController) CheckoutCounter(ctx echo.Context) (err error) {
 	tradeId := ctx.Param("trade_id")
 	resp, err := service.GetCheckoutCounterByTradeId(tradeId)
 	if err != nil {
 		if err == service.ErrOrder {
-			tmpl, err := template.ParseFiles(filepath.Join(config.StaticFilePath, "index.html"))
+			// Unknown trade id: render the page with empty payload
-			if err != nil {
+			// (client side shows a friendly "order not found" screen).
-				return ctx.String(http.StatusOK, err.Error())
+			tmpl, tmplErr := template.ParseFiles(filepath.Join(config.StaticFilePath, "index.html"))
+			if tmplErr != nil {
+				return ctx.String(http.StatusInternalServerError, tmplErr.Error())
 			}
+			ctx.Response().Status = http.StatusNotFound
 			emptyResp := response.CheckoutCounterResponse{}
 			return tmpl.Execute(ctx.Response(), emptyResp)
 		}
-		return ctx.String(http.StatusOK, err.Error())
+		return ctx.String(http.StatusInternalServerError, err.Error())
 	}
 	tmpl, err := template.ParseFiles(filepath.Join(config.StaticFilePath, "index.html"))
 	if err != nil {
-		return ctx.String(http.StatusOK, err.Error())
+		return ctx.String(http.StatusInternalServerError, err.Error())
 	}
 
-	jsonByte, err := json.MarshalIndent(resp, "", "  ")
-	if err != nil {
-		return ctx.String(http.StatusOK, err.Error())
-	}
-	fmt.Printf("%v\n", string(jsonByte))
-
 	return tmpl.Execute(ctx.Response(), resp)
 }
 
 // CheckStatus 支付状态检测
+// @Summary      Check payment status
+// @Description  Check the payment status of an order by trade ID
+// @Tags         Payment
+// @Produce      json
+// @Param        trade_id path string true "Trade ID"
+// @Success      200 {object} response.ApiResponse{data=response.CheckStatusResponse}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /pay/check-status/{trade_id} [get]
 func (c *BaseCommController) CheckStatus(ctx echo.Context) (err error) {
 	tradeId := ctx.Param("trade_id")
 	order, err := service.GetOrderInfoByTradeId(tradeId)

src/controller/comm/supported_asset_controller.go

@@ -3,6 +3,7 @@ package comm
 import (
 	"sort"
 	"strconv"
+	"strings"
 
 	"github.com/assimon/luuu/model/data"
 	"github.com/assimon/luuu/model/response"
@@ -10,21 +11,21 @@ import (
 	"github.com/labstack/echo/v4"
 )
 
-type addSupportedAssetRequest struct {
+// GetSupportedAssets 对外公开可用链与 token 列表。数据源是管理后台
-	Network string `json:"network" validate:"required"`
+// 的 chains + chain_tokens + wallet_address 三张表的实时查询，admin
-	Token   string `json:"token" validate:"required"`
+// 启用/禁用链或代币后，这个接口在下次调用时就会反映新状态（无缓存）。
-	Status  int64  `json:"status" validate:"required|in:1,2"`
+// 仅返回：链 enabled=true、代币 enabled=true、且该链上至少有一个可用
-}
+// 钱包地址的组合。
-
+// @Summary      List supported (network, tokens) groupings
-type updateSupportedAssetRequest struct {
+// @Description  Public endpoint, Auth required in /admin/api/v1/supported-assets
-	Network string `json:"network" validate:"required"`
+// @Tags         Supported Assets
-	Token   string `json:"token" validate:"required"`
+// @Produce      json
-	Status  int64  `json:"status" validate:"required|in:1,2"`
+// @Success      200 {object} response.ApiResponse{data=response.SupportedAssetsResponse}
-}
+// @Failure      400 {object} response.ApiResponse
-
+// @Router       /payments/gmpay/v1/supported-assets [get]
-// GetSupportedAssets 对外公开可用链与 token 列表（无需鉴权，仅返回已启用项）。
+// @Router       /admin/api/v1/supported-assets [get]
 func (c *BaseCommController) GetSupportedAssets(ctx echo.Context) error {
-	list, err := data.ListEnabledSupportedAssets()
+	chains, err := data.ListEnabledChains()
 	if err != nil {
 		return c.FailJson(ctx, err)
 	}
@@ -33,32 +34,42 @@ func (c *BaseCommController) GetSupportedAssets(ctx echo.Context) error {
 		return c.FailJson(ctx, err)
 	}
 
-	networkSet := make(map[string]struct{})
+	// A chain only qualifies if it has at least one wallet available —
+	// without a recipient address, payments on that chain can't be
+	// processed even if the chain + token config says "enabled".
+	networkHasWallet := make(map[string]struct{})
 	for _, w := range wallets {
-		networkSet[w.Network] = struct{}{}
+		networkHasWallet[strings.ToLower(w.Network)] = struct{}{}
 	}
 
-	grouped := make(map[string][]string)
+	supports := make([]response.NetworkTokenSupport, 0, len(chains))
-	for _, item := range list {
+	for _, ch := range chains {
-		if _, ok := networkSet[item.Network]; !ok {
+		network := strings.ToLower(ch.Network)
+		if _, ok := networkHasWallet[network]; !ok {
 			continue
 		}
-		grouped[item.Network] = append(grouped[item.Network], item.Token)
+		tokens, err := data.ListEnabledChainTokensByNetwork(network)
-	}
+		if err != nil {
-
+			return c.FailJson(ctx, err)
-	networks := make([]string, 0, len(grouped))
+		}
-	for network := range grouped {
+		if len(tokens) == 0 {
-		networks = append(networks, network)
+			continue
-	}
+		}
-	sort.Strings(networks)
+		symbols := make([]string, 0, len(tokens))
-
+		for _, t := range tokens {
-	supports := make([]response.NetworkTokenSupport, 0, len(networks))
+			sym := strings.ToUpper(strings.TrimSpace(t.Symbol))
-	for _, network := range networks {
+			if sym == "" {
-		tokens := grouped[network]
+				continue
-		sort.Strings(tokens)
+			}
+			symbols = append(symbols, sym)
+		}
+		if len(symbols) == 0 {
+			continue
+		}
+		sort.Strings(symbols)
 		supports = append(supports, response.NetworkTokenSupport{
 			Network: network,
-			Tokens:  tokens,
+			Tokens:  symbols,
 		})
 	}
 
@@ -66,9 +77,17 @@ func (c *BaseCommController) GetSupportedAssets(ctx echo.Context) error {
 }
 
 // ListSupportedAssetRecords 查询支持项明细（无需鉴权）。
+// @Summary      List supported asset records
+// @Description  Public endpoint. Returns enabled chain_tokens, optionally filtered by network.
+// @Tags         Supported Assets
+// @Produce      json
+// @Param        network query string false "Network filter (e.g. tron, ethereum)"
+// @Success      200 {object} response.ApiResponse{data=[]mdb.ChainToken}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /payments/gmpay/v1/supported-assets/records [get]
 func (c *BaseCommController) ListSupportedAssetRecords(ctx echo.Context) error {
 	network := ctx.QueryParam("network")
-	list, err := data.ListSupportedAssets(network)
+	list, err := data.ListEnabledChainTokens(network)
 	if err != nil {
 		return c.FailJson(ctx, err)
 	}
@@ -76,72 +95,25 @@ func (c *BaseCommController) ListSupportedAssetRecords(ctx echo.Context) error {
 }
 
 // GetSupportedAsset 查询单条支持项（无需鉴权）。
+// @Summary      Get a supported asset
+// @Description  Public endpoint. Returns one chain_token row by ID. Returns 404 if the token is disabled.
+// @Tags         Supported Assets
+// @Produce      json
+// @Param        id path int true "ChainToken ID"
+// @Success      200 {object} response.ApiResponse{data=mdb.ChainToken}
+// @Failure      400 {object} response.ApiResponse
+// @Router       /payments/gmpay/v1/supported-assets/{id} [get]
 func (c *BaseCommController) GetSupportedAsset(ctx echo.Context) error {
 	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
 	if err != nil {
 		return c.FailJson(ctx, constant.ParamsMarshalErr)
 	}
-	asset, err := data.GetSupportedAssetByID(id)
+	token, err := data.GetChainTokenByID(id)
 	if err != nil {
 		return c.FailJson(ctx, err)
 	}
-	if asset.ID <= 0 {
+	if token.ID <= 0 || !token.Enabled {
 		return c.FailJson(ctx, constant.SupportedAssetNotFound)
 	}
-	return c.SucJson(ctx, asset)
+	return c.SucJson(ctx, token)
-}
-
-// AddSupportedAsset 新增支持项（鉴权）。
-func (c *BaseCommController) AddSupportedAsset(ctx echo.Context) error {
-	req := new(addSupportedAssetRequest)
-	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, constant.ParamsMarshalErr)
-	}
-	if err := c.ValidateStruct(ctx, req); err != nil {
-		return c.FailJson(ctx, err)
-	}
-	asset, err := data.AddSupportedAsset(req.Network, req.Token, req.Status)
-	if err != nil {
-		return c.FailJson(ctx, err)
-	}
-	return c.SucJson(ctx, asset)
-}
-
-// UpdateSupportedAsset 修改支持项（鉴权）。
-func (c *BaseCommController) UpdateSupportedAsset(ctx echo.Context) error {
-	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
-	if err != nil {
-		return c.FailJson(ctx, constant.ParamsMarshalErr)
-	}
-	req := new(updateSupportedAssetRequest)
-	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, constant.ParamsMarshalErr)
-	}
-	if err := c.ValidateStruct(ctx, req); err != nil {
-		return c.FailJson(ctx, err)
-	}
-	asset, err := data.UpdateSupportedAsset(id, req.Network, req.Token, req.Status)
-	if err != nil {
-		return c.FailJson(ctx, err)
-	}
-	return c.SucJson(ctx, asset)
-}
-
-// DeleteSupportedAsset 删除支持项（鉴权）。
-func (c *BaseCommController) DeleteSupportedAsset(ctx echo.Context) error {
-	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
-	if err != nil {
-		return c.FailJson(ctx, constant.ParamsMarshalErr)
-	}
-	asset, err := data.GetSupportedAssetByID(id)
-	if err != nil {
-		return c.FailJson(ctx, err)
-	}
-	if asset.ID <= 0 {
-		return c.FailJson(ctx, constant.SupportedAssetNotFound)
-	}
-	if err := data.DeleteSupportedAssetByID(id); err != nil {
-		return c.FailJson(ctx, err)
-	}
-	return c.SucJson(ctx, nil)
 }

src/controller/comm/wallet_controller.go

@@ -1,98 +0,0 @@
-package comm
-
-import (
-	"strconv"
-
-	"github.com/assimon/luuu/model/data"
-	"github.com/assimon/luuu/model/mdb"
-	"github.com/assimon/luuu/util/constant"
-	"github.com/labstack/echo/v4"
-)
-
-type addWalletRequest struct {
-	Network string `json:"network" validate:"required"`
-	Address string `json:"address" validate:"required"`
-}
-
-type changeStatusRequest struct {
-	Status int `json:"status" validate:"required|in:1,2"`
-}
-
-// AddWallet 添加钱包地址
-func (c *BaseCommController) AddWallet(ctx echo.Context) error {
-	req := new(addWalletRequest)
-	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, constant.ParamsMarshalErr)
-	}
-	if err := c.ValidateStruct(ctx, req); err != nil {
-		return c.FailJson(ctx, err)
-	}
-	wallet, err := data.AddWalletAddressWithNetwork(req.Network, req.Address)
-	if err != nil {
-		return c.FailJson(ctx, err)
-	}
-	return c.SucJson(ctx, wallet)
-}
-
-// ListWallets 获取钱包列表
-func (c *BaseCommController) ListWallets(ctx echo.Context) error {
-	network := ctx.QueryParam("network")
-	var wallets []mdb.WalletAddress
-	var err error
-	if network != "" {
-		wallets, err = data.GetAllWalletAddressByNetwork(network)
-	} else {
-		wallets, err = data.GetAllWalletAddress()
-	}
-	if err != nil {
-		return c.FailJson(ctx, err)
-	}
-	return c.SucJson(ctx, wallets)
-}
-
-// GetWallet 获取单个钱包
-func (c *BaseCommController) GetWallet(ctx echo.Context) error {
-	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
-	if err != nil {
-		return c.FailJson(ctx, constant.ParamsMarshalErr)
-	}
-	wallet, err := data.GetWalletAddressById(id)
-	if err != nil {
-		return c.FailJson(ctx, err)
-	}
-	if wallet.ID <= 0 {
-		return c.FailJson(ctx, constant.NotAvailableWalletAddress)
-	}
-	return c.SucJson(ctx, wallet)
-}
-
-// ChangeWalletStatus 启用/禁用钱包
-func (c *BaseCommController) ChangeWalletStatus(ctx echo.Context) error {
-	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
-	if err != nil {
-		return c.FailJson(ctx, constant.ParamsMarshalErr)
-	}
-	req := new(changeStatusRequest)
-	if err := ctx.Bind(req); err != nil {
-		return c.FailJson(ctx, constant.ParamsMarshalErr)
-	}
-	if err := c.ValidateStruct(ctx, req); err != nil {
-		return c.FailJson(ctx, err)
-	}
-	if err := data.ChangeWalletAddressStatus(id, req.Status); err != nil {
-		return c.FailJson(ctx, err)
-	}
-	return c.SucJson(ctx, nil)
-}
-
-// DeleteWallet 删除钱包
-func (c *BaseCommController) DeleteWallet(ctx echo.Context) error {
-	id, err := strconv.ParseUint(ctx.Param("id"), 10, 64)
-	if err != nil {
-		return c.FailJson(ctx, constant.ParamsMarshalErr)
-	}
-	if err := data.DeleteWalletAddressById(id); err != nil {
-		return c.FailJson(ctx, err)
-	}
-	return c.SucJson(ctx, nil)
-}

src/go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/ethereum/go-ethereum v1.15.11
 	github.com/gagliardetto/solana-go v1.16.0
 	github.com/go-resty/resty/v2 v2.11.0
+	github.com/golang-jwt/jwt/v4 v4.5.1
 	github.com/gookit/color v1.5.0
 	github.com/gookit/goutil v0.4.6
 	github.com/gookit/validate v1.3.1
@@ -23,6 +24,7 @@ require (
 	github.com/spf13/viper v1.20.1
 	github.com/tidwall/gjson v1.18.0
 	go.uber.org/zap v1.27.0
+	golang.org/x/crypto v0.48.0
 	gopkg.in/telebot.v3 v3.0.0
 	gorm.io/driver/mysql v1.5.1
 	gorm.io/driver/postgres v1.5.2
@@ -99,12 +101,11 @@ require (
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
 	go.mongodb.org/mongo-driver v1.17.3 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.47.0 // indirect
+	golang.org/x/net v0.50.0 // indirect
-	golang.org/x/net v0.49.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
-	golang.org/x/term v0.39.0 // indirect
+	golang.org/x/term v0.40.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.70.0 // indirect

src/go.sum

@@ -375,8 +375,8 @@ golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -397,8 +397,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
+golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -440,8 +440,8 @@ golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuX
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -450,8 +450,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 golang.org/x/time v0.0.0-20201208040808-7e3f01d25324/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=

src/install/installer.go

@@ -0,0 +1,336 @@
+// Package install provides a first-run setup REST API.
+//
+// When the .env config file is absent (or has install=true) the HTTP start
+// command calls RunInstallServer, which listens on the same address the main
+// server will eventually use (default :8000) and mounts two JSON endpoints
+// under /install consumed by the frontend install UI:
+//
+//	GET  /install/defaults  — default field values for the form
+//	POST /install           — validate + write .env, then shut down
+//
+// The HTTP listen address is submitted as two separate fields (http_bind_addr
+// and http_bind_port) and combined internally as "ADDR:PORT" before writing
+// the http_listen key in .env.  This makes the form easier for users who only
+// want to change the port without touching the bind address.
+//
+// Once the .env is written the install server stops and normal bootstrap
+// proceeds on the same port without a restart.
+package install
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"text/template"
+	"time"
+
+	"github.com/gookit/color"
+	"github.com/labstack/echo/v4"
+	"github.com/labstack/echo/v4/middleware"
+)
+
+// DefaultInstallAddr is the listen address used by the install API.
+// Matches the default http_listen so no extra port is needed.
+const DefaultInstallAddr = ":8000"
+
+// InstallRequest is the payload submitted by the install form.
+// All fields are optional except AppURI; omitted fields fall back to InstallDefaults().
+type InstallRequest struct {
+	// Application display name (default: epusdt)
+	AppName string `json:"app_name" form:"app_name" example:"epusdt"`
+	// Public base URL of the service, e.g. https://pay.example.com (required)
+	AppURI string `json:"app_uri" form:"app_uri" example:"https://pay.example.com"`
+	// Bind address for the HTTP server (default: 127.0.0.1)
+	HttpBindAddr string `json:"http_bind_addr" form:"http_bind_addr" example:"127.0.0.1"`
+	// Bind port for the HTTP server (default: 8000)
+	HttpBindPort int `json:"http_bind_port" form:"http_bind_port" example:"8000"`
+	// Runtime directory for SQLite DB and temp files (default: ./runtime)
+	RuntimeRootPath string `json:"runtime_root_path" form:"runtime_root_path" example:"./runtime"`
+	// Directory for application log files (default: ./logs)
+	LogSavePath string `json:"log_save_path" form:"log_save_path" example:"./logs"`
+	// Minutes before an unpaid order expires (default: 10)
+	OrderExpirationTime int `json:"order_expiration_time" form:"order_expiration_time" example:"10"`
+	// Maximum webhook retry attempts (default: 1)
+	OrderNoticeMaxRetry int `json:"order_notice_max_retry" form:"order_notice_max_retry" example:"1"`
+}
+
+// InstallDefaults returns sensible default values for the install form.
+func InstallDefaults() InstallRequest {
+	return InstallRequest{
+		AppName:             "epusdt",
+		AppURI:              "",
+		HttpBindAddr:        "127.0.0.1",
+		HttpBindPort:        8000,
+		RuntimeRootPath:     "./runtime",
+		LogSavePath:         "./logs",
+		OrderExpirationTime: 10,
+		OrderNoticeMaxRetry: 1,
+	}
+}
+
+// installHandler holds the per-invocation state shared between handlers.
+type installHandler struct {
+	envFilePath string
+	done        chan struct{}
+}
+
+// GetDefaults returns default values for the install form.
+//
+// @Summary      Install — get default values
+// @Description  Returns sensible default field values for the first-run install form.
+//
+//	Available only before the .env config file has been written.
+//	After installation completes this route is no longer served.
+//
+// @Tags         Install
+// @Produce      json
+// @Success      200 {object} InstallRequest "Default install values"
+// @Router       /api/install/defaults [get]
+func (h *installHandler) GetDefaults(c echo.Context) error {
+	return c.JSON(http.StatusOK, InstallDefaults())
+}
+
+// Submit validates the install payload, writes the .env file, and signals
+// the install server to shut down so the main bootstrap can proceed.
+// http_bind_addr and http_bind_port are combined as "ADDR:PORT" to produce
+// the http_listen config key (e.g. 0.0.0.0:8000).
+//
+// @Summary      Install — submit configuration
+// @Description  Validates the submitted configuration and writes the .env file.
+//
+//	http_bind_addr + http_bind_port are joined internally as "ADDR:PORT" for
+//	the http_listen config key (defaults: 127.0.0.1 and 8000 respectively).
+//	http_bind_port must be in the range 1–65535 if provided.
+//	app_uri is required. All other fields are optional and fall back to
+//	the defaults returned by GET /api/install/defaults.
+//	Sets install=false in the written .env, then shuts down the install
+//	server so that normal application bootstrap starts on the same port.
+//	After installation completes this route is no longer served.
+//
+// @Tags         Install
+// @Accept       json
+// @Produce      json
+// @Param        body body     InstallRequest true "Install configuration"
+// @Success      200  {object} map[string]string "message"
+// @Failure      400  {object} map[string]string "error"
+// @Failure      500  {object} map[string]string "error"
+// @Router       /api/install [post]
+func (h *installHandler) Submit(c echo.Context) error {
+	req := new(InstallRequest)
+	if err := c.Bind(req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]interface{}{"error": err.Error()})
+	}
+
+	req.AppURI = strings.TrimSpace(req.AppURI)
+	if req.AppURI == "" {
+		return c.JSON(http.StatusBadRequest, map[string]interface{}{"error": "app_uri is required"})
+	}
+	if req.HttpBindPort != 0 && (req.HttpBindPort < 1 || req.HttpBindPort > 65535) {
+		return c.JSON(http.StatusBadRequest, map[string]interface{}{"error": "http_bind_port must be between 1 and 65535"})
+	}
+	d := InstallDefaults()
+	if strings.TrimSpace(req.AppName) == "" {
+		req.AppName = d.AppName
+	}
+	if strings.TrimSpace(req.HttpBindAddr) == "" {
+		req.HttpBindAddr = d.HttpBindAddr
+	}
+	if req.HttpBindPort <= 0 {
+		req.HttpBindPort = d.HttpBindPort
+	}
+	if strings.TrimSpace(req.RuntimeRootPath) == "" {
+		req.RuntimeRootPath = d.RuntimeRootPath
+	}
+	if strings.TrimSpace(req.LogSavePath) == "" {
+		req.LogSavePath = d.LogSavePath
+	}
+	if req.OrderExpirationTime <= 0 {
+		req.OrderExpirationTime = d.OrderExpirationTime
+	}
+	if req.OrderNoticeMaxRetry < 0 {
+		req.OrderNoticeMaxRetry = d.OrderNoticeMaxRetry
+	}
+
+	if err := writeEnvFile(h.envFilePath, req); err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]interface{}{"error": err.Error()})
+	}
+
+	go func() { close(h.done) }()
+	return c.JSON(http.StatusOK, map[string]interface{}{"message": "install complete, starting server…"})
+}
+
+// RunInstallServer starts the install REST API on listenAddr (default :8000)
+// under the /install path and blocks until the .env file has been written.
+// The caller should then proceed with normal app initialisation (bootstrap.InitApp).
+func RunInstallServer(listenAddr, envFilePath string) {
+	if listenAddr == "" {
+		listenAddr = DefaultInstallAddr
+	}
+
+	h := &installHandler{
+		envFilePath: envFilePath,
+		done:        make(chan struct{}),
+	}
+
+	e := echo.New()
+	e.HideBanner = true
+	e.HidePort = true
+
+	// api routes for the install frontend
+	api := e.Group("/api")
+
+	api.GET("/install/defaults", h.GetDefaults)
+	api.POST("/install", h.Submit)
+
+	// Resolve www/ relative to the executable so SPA routes work regardless
+	// of the working directory. main.go extracts www/ next to the binary.
+	wwwRoot := "./www"
+	if exePath, err := os.Executable(); err == nil {
+		if exePath, err = filepath.EvalSymlinks(exePath); err == nil {
+			wwwRoot = filepath.Join(filepath.Dir(exePath), "www")
+		}
+	}
+	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
+		HTML5: true,
+		Index: "index.html",
+		Root:  wwwRoot,
+	}))
+
+	// Build a human-readable URL for the console hint.
+	installHost := listenAddr
+	if strings.HasPrefix(installHost, ":") {
+		installHost = "localhost" + installHost
+	}
+	color.Green.Printf("[install] no config found — install API available at http://%s/install\n", installHost)
+
+	go func() {
+		<-h.done
+		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		defer cancel()
+		_ = e.Shutdown(ctx)
+	}()
+
+	if err := e.Start(listenAddr); err != nil && err != http.ErrServerClosed {
+		color.Red.Printf("[install] server error: %s\n", err)
+		os.Exit(1)
+	}
+
+	color.Green.Printf("[install] configuration saved to %s, starting…\n", envFilePath)
+}
+
+// formControlledKeys are keys whose values always come from the install form
+// (or are set unconditionally by the template). Existing config values for
+// these keys must NOT be preserved — the form submission takes precedence.
+var formControlledKeys = map[string]bool{
+	"app_name":               true,
+	"app_uri":                true,
+	"http_listen":            true,
+	"runtime_root_path":      true,
+	"log_save_path":          true,
+	"order_expiration_time":  true,
+	"order_notice_max_retry": true,
+	"install":                true,
+}
+
+// writeEnvFile renders and writes a minimal .env file.
+// If the file already exists, values for keys that are NOT controlled by the
+// install form are preserved from the existing file so that operator-specific
+// settings (tg_bot_token, db_type, etc.) survive a re-install.
+// Keys that the form controls (app_uri, http_listen, …) always use the
+// submitted values.
+func writeEnvFile(path string, r *InstallRequest) error {
+	// Collect existing non-empty key→value pairs for non-form keys.
+	existingValues := map[string]string{}
+	if data, err := os.ReadFile(path); err == nil {
+		for _, line := range strings.Split(string(data), "\n") {
+			line = strings.TrimSpace(line)
+			if line == "" || strings.HasPrefix(line, "#") {
+				continue
+			}
+			if idx := strings.IndexByte(line, '='); idx >= 0 {
+				k := strings.TrimSpace(line[:idx])
+				v := strings.TrimSpace(line[idx+1:])
+				if v != "" && !formControlledKeys[k] {
+					existingValues[k] = v
+				}
+			}
+		}
+	}
+
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		return fmt.Errorf("create config directory: %w", err)
+	}
+
+	// Render the template into a buffer first.
+	var buf bytes.Buffer
+	if err := envTemplate.Execute(&buf, r); err != nil {
+		return fmt.Errorf("render env template: %w", err)
+	}
+
+	// For non-form keys that already had a value, substitute the existing value
+	// so the template default does not clobber operator configuration.
+	lines := strings.Split(buf.String(), "\n")
+	for i, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" || strings.HasPrefix(trimmed, "#") {
+			continue
+		}
+		if idx := strings.IndexByte(trimmed, '='); idx >= 0 {
+			k := strings.TrimSpace(trimmed[:idx])
+			if existing, ok := existingValues[k]; ok {
+				lines[i] = k + "=" + existing
+			}
+		}
+	}
+
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
+	if err != nil {
+		return fmt.Errorf("open config file: %w", err)
+	}
+	defer f.Close()
+	_, err = fmt.Fprint(f, strings.Join(lines, "\n"))
+	return err
+}
+
+var envTemplate = template.Must(template.New("env").Parse(`app_name={{.AppName}}
+app_uri={{.AppURI}}
+log_level=info
+http_access_log=false
+sql_debug=false
+http_listen={{.HttpBindAddr}}:{{.HttpBindPort}}
+
+static_path=/static
+runtime_root_path={{.RuntimeRootPath}}
+
+log_save_path={{.LogSavePath}}
+log_max_size=32
+log_max_age=7
+max_backups=3
+
+# supported values: postgres,mysql,sqlite
+db_type=sqlite
+
+# sqlite primary database config
+sqlite_database_filename=
+sqlite_table_prefix=
+
+# sqlite runtime store config
+runtime_sqlite_filename=epusdt-runtime.db
+
+# background scheduler config
+queue_concurrency=10
+queue_poll_interval_ms=1000
+callback_retry_base_seconds=5
+
+order_expiration_time={{.OrderExpirationTime}}
+order_notice_max_retry={{.OrderNoticeMaxRetry}}
+
+api_rate_url=
+
+# Set to true to re-run the install wizard on next startup.
+install=false
+`))

src/install/installer_test.go

@@ -0,0 +1,175 @@
+package install
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/labstack/echo/v4"
+)
+
+func TestInstallDefaults(t *testing.T) {
+	d := InstallDefaults()
+	if d.AppName != "epusdt" {
+		t.Errorf("AppName = %q, want epusdt", d.AppName)
+	}
+	if d.HttpBindAddr != "127.0.0.1" {
+		t.Errorf("HttpBindAddr = %q, want 127.0.0.1", d.HttpBindAddr)
+	}
+	if d.HttpBindPort != 8000 {
+		t.Errorf("HttpBindPort = %d, want 8000", d.HttpBindPort)
+	}
+	if d.OrderExpirationTime != 10 {
+		t.Errorf("OrderExpirationTime = %d, want 10", d.OrderExpirationTime)
+	}
+}
+
+func TestWriteEnvFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, ".env")
+
+	req := &InstallRequest{
+		AppName:             "myapp",
+		AppURI:              "http://1.2.3.4:8000",
+		HttpBindAddr:        "0.0.0.0",
+		HttpBindPort:        9000,
+		RuntimeRootPath:     "./runtime",
+		LogSavePath:         "./logs",
+		OrderExpirationTime: 15,
+		OrderNoticeMaxRetry: 3,
+	}
+	if err := writeEnvFile(path, req); err != nil {
+		t.Fatalf("writeEnvFile: %v", err)
+	}
+
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read env: %v", err)
+	}
+	content := string(data)
+
+	for _, want := range []string{
+		"app_name=myapp",
+		"app_uri=http://1.2.3.4:8000",
+		"http_listen=0.0.0.0:9000",
+		"order_expiration_time=15",
+		"order_notice_max_retry=3",
+		"db_type=sqlite",
+		"install=false",
+	} {
+		if !strings.Contains(content, want) {
+			t.Errorf("env file missing %q\ncontent:\n%s", want, content)
+		}
+	}
+}
+
+func TestInstallAPIDefaults(t *testing.T) {
+	h := &installHandler{done: make(chan struct{})}
+	e := echo.New()
+	e.GET("/install/defaults", h.GetDefaults)
+
+	req := httptest.NewRequest(http.MethodGet, "/install/defaults", nil)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	var body map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode body: %v", err)
+	}
+	if body["app_name"] != "epusdt" {
+		t.Errorf("app_name = %v, want epusdt", body["app_name"])
+	}
+	if body["http_bind_addr"] != "127.0.0.1" {
+		t.Errorf("http_bind_addr = %v, want 127.0.0.1", body["http_bind_addr"])
+	}
+	if body["http_bind_port"] != float64(8000) {
+		t.Errorf("http_bind_port = %v, want 8000", body["http_bind_port"])
+	}
+}
+
+func TestInstallAPISubmit(t *testing.T) {
+	dir := t.TempDir()
+	envPath := filepath.Join(dir, ".env")
+
+	h := &installHandler{envFilePath: envPath, done: make(chan struct{})}
+	e := echo.New()
+	e.POST("/install", h.Submit)
+
+	payload := `{"app_name":"testapp","app_uri":"http://10.0.0.1:8000","http_bind_addr":"0.0.0.0","http_bind_port":8000,"order_expiration_time":10,"order_notice_max_retry":1}`
+	req := httptest.NewRequest(http.MethodPost, "/install", strings.NewReader(payload))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rec.Code, rec.Body.String())
+	}
+	// done channel should be closed after successful submit
+	select {
+	case <-h.done:
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal("handler did not close done channel within timeout")
+	}
+	data, err := os.ReadFile(envPath)
+	if err != nil {
+		t.Fatalf("env file not written: %v", err)
+	}
+	content := string(data)
+	if !strings.Contains(content, "app_uri=http://10.0.0.1:8000") {
+		t.Errorf("env file missing app_uri; content:\n%s", content)
+	}
+	if !strings.Contains(content, "http_listen=0.0.0.0:8000") {
+		t.Errorf("env file missing http_listen; content:\n%s", content)
+	}
+}
+
+func TestInstallAPISubmitMissingURI(t *testing.T) {
+	dir := t.TempDir()
+	envPath := filepath.Join(dir, ".env")
+
+	h := &installHandler{envFilePath: envPath, done: make(chan struct{})}
+	e := echo.New()
+	e.POST("/install", h.Submit)
+
+	req := httptest.NewRequest(http.MethodPost, "/install", strings.NewReader(`{"app_name":"x"}`))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+	if _, err := os.Stat(envPath); err == nil {
+		t.Error("env file should not have been written for invalid request")
+	}
+}
+
+func TestInstallAPISubmitInvalidPort(t *testing.T) {
+	dir := t.TempDir()
+	envPath := filepath.Join(dir, ".env")
+
+	h := &installHandler{envFilePath: envPath, done: make(chan struct{})}
+	e := echo.New()
+	e.POST("/install", h.Submit)
+
+	payload := `{"app_uri":"http://example.com","http_bind_port":99999}`
+	req := httptest.NewRequest(http.MethodPost, "/install", strings.NewReader(payload))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400; body: %s", rec.Code, rec.Body.String())
+	}
+	if _, err := os.Stat(envPath); err == nil {
+		t.Error("env file should not have been written for invalid port")
+	}
+}

src/internal/testutil/testdb.go

@@ -27,7 +27,6 @@ func SetupTestDatabases(t testing.TB) func() {
 	viper.Set("callback_retry_base_seconds", 1)
 	viper.Set("queue_concurrency", 4)
 	viper.Set("queue_poll_interval_ms", 50)
-	viper.Set("api_auth_token", "test-token")
 
 	config.HTTPAccessLog = false
 	config.SQLDebug = false
@@ -38,12 +37,44 @@ func SetupTestDatabases(t testing.TB) func() {
 	mainDB := mustOpenSQLite(t, filepath.Join(t.TempDir(), "main.db"))
 	runtimeDB := mustOpenSQLite(t, filepath.Join(t.TempDir(), "runtime.db"))
 
-	mustMigrate(t, mainDB, &mdb.Orders{}, &mdb.WalletAddress{})
+	mustMigrate(t, mainDB,
+		&mdb.Orders{},
+		&mdb.WalletAddress{},
+		&mdb.ApiKey{},
+		&mdb.Setting{},
+		&mdb.NotificationChannel{},
+		&mdb.Chain{},
+		&mdb.ChainToken{},
+		&mdb.RpcNode{},
+		&mdb.AdminUser{},
+	)
 	mustMigrate(t, runtimeDB, &mdb.TransactionLock{})
 
 	dao.Mdb = mainDB
 	dao.RuntimeDB = runtimeDB
 
+	// Seed all standard chains as enabled so IsChainEnabled checks pass.
+	for _, network := range []string{
+		mdb.NetworkTron, mdb.NetworkSolana, mdb.NetworkEthereum,
+		mdb.NetworkBsc, mdb.NetworkPolygon, mdb.NetworkPlasma,
+	} {
+		mainDB.Create(&mdb.Chain{Network: network, Enabled: true})
+	}
+
+	// Seed two universal api_keys rows. Both usable for EPAY/GMPAY
+	// flows; the numeric PID 1001 row lets legacy tests that submit
+	// `pid=1001` still match.
+	mainDB.Create(&mdb.ApiKey{
+		Name: "test-default",
+		Pid:  "test-token", SecretKey: "test-token",
+		Status: mdb.ApiKeyStatusEnable,
+	})
+	mainDB.Create(&mdb.ApiKey{
+		Name: "test-pid-1001",
+		Pid:  "1001", SecretKey: "test-token",
+		Status: mdb.ApiKeyStatusEnable,
+	})
+
 	return func() {
 		closeDB(t, runtimeDB)
 		closeDB(t, mainDB)

src/main.go

@@ -1,11 +1,110 @@
 package main
 
 import (
+	"embed"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+
 	"github.com/assimon/luuu/command"
 	"github.com/gookit/color"
 )
 
+//go:embed all:static
+var staticDir embed.FS
+
+//go:embed all:www
+var wwwDir embed.FS
+
+func executableDir() (string, error) {
+	exePath, err := os.Executable()
+	if err != nil {
+		return "", err
+	}
+	exePath, err = filepath.EvalSymlinks(exePath)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Dir(exePath), nil
+}
+
+func extractEmbeddedDir(src embed.FS, embeddedRoot, dstRoot string) error {
+	sub, err := fs.Sub(src, embeddedRoot)
+	if err != nil {
+		return err
+	}
+
+	return fs.WalkDir(sub, ".", func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		dstPath := filepath.Join(dstRoot, path)
+
+		if d.IsDir() {
+			return os.MkdirAll(dstPath, 0o755)
+		}
+
+		if err := os.MkdirAll(filepath.Dir(dstPath), 0o755); err != nil {
+			return err
+		}
+
+		in, err := sub.Open(path)
+		if err != nil {
+			return err
+		}
+		defer in.Close()
+
+		out, err := os.OpenFile(dstPath, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o644)
+		if err != nil {
+			return err
+		}
+		defer out.Close()
+
+		_, err = io.Copy(out, in)
+		return err
+	})
+}
+
+func releaseStatic(fs embed.FS, target string) (string, error) {
+	baseDir, err := executableDir()
+	if err != nil {
+		return "", err
+	}
+
+	targetDir := filepath.Join(baseDir, target)
+
+	if err := os.RemoveAll(targetDir); err != nil {
+		return "", err
+	}
+
+	if err := os.MkdirAll(targetDir, 0o755); err != nil {
+		return "", err
+	}
+
+	if err := extractEmbeddedDir(fs, target, targetDir); err != nil {
+		return "", err
+	}
+
+	return targetDir, nil
+}
+
 func main() {
+	staticPath, err := releaseStatic(staticDir, "static")
+	if err != nil {
+		panic(err)
+	}
+	fmt.Println("static released to:", staticPath)
+
+	wwwwPath, err := releaseStatic(wwwDir, "www")
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Println("www released to:", wwwwPath)
+
 	defer func() {
 		if err := recover(); err != nil {
 			color.Error.Println("[Start Server Err!!!] ", err)

src/middleware/check_jwt.go

@@ -0,0 +1,50 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	appjwt "github.com/assimon/luuu/util/jwt"
+	"github.com/labstack/echo/v4"
+)
+
+const (
+	// AdminUserIDKey is the echo.Context key holding the authenticated
+	// admin user's ID after successful JWT validation.
+	AdminUserIDKey = "admin_user_id"
+	// AdminUsernameKey mirrors the username for convenience.
+	AdminUsernameKey = "admin_username"
+)
+
+// CheckAdminJWT validates an Authorization: Bearer <jwt> header against
+// the HS256 secret stored in system.jwt_secret. On success it injects
+// the admin user ID and username into the echo context.
+//
+// Accepts both "Authorization: Bearer <jwt>" and a bare "<jwt>" for
+// developer convenience (curl / postman). The token itself is always
+// cryptographically validated — the relaxed header parsing doesn't
+// widen the trust surface.
+func CheckAdminJWT() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(ctx echo.Context) error {
+			raw := strings.TrimSpace(ctx.Request().Header.Get("Authorization"))
+			if raw == "" {
+				return echo.NewHTTPError(http.StatusUnauthorized, "missing authorization header")
+			}
+			if !strings.HasPrefix(raw, "Bearer ") {
+				return echo.NewHTTPError(http.StatusUnauthorized, "authorization header must use Bearer scheme")
+			}
+			token := strings.TrimSpace(raw[len("Bearer "):])
+			if token == "" {
+				return echo.NewHTTPError(http.StatusUnauthorized, "empty token")
+			}
+			claims, err := appjwt.Parse(token)
+			if err != nil {
+				return echo.NewHTTPError(http.StatusUnauthorized, "invalid token")
+			}
+			ctx.Set(AdminUserIDKey, claims.AdminUserID)
+			ctx.Set(AdminUsernameKey, claims.Username)
+			return next(ctx)
+		}
+	}
+}

src/middleware/check_sign.go

@@ -2,37 +2,142 @@ package middleware
 
 import (
 	"bytes"
-	"io/ioutil"
+	"crypto/subtle"
+	"io"
+	"net"
+	"net/url"
+	"strconv"
+	"strings"
 
-	"github.com/assimon/luuu/config"
+	"github.com/assimon/luuu/model/data"
 	"github.com/assimon/luuu/util/constant"
 	"github.com/assimon/luuu/util/json"
 	"github.com/assimon/luuu/util/sign"
 	"github.com/labstack/echo/v4"
 )
 
+// Context keys populated by CheckApiSign after successful verification.
+// Handlers (pay/order creation) pull ApiKeyIDKey to stamp order.api_key_id.
+const (
+	ApiKeyIDKey  = "api_key_id"
+	ApiKeyRowKey = "api_key_row"
+)
+
+// CheckApiSign validates the body signature against the secret_key of
+// the api_keys row matching the submitted "pid" field. A single row is
+// valid for all gateway flows — identification is always by pid.
+//
+// Flow:
+//  1. Extract the pid from the request body.
+//  2. Look up the enabled row by pid; if missing, return signature error.
+//  3. Verify signature == MD5(sorted_params + secret_key).
+//  4. Enforce IP whitelist (empty = allow any).
+//  5. Bump call_count / last_used_at (best-effort).
+//  6. Stash api_key_id + row in context and rewind the body.
 func CheckApiSign() echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(ctx echo.Context) error {
-			params, err := ioutil.ReadAll(ctx.Request().Body)
+			params, err := io.ReadAll(ctx.Request().Body)
 			if err != nil {
 				return constant.SignatureErr
 			}
+			// Rewind the body for downstream bindings regardless of outcome.
+			ctx.Request().Body = io.NopCloser(bytes.NewBuffer(params))
+
 			m := make(map[string]interface{})
-			err = json.Cjson.Unmarshal(params, &m)
+			contentType := ctx.Request().Header.Get("Content-Type")
+			if strings.Contains(contentType, "application/x-www-form-urlencoded") {
+				values, parseErr := url.ParseQuery(string(params))
+				if parseErr != nil {
+					return constant.SignatureErr
+				}
+				for k, vs := range values {
+					if len(vs) > 0 {
+						m[k] = vs[0]
+					}
+				}
+			} else {
+				if err = json.Cjson.Unmarshal(params, &m); err != nil {
+					return constant.SignatureErr
+				}
+			}
 			signature, ok := m["signature"]
 			if !ok {
 				return constant.SignatureErr
 			}
-			checkSignature, err := sign.Get(m, config.GetApiAuthToken())
+			identifier := extractPid(m)
+			if identifier == "" {
+				return constant.SignatureErr
+			}
+
+			row, err := data.GetEnabledApiKey(identifier)
+			if err != nil || row.ID == 0 {
+				return constant.SignatureErr
+			}
+
+			checkSignature, err := sign.Get(m, row.SecretKey)
 			if err != nil {
 				return constant.SignatureErr
 			}
-			if checkSignature != signature {
+			signatureStr, _ := signature.(string)
+			if subtle.ConstantTimeCompare([]byte(checkSignature), []byte(signatureStr)) != 1 {
 				return constant.SignatureErr
 			}
-			ctx.Request().Body = ioutil.NopCloser(bytes.NewBuffer(params))
+
+			if !IsIPWhitelisted(row.IpWhitelist, ctx.RealIP()) {
+				return constant.SignatureErr
+			}
+
+			_ = data.TouchApiKeyUsage(row.ID)
+
+			ctx.Set(ApiKeyIDKey, row.ID)
+			ctx.Set(ApiKeyRowKey, row)
 			return next(ctx)
 		}
 	}
 }
+
+// extractPid reads the "pid" field from the request body. JSON numbers
+// unmarshal to float64 (EPAY merchants typically send numeric pid); we
+// format with -1 precision to drop trailing zeros so "1000" matches
+// regardless of whether the client sent a string or a number.
+func extractPid(m map[string]interface{}) string {
+	v, ok := m["pid"]
+	if !ok || v == nil {
+		return ""
+	}
+	switch t := v.(type) {
+	case string:
+		return strings.TrimSpace(t)
+	case float64:
+		return strconv.FormatFloat(t, 'f', -1, 64)
+	}
+	return ""
+}
+
+// IsIPWhitelisted checks the CSV IP list. Empty list = open.
+// Entries may be single IPs or CIDR blocks.
+func IsIPWhitelisted(csv, remote string) bool {
+	csv = strings.TrimSpace(csv)
+	if csv == "" {
+		return true
+	}
+	remoteIP := net.ParseIP(remote)
+	for _, raw := range strings.Split(csv, ",") {
+		entry := strings.TrimSpace(raw)
+		if entry == "" {
+			continue
+		}
+		if strings.Contains(entry, "/") {
+			_, cidr, err := net.ParseCIDR(entry)
+			if err == nil && remoteIP != nil && cidr.Contains(remoteIP) {
+				return true
+			}
+			continue
+		}
+		if entry == remote {
+			return true
+		}
+	}
+	return false
+}

src/middleware/check_token.go

@@ -1,24 +0,0 @@
-package middleware
-
-import (
-	"github.com/assimon/luuu/config"
-	"github.com/assimon/luuu/util/constant"
-	"github.com/labstack/echo/v4"
-)
-
-// CheckApiToken validates the Authorization header against the configured api_auth_token.
-// Use this for management APIs (GET/POST) where body-based signature is not practical.
-func CheckApiToken() echo.MiddlewareFunc {
-	return func(next echo.HandlerFunc) echo.HandlerFunc {
-		return func(ctx echo.Context) error {
-			token := ctx.Request().Header.Get("Authorization")
-			if token == "" {
-				token = ctx.QueryParam("api_token")
-			}
-			if token == "" || token != config.GetApiAuthToken() {
-				return constant.SignatureErr
-			}
-			return next(ctx)
-		}
-	}
-}

src/model/dao/mdb_table_init.go

@@ -1,60 +1,250 @@
 package dao
 
 import (
+	"encoding/json"
+	"strconv"
+	"strings"
 	"sync"
 
 	"github.com/assimon/luuu/model/mdb"
 	"github.com/gookit/color"
+	"gorm.io/gorm/clause"
 )
 
 var once sync.Once
 
-// 自动建表
+// MdbTableInit performs AutoMigrate for all primary DB tables and seeds
+// the minimum static rows: chains, chain tokens, default settings, and
+// a Telegram notification channel migrated from legacy settings keys.
+// Called by dao.Init (via bootstrap.InitApp) after the DB connection is
+// established.  The install wizard (see install/installer.go) writes the
+// .env file before bootstrap runs, so this function always finds the DB
+// available.
 func MdbTableInit() {
 	once.Do(func() {
-		if err := Mdb.AutoMigrate(&mdb.Orders{}); err != nil {
+		migrations := []struct {
-			color.Red.Printf("[store_db] AutoMigrate DB(Orders),err=%s\n", err)
+			name  string
-			// panic(err)
+			model interface{}
-			return
+		}{
+			{"Orders", &mdb.Orders{}},
+			{"WalletAddress", &mdb.WalletAddress{}},
+			{"AdminUser", &mdb.AdminUser{}},
+			{"ApiKey", &mdb.ApiKey{}},
+			{"Setting", &mdb.Setting{}},
+			{"NotificationChannel", &mdb.NotificationChannel{}},
+			{"Chain", &mdb.Chain{}},
+			{"ChainToken", &mdb.ChainToken{}},
+			{"RpcNode", &mdb.RpcNode{}},
 		}
-		if err := Mdb.AutoMigrate(&mdb.WalletAddress{}); err != nil {
+		for _, m := range migrations {
-			color.Red.Printf("[store_db] AutoMigrate DB(Orders),err=%s\n", err)
+			if err := Mdb.AutoMigrate(m.model); err != nil {
-			// panic(err)
+				color.Red.Printf("[store_db] AutoMigrate DB(%s),err=%s\n", m.name, err)
-			return
+				return
-		}
+			}
-		if err := Mdb.AutoMigrate(&mdb.SupportedAsset{}); err != nil {
-			color.Red.Printf("[store_db] AutoMigrate DB(SupportedAsset),err=%s\n", err)
-			return
 		}
 
-		seedSupportedAssets()
+		seedChains()
+		seedRpcNodes()
+		seedChainTokens()
+		seedDefaultSettings()
+		seedTelegramChannelFromSettings()
 	})
 }
 
-func seedSupportedAssets() {
+// seedChains inserts the built-in networks as enabled rows. Uses
-	var cnt int64
+// ON CONFLICT DO NOTHING so re-runs are no-ops and admin edits persist.
-	if err := Mdb.Model(&mdb.SupportedAsset{}).Count(&cnt).Error; err != nil {
+func seedChains() {
-		color.Red.Printf("[store_db] Count SupportedAsset,err=%s\n", err)
+	defaults := []mdb.Chain{
-		return
+		{Network: mdb.NetworkTron, DisplayName: "TRON", Enabled: true, MinConfirmations: 1, ScanIntervalSec: 5},
+		{Network: mdb.NetworkEthereum, DisplayName: "Ethereum", Enabled: true, MinConfirmations: 3, ScanIntervalSec: 5},
+		{Network: mdb.NetworkSolana, DisplayName: "Solana", Enabled: true, MinConfirmations: 1, ScanIntervalSec: 5},
+		{Network: mdb.NetworkBsc, DisplayName: "BSC", Enabled: true, MinConfirmations: 3, ScanIntervalSec: 5},
+		{Network: mdb.NetworkPolygon, DisplayName: "Polygon", Enabled: true, MinConfirmations: 3, ScanIntervalSec: 5},
+		{Network: mdb.NetworkPlasma, DisplayName: "Plasma", Enabled: true, MinConfirmations: 1, ScanIntervalSec: 5},
 	}
-	if cnt > 0 {
+	if err := Mdb.Clauses(clause.OnConflict{DoNothing: true}).Create(&defaults).Error; err != nil {
-		return
+		color.Red.Printf("[store_db] seed chains err=%s\n", err)
-	}
+	}
-	defaults := []mdb.SupportedAsset{
+}
-		{Network: mdb.NetworkTron, Token: "TRX", Status: mdb.TokenStatusEnable},
+
-		{Network: mdb.NetworkTron, Token: "USDT", Status: mdb.TokenStatusEnable},
+// seedChainTokens inserts default token configurations for each chain.
-		{Network: mdb.NetworkSolana, Token: "SOL", Status: mdb.TokenStatusEnable},
+// ON CONFLICT DO NOTHING on the (network, symbol) unique index so
-		{Network: mdb.NetworkSolana, Token: "USDT", Status: mdb.TokenStatusEnable},
+// re-runs are no-ops and admin edits to contract_address / decimals /
-		{Network: mdb.NetworkSolana, Token: "USDC", Status: mdb.TokenStatusEnable},
+// min_amount persist across restarts.
-		{Network: mdb.NetworkEthereum, Token: "USDT", Status: mdb.TokenStatusEnable},
+func seedChainTokens() {
-		{Network: mdb.NetworkEthereum, Token: "USDC", Status: mdb.TokenStatusEnable},
+	// Contract-address rows are matched by scanners via exact contract
-		{Network: mdb.NetworkBsc, Token: "USDT", Status: mdb.TokenStatusEnable},
+	// lookup. Native-token rows (empty contract_address) are matched by
-		{Network: mdb.NetworkBsc, Token: "USDC", Status: mdb.TokenStatusEnable},
+	// symbol — these act as admin toggles for the native payment path.
-		{Network: mdb.NetworkPolygon, Token: "USDT", Status: mdb.TokenStatusEnable},
+	defaults := []mdb.ChainToken{
-		{Network: mdb.NetworkPolygon, Token: "USDC", Status: mdb.TokenStatusEnable},
+		// TRON
-		{Network: mdb.NetworkPlasma, Token: "USDT", Status: mdb.TokenStatusEnable},
+		{Network: mdb.NetworkTron, Symbol: "USDT", ContractAddress: "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t", Decimals: 6, Enabled: true},
-	}
+		{Network: mdb.NetworkTron, Symbol: "TRX", ContractAddress: "", Decimals: 6, Enabled: true},
-	if err := Mdb.Create(&defaults).Error; err != nil {
+		// Ethereum
-		color.Red.Printf("[store_db] Seed SupportedAsset,err=%s\n", err)
+		{Network: mdb.NetworkEthereum, Symbol: "USDT", ContractAddress: "0xdAC17F958D2ee523a2206206994597C13D831ec7", Decimals: 6, Enabled: true},
+		{Network: mdb.NetworkEthereum, Symbol: "USDC", ContractAddress: "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", Decimals: 6, Enabled: true},
+		// Solana
+		{Network: mdb.NetworkSolana, Symbol: "USDT", ContractAddress: "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB", Decimals: 6, Enabled: true},
+		{Network: mdb.NetworkSolana, Symbol: "USDC", ContractAddress: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", Decimals: 6, Enabled: true},
+		{Network: mdb.NetworkSolana, Symbol: "SOL", ContractAddress: "", Decimals: 9, Enabled: true},
+		// BSC (BEP20 USDT/USDC are 18 decimals, unlike their Ethereum counterparts)
+		{Network: mdb.NetworkBsc, Symbol: "USDT", ContractAddress: "0x55d398326f99059fF775485246999027B3197955", Decimals: 18, Enabled: true},
+		{Network: mdb.NetworkBsc, Symbol: "USDC", ContractAddress: "0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d", Decimals: 18, Enabled: true},
+		// Polygon
+		{Network: mdb.NetworkPolygon, Symbol: "USDT", ContractAddress: "0xc2132D05D31c914a87C6611C10748AEb04B58e8F", Decimals: 6, Enabled: true},
+		{Network: mdb.NetworkPolygon, Symbol: "USDC", ContractAddress: "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359", Decimals: 6, Enabled: true},
+		{Network: mdb.NetworkPolygon, Symbol: "USDC.e", ContractAddress: "0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174", Decimals: 6, Enabled: true},
+		// Plasma
+		{Network: mdb.NetworkPlasma, Symbol: "USDT", ContractAddress: "0xB8CE59FC3717ada4C02eaDF9682A9e934F625ebb", Decimals: 6, Enabled: true},
+	}
+	if err := Mdb.Clauses(clause.OnConflict{DoNothing: true}).Create(&defaults).Error; err != nil {
+		color.Red.Printf("[store_db] seed chain_tokens err=%s\n", err)
+	}
+}
+
+// seedRpcNodes inserts default RPC endpoints for each chain. Checks per
+// (network, url) so re-runs are idempotent and admin edits persist.
+func seedRpcNodes() {
+	defaults := []mdb.RpcNode{
+		{Network: mdb.NetworkTron, Url: "https://api.trongrid.io", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkEthereum, Url: "wss://ethereum.publicnode.com", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkSolana, Url: "https://api.mainnet-beta.solana.com", Type: mdb.RpcNodeTypeHttp, Weight: 1, Enabled: true, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkBsc, Url: "wss://bsc.drpc.org", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkPolygon, Url: "wss://polygon-bor-rpc.publicnode.com", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Status: mdb.RpcNodeStatusUnknown},
+		{Network: mdb.NetworkPlasma, Url: "wss://rpc.plasma.to", Type: mdb.RpcNodeTypeWs, Weight: 1, Enabled: true, Status: mdb.RpcNodeStatusUnknown},
+	}
+	for _, d := range defaults {
+		var count int64
+		if err := Mdb.Model(&mdb.RpcNode{}).
+			Where("network = ? AND url = ?", d.Network, d.Url).
+			Count(&count).Error; err != nil {
+			color.Red.Printf("[store_db] seed rpc_nodes check err=%s\n", err)
+			continue
+		}
+		if count > 0 {
+			continue
+		}
+		if err := Mdb.Create(&d).Error; err != nil {
+			color.Red.Printf("[store_db] seed rpc_nodes err=%s\n", err)
+		}
+	}
+}
+
+// seedDefaultSettings inserts built-in default settings.
+// Uses ON CONFLICT DO NOTHING so admin edits persist across restarts.
+func seedDefaultSettings() {
+	defaults := []mdb.Setting{
+		{Group: mdb.SettingGroupEpay, Key: mdb.SettingKeyEpayDefaultToken, Value: "usdt", Type: mdb.SettingTypeString},
+		{Group: mdb.SettingGroupEpay, Key: mdb.SettingKeyEpayDefaultCurrency, Value: "cny", Type: mdb.SettingTypeString},
+		{Group: mdb.SettingGroupEpay, Key: mdb.SettingKeyEpayDefaultNetwork, Value: "tron", Type: mdb.SettingTypeString},
+	}
+	if err := Mdb.Clauses(clause.OnConflict{DoNothing: true}).Create(&defaults).Error; err != nil {
+		color.Red.Printf("[store_db] seed default settings err=%s\n", err)
+	}
+}
+
+// seedTelegramChannelFromSettings auto-migrates the legacy settings-table
+// Telegram config into a notification_channels row so the notify dispatcher
+// can use it. Idempotent: no-op when any telegram channel already exists.
+//
+// Legacy keys read from settings:
+//
+//	system.telegram_bot_token               → TelegramConfig.BotToken
+//	system.telegram_chat_id                 → TelegramConfig.ChatID
+//	system.telegram_payment_notice_enabled  → events.pay_success
+//	system.telegram_abnormal_notice_enabled → events.order_expired
+func seedTelegramChannelFromSettings() {
+	var count int64
+	if err := Mdb.Model(&mdb.NotificationChannel{}).
+		Where("type = ?", mdb.NotificationTypeTelegram).
+		Count(&count).Error; err != nil {
+		color.Red.Printf("[store_db] seed telegram channel check err=%s\n", err)
+		return
+	}
+	if count > 0 {
+		return
+	}
+	SyncTelegramChannelFromSettings()
+}
+
+// SyncTelegramChannelFromSettings reads the four Telegram keys from the
+// settings table and upserts the matching notification_channels row:
+//   - creates a new row when none exists yet
+//   - updates config+events on the first existing row when settings change
+//
+// This is called at startup (via seedTelegramChannelFromSettings) and by
+// the settings controller whenever any Telegram key is changed at runtime.
+func SyncTelegramChannelFromSettings() {
+	keys := []string{
+		"system.telegram_bot_token",
+		"system.telegram_chat_id",
+		"system.telegram_payment_notice_enabled",
+		"system.telegram_abnormal_notice_enabled",
+	}
+	var rows []mdb.Setting
+	if err := Mdb.Where("key IN ?", keys).Find(&rows).Error; err != nil {
+		color.Red.Printf("[store_db] sync telegram channel: read settings err=%s\n", err)
+		return
+	}
+	m := make(map[string]string, len(rows))
+	for _, r := range rows {
+		m[r.Key] = r.Value
+	}
+
+	botToken := strings.TrimSpace(m["system.telegram_bot_token"])
+	chatIDStr := strings.TrimSpace(m["system.telegram_chat_id"])
+	if botToken == "" || chatIDStr == "" {
+		return // No telegram config to sync.
+	}
+
+	chatID, err := strconv.ParseInt(chatIDStr, 10, 64)
+	if err != nil {
+		color.Red.Printf("[store_db] sync telegram channel: invalid chat_id=%q\n", chatIDStr)
+		return
+	}
+
+	paymentEnabled, _ := strconv.ParseBool(m["system.telegram_payment_notice_enabled"])
+	abnormalEnabled, _ := strconv.ParseBool(m["system.telegram_abnormal_notice_enabled"])
+
+	configJSON, _ := json.Marshal(map[string]interface{}{
+		"bot_token": botToken,
+		"chat_id":   chatID,
+		"proxy":     "",
+	})
+	eventsJSON, _ := json.Marshal(map[string]bool{
+		mdb.NotifyEventPaySuccess:   paymentEnabled,
+		mdb.NotifyEventOrderExpired: abnormalEnabled,
+		mdb.NotifyEventDailyReport:  false,
+	})
+
+	// Try to update an existing row first.
+	// Use Find (not First) to avoid GORM printing a spurious
+	// "record not found" log when the table is empty on first boot.
+	var existing mdb.NotificationChannel
+	Mdb.Model(&mdb.NotificationChannel{}).
+		Where("type = ?", mdb.NotificationTypeTelegram).
+		Order("id ASC").Limit(1).Find(&existing)
+	if existing.ID != 0 {
+		// Row exists — patch config and events.
+		if err2 := Mdb.Model(&existing).Updates(map[string]interface{}{
+			"config": string(configJSON),
+			"events": string(eventsJSON),
+		}).Error; err2 != nil {
+			color.Red.Printf("[store_db] sync telegram channel update err=%s\n", err2)
+		}
+		return
+	}
+
+	// No row yet — create one.
+	ch := mdb.NotificationChannel{
+		Type:    mdb.NotificationTypeTelegram,
+		Name:    "Telegram",
+		Config:  string(configJSON),
+		Events:  string(eventsJSON),
+		Enabled: true,
+	}
+	if err := Mdb.Create(&ch).Error; err != nil {
+		color.Red.Printf("[store_db] sync telegram channel create err=%s\n", err)
+	} else {
+		color.Green.Printf("[store_db] created telegram notification_channel from settings (id=%d)\n", ch.ID)
 	}
 }

src/model/data/admin_user_data.go

@@ -0,0 +1,93 @@
+package data
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"strings"
+
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/dromara/carbon/v2"
+	"golang.org/x/crypto/bcrypt"
+)
+
+const defaultAdminUsername = "admin"
+
+// EnsureDefaultAdmin seeds an initial admin account when no admin user
+// exists. The password is randomly generated and returned so the caller
+// can print it to the console. Idempotent — subsequent calls return
+// ("", false, nil).
+func EnsureDefaultAdmin() (password string, created bool, err error) {
+	var count int64
+	if err := dao.Mdb.Model(&mdb.AdminUser{}).Count(&count).Error; err != nil {
+		return "", false, err
+	}
+	if count > 0 {
+		return "", false, nil
+	}
+	password = randomAdminPassword()
+	hash, err := HashPassword(password)
+	if err != nil {
+		return "", false, err
+	}
+	user := &mdb.AdminUser{
+		Username:     defaultAdminUsername,
+		PasswordHash: hash,
+		Status:       mdb.AdminUserStatusEnable,
+	}
+	return password, true, dao.Mdb.Create(user).Error
+}
+
+func randomAdminPassword() string {
+	b := make([]byte, 16)
+	_, _ = rand.Read(b)
+	return hex.EncodeToString(b)
+}
+
+// HashPassword bcrypts a plaintext password.
+func HashPassword(plain string) (string, error) {
+	b, err := bcrypt.GenerateFromPassword([]byte(plain), bcrypt.DefaultCost)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
+
+// VerifyPassword compares a plaintext password against a bcrypt hash.
+func VerifyPassword(hash, plain string) bool {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(plain)) == nil
+}
+
+// GetAdminUserByUsername returns the row for a username (case-insensitive).
+func GetAdminUserByUsername(username string) (*mdb.AdminUser, error) {
+	u := new(mdb.AdminUser)
+	err := dao.Mdb.Model(u).
+		Where("username = ?", strings.ToLower(strings.TrimSpace(username))).
+		Limit(1).Find(u).Error
+	return u, err
+}
+
+// GetAdminUserByID returns the row for an ID.
+func GetAdminUserByID(id uint64) (*mdb.AdminUser, error) {
+	u := new(mdb.AdminUser)
+	err := dao.Mdb.Model(u).Limit(1).Find(u, id).Error
+	return u, err
+}
+
+// UpdateAdminUserPassword rehashes and persists a new password.
+func UpdateAdminUserPassword(id uint64, newPlain string) error {
+	hash, err := HashPassword(newPlain)
+	if err != nil {
+		return err
+	}
+	return dao.Mdb.Model(&mdb.AdminUser{}).
+		Where("id = ?", id).
+		Update("password_hash", hash).Error
+}
+
+// TouchAdminUserLastLogin stamps last_login_at to now.
+func TouchAdminUserLastLogin(id uint64) error {
+	return dao.Mdb.Model(&mdb.AdminUser{}).
+		Where("id = ?", id).
+		Update("last_login_at", carbon.Now().StdTime()).Error
+}

src/model/data/api_key_data.go

@@ -0,0 +1,137 @@
+package data
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"strconv"
+	"strings"
+
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/dromara/carbon/v2"
+	"gorm.io/gorm"
+)
+
+// GetEnabledApiKey looks up an enabled merchant credential row by PID.
+// A single row is valid for both EPAY and GMPAY flows; the route
+// determines the flow. Returns (row, nil) on success; (zero row, nil)
+// when no match; error only on true DB failure.
+func GetEnabledApiKey(pid string) (*mdb.ApiKey, error) {
+	row := new(mdb.ApiKey)
+	err := dao.Mdb.Model(row).
+		Where("pid = ?", strings.TrimSpace(pid)).
+		Where("status = ?", mdb.ApiKeyStatusEnable).
+		Limit(1).Find(row).Error
+	return row, err
+}
+
+// GetApiKeyByID fetches a row by primary key (including disabled).
+func GetApiKeyByID(id uint64) (*mdb.ApiKey, error) {
+	row := new(mdb.ApiKey)
+	err := dao.Mdb.Model(row).Limit(1).Find(row, id).Error
+	return row, err
+}
+
+// ListApiKeys returns all rows ordered by ID descending.
+func ListApiKeys() ([]mdb.ApiKey, error) {
+	var rows []mdb.ApiKey
+	err := dao.Mdb.Model(&mdb.ApiKey{}).Order("id DESC").Find(&rows).Error
+	return rows, err
+}
+
+// CreateApiKey persists a new row.
+func CreateApiKey(row *mdb.ApiKey) error {
+	return dao.Mdb.Create(row).Error
+}
+
+// UpdateApiKeyFields updates a whitelist of mutable fields on a row.
+func UpdateApiKeyFields(id uint64, fields map[string]interface{}) error {
+	if len(fields) == 0 {
+		return nil
+	}
+	return dao.Mdb.Model(&mdb.ApiKey{}).Where("id = ?", id).Updates(fields).Error
+}
+
+// DeleteApiKeyByID removes (soft-deletes) a row.
+func DeleteApiKeyByID(id uint64) error {
+	return dao.Mdb.Where("id = ?", id).Delete(&mdb.ApiKey{}).Error
+}
+
+// TouchApiKeyUsage increments call_count and stamps last_used_at.
+// Called from the signature middleware after a successful verify.
+func TouchApiKeyUsage(id uint64) error {
+	return dao.Mdb.Model(&mdb.ApiKey{}).
+		Where("id = ?", id).
+		Updates(map[string]interface{}{
+			"call_count":   gorm.Expr("call_count + 1"),
+			"last_used_at": carbon.Now().StdTime(),
+		}).Error
+}
+
+// basePid is the starting PID value for api_keys.
+const basePid = 1000
+
+// NextPid returns the next available numeric PID for api_keys. Scans
+// ALL rows (including soft-deleted) to avoid reusing a PID whose row
+// is still in the table with a non-null deleted_at — the unique index
+// on pid doesn't know about soft deletes, so reuse would trigger a
+// DB-level unique violation on Create.
+func NextPid() (int, error) {
+	var rows []mdb.ApiKey
+	err := dao.Mdb.Unscoped().Model(&mdb.ApiKey{}).Select("pid").Find(&rows).Error
+	if err != nil {
+		return basePid, err
+	}
+	maxPid := basePid - 1
+	for _, r := range rows {
+		if pid, err := strconv.Atoi(strings.TrimSpace(r.Pid)); err == nil && pid > maxPid {
+			maxPid = pid
+		}
+	}
+	return maxPid + 1, nil
+}
+
+// SeededApiKey carries the details of a newly created default key so
+// the caller can print them to the console (secret is never surfaced
+// again via the admin API — it has to be viewed via /api-keys/:id/secret
+// after login).
+type SeededApiKey struct {
+	Pid       string
+	Name      string
+	SecretKey string
+}
+
+// EnsureDefaultApiKey seeds ONE universal API key on a fresh install.
+// The seeded key is valid for all three gateway flows — the admin can
+// create additional keys later, each also universal. Idempotent: if
+// any api_keys row already exists, returns nil without seeding.
+func EnsureDefaultApiKey() (*SeededApiKey, error) {
+	var count int64
+	if err := dao.Mdb.Model(&mdb.ApiKey{}).Count(&count).Error; err != nil {
+		return nil, err
+	}
+	if count > 0 {
+		return nil, nil
+	}
+	secret := generateHex(32)
+	row := &mdb.ApiKey{
+		Name:      "default",
+		Pid:       strconv.Itoa(basePid),
+		SecretKey: secret,
+		Status:    mdb.ApiKeyStatusEnable,
+	}
+	if err := dao.Mdb.Create(row).Error; err != nil {
+		return nil, err
+	}
+	return &SeededApiKey{
+		Pid:       row.Pid,
+		Name:      row.Name,
+		SecretKey: secret,
+	}, nil
+}
+
+func generateHex(n int) string {
+	b := make([]byte, n)
+	_, _ = rand.Read(b)
+	return hex.EncodeToString(b)
+}

src/model/data/chain_data.go

@@ -0,0 +1,54 @@
+package data
+
+import (
+	"strings"
+
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/mdb"
+)
+
+// ListChains returns all chain rows ordered by id.
+func ListChains() ([]mdb.Chain, error) {
+	var rows []mdb.Chain
+	err := dao.Mdb.Model(&mdb.Chain{}).Order("id ASC").Find(&rows).Error
+	return rows, err
+}
+
+// ListEnabledChains returns only rows with Enabled=true.
+func ListEnabledChains() ([]mdb.Chain, error) {
+	var rows []mdb.Chain
+	err := dao.Mdb.Model(&mdb.Chain{}).
+		Where("enabled = ?", true).
+		Order("id ASC").Find(&rows).Error
+	return rows, err
+}
+
+// GetChainByNetwork fetches one row by network key.
+func GetChainByNetwork(network string) (*mdb.Chain, error) {
+	row := new(mdb.Chain)
+	err := dao.Mdb.Model(row).
+		Where("network = ?", strings.ToLower(strings.TrimSpace(network))).
+		Limit(1).Find(row).Error
+	return row, err
+}
+
+// IsChainEnabled returns whether the row exists and Enabled=true. A
+// missing row is treated as disabled — scanners must be able to
+// short-circuit even before the admin creates the chain entry.
+func IsChainEnabled(network string) bool {
+	row, err := GetChainByNetwork(network)
+	if err != nil || row.ID == 0 {
+		return false
+	}
+	return row.Enabled
+}
+
+// UpdateChainFields patches mutable columns.
+func UpdateChainFields(network string, fields map[string]interface{}) error {
+	if len(fields) == 0 {
+		return nil
+	}
+	return dao.Mdb.Model(&mdb.Chain{}).
+		Where("network = ?", strings.ToLower(strings.TrimSpace(network))).
+		Updates(fields).Error
+}

src/model/data/chain_token_data.go

@@ -0,0 +1,125 @@
+package data
+
+import (
+	"strings"
+
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/mdb"
+)
+
+// ListEnabledChainTokens returns enabled tokens, optionally filtered by network.
+// An empty network returns all enabled tokens across all networks.
+func ListEnabledChainTokens(network string) ([]mdb.ChainToken, error) {
+	var rows []mdb.ChainToken
+	tx := dao.Mdb.Model(&mdb.ChainToken{}).Where("enabled = ?", true)
+	if n := strings.ToLower(strings.TrimSpace(network)); n != "" {
+		tx = tx.Where("network = ?", n)
+	}
+	err := tx.Order("network ASC, id ASC").Find(&rows).Error
+	return rows, err
+}
+
+// ListChainTokens returns rows optionally filtered by network.
+func ListChainTokens(network string) ([]mdb.ChainToken, error) {
+	var rows []mdb.ChainToken
+	tx := dao.Mdb.Model(&mdb.ChainToken{})
+	if network != "" {
+		tx = tx.Where("network = ?", strings.ToLower(network))
+	}
+	err := tx.Order("id ASC").Find(&rows).Error
+	return rows, err
+}
+
+// ListEnabledChainTokensByNetwork returns the enabled tokens for a network.
+// Scanners call this to learn which contract addresses to subscribe to.
+func ListEnabledChainTokensByNetwork(network string) ([]mdb.ChainToken, error) {
+	var rows []mdb.ChainToken
+	err := dao.Mdb.Model(&mdb.ChainToken{}).
+		Where("network = ?", strings.ToLower(network)).
+		Where("enabled = ?", true).
+		Find(&rows).Error
+	return rows, err
+}
+
+// GetEnabledChainTokenByContract finds one enabled token by (network,
+// contract_address). Used by EVM/TRON scanners to resolve the symbol
+// and decimals of an incoming transfer. Returns (zero row, nil) if no
+// match. The contract address match is case-insensitive.
+func GetEnabledChainTokenByContract(network, contractAddress string) (*mdb.ChainToken, error) {
+	row := new(mdb.ChainToken)
+	addr := strings.TrimSpace(contractAddress)
+	if addr == "" {
+		return row, nil
+	}
+	err := dao.Mdb.Model(row).
+		Where("network = ?", strings.ToLower(strings.TrimSpace(network))).
+		Where("enabled = ?", true).
+		Where("LOWER(contract_address) = ?", strings.ToLower(addr)).
+		Limit(1).Find(row).Error
+	return row, err
+}
+
+// GetEnabledChainTokenBySymbol finds one enabled token by (network, symbol).
+// Used by Solana native-SOL path where there's no contract address.
+func GetEnabledChainTokenBySymbol(network, symbol string) (*mdb.ChainToken, error) {
+	row := new(mdb.ChainToken)
+	sym := strings.TrimSpace(symbol)
+	if sym == "" {
+		return row, nil
+	}
+	err := dao.Mdb.Model(row).
+		Where("network = ?", strings.ToLower(strings.TrimSpace(network))).
+		Where("enabled = ?", true).
+		Where("UPPER(symbol) = ?", strings.ToUpper(sym)).
+		Limit(1).Find(row).Error
+	return row, err
+}
+
+// GetChainTokenByID fetches by primary key.
+func GetChainTokenByID(id uint64) (*mdb.ChainToken, error) {
+	row := new(mdb.ChainToken)
+	err := dao.Mdb.Model(row).Limit(1).Find(row, id).Error
+	return row, err
+}
+
+// CreateChainToken inserts a row.
+// If a soft-deleted row with the same (network, symbol) exists it is
+// restored with the incoming field values rather than creating a duplicate
+// that would violate the unique index.
+func CreateChainToken(row *mdb.ChainToken) error {
+	deleted := new(mdb.ChainToken)
+	err := dao.Mdb.Unscoped().
+		Where("network = ? AND symbol = ? AND deleted_at IS NOT NULL", row.Network, row.Symbol).
+		Limit(1).Find(deleted).Error
+	if err != nil {
+		return err
+	}
+	if deleted.ID > 0 {
+		err = dao.Mdb.Unscoped().Model(deleted).Updates(map[string]interface{}{
+			"deleted_at":       nil,
+			"contract_address": row.ContractAddress,
+			"decimals":         row.Decimals,
+			"enabled":          row.Enabled,
+			"min_amount":       row.MinAmount,
+		}).Error
+		if err != nil {
+			return err
+		}
+		row.ID = deleted.ID
+		return nil
+	}
+	return dao.Mdb.Create(row).Error
+}
+
+// UpdateChainTokenFields patches mutable columns.
+func UpdateChainTokenFields(id uint64, fields map[string]interface{}) error {
+	if len(fields) == 0 {
+		return nil
+	}
+	return dao.Mdb.Model(&mdb.ChainToken{}).Where("id = ?", id).Updates(fields).Error
+}
+
+// DeleteChainTokenByID soft-deletes the row.
+func DeleteChainTokenByID(id uint64) error {
+	return dao.Mdb.Where("id = ?", id).Delete(&mdb.ChainToken{}).Error
+}

src/model/data/notification_channel_data.go

@@ -0,0 +1,81 @@
+package data
+
+import (
+	"encoding/json"
+	"strings"
+
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/mdb"
+)
+
+// ListNotificationChannels returns all rows, optionally filtered by type.
+func ListNotificationChannels(channelType string) ([]mdb.NotificationChannel, error) {
+	var rows []mdb.NotificationChannel
+	tx := dao.Mdb.Model(&mdb.NotificationChannel{})
+	if channelType != "" {
+		tx = tx.Where("type = ?", strings.ToLower(channelType))
+	}
+	err := tx.Order("id DESC").Find(&rows).Error
+	return rows, err
+}
+
+// ListEnabledChannelsByEvent returns enabled rows whose Events JSON has
+// the named event key set to true. Done in Go (rather than JSON_EXTRACT)
+// because the runtime DB is DB-agnostic (MySQL/Postgres/SQLite).
+func ListEnabledChannelsByEvent(event string) ([]mdb.NotificationChannel, error) {
+	var rows []mdb.NotificationChannel
+	if err := dao.Mdb.Model(&mdb.NotificationChannel{}).
+		Where("enabled = ?", true).
+		Find(&rows).Error; err != nil {
+		return nil, err
+	}
+	out := rows[:0]
+	for _, r := range rows {
+		events := map[string]bool{}
+		if r.Events != "" {
+			_ = json.Unmarshal([]byte(r.Events), &events)
+		}
+		if events[event] {
+			out = append(out, r)
+		}
+	}
+	return out, nil
+}
+
+// GetFirstEnabledTelegramChannel returns the oldest enabled telegram
+// row, or nil ID if none. Telegram bot startup uses this as the primary
+// instance backing /start and command handlers.
+func GetFirstEnabledTelegramChannel() (*mdb.NotificationChannel, error) {
+	row := new(mdb.NotificationChannel)
+	err := dao.Mdb.Model(row).
+		Where("type = ?", mdb.NotificationTypeTelegram).
+		Where("enabled = ?", true).
+		Order("id ASC").
+		Limit(1).Find(row).Error
+	return row, err
+}
+
+// GetNotificationChannelByID fetches by PK.
+func GetNotificationChannelByID(id uint64) (*mdb.NotificationChannel, error) {
+	row := new(mdb.NotificationChannel)
+	err := dao.Mdb.Model(row).Limit(1).Find(row, id).Error
+	return row, err
+}
+
+// CreateNotificationChannel inserts a new row.
+func CreateNotificationChannel(row *mdb.NotificationChannel) error {
+	return dao.Mdb.Create(row).Error
+}
+
+// UpdateNotificationChannelFields patches mutable columns.
+func UpdateNotificationChannelFields(id uint64, fields map[string]interface{}) error {
+	if len(fields) == 0 {
+		return nil
+	}
+	return dao.Mdb.Model(&mdb.NotificationChannel{}).Where("id = ?", id).Updates(fields).Error
+}
+
+// DeleteNotificationChannelByID soft-deletes a row.
+func DeleteNotificationChannelByID(id uint64) error {
+	return dao.Mdb.Where("id = ?", id).Delete(&mdb.NotificationChannel{}).Error
+}

src/model/data/order_admin_data.go

@@ -0,0 +1,151 @@
+package data
+
+import (
+	"strings"
+	"time"
+
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/mdb"
+	"gorm.io/gorm"
+)
+
+// OrderListFilter bundles every filter supported by the admin orders
+// list page. Zero values are ignored so callers can pass only what the
+// user actually filtered on.
+type OrderListFilter struct {
+	Status   int
+	Network  string
+	Token    string
+	Address  string
+	Keyword  string // matches trade_id / order_id / block_transaction_id
+	StartAt  *time.Time
+	EndAt    *time.Time
+	Page     int
+	PageSize int
+	// ParentOnly restricts the result to top-level orders only
+	// (parent_trade_id = ''). Sub-orders are excluded from the listing.
+	ParentOnly bool
+}
+
+// ListOrders returns a paginated order slice plus the total count under
+// the same filter (for the UI pagination bar).
+func ListOrders(f OrderListFilter) ([]mdb.Orders, int64, error) {
+	tx := buildOrderListQuery(f)
+	var total int64
+	if err := tx.Count(&total).Error; err != nil {
+		return nil, 0, err
+	}
+	page := f.Page
+	if page < 1 {
+		page = 1
+	}
+	size := f.PageSize
+	if size < 1 {
+		size = 20
+	}
+	if size > 200 {
+		size = 200
+	}
+	var rows []mdb.Orders
+	err := tx.Order("id DESC").
+		Offset((page - 1) * size).Limit(size).
+		Find(&rows).Error
+	return rows, total, err
+}
+
+func buildOrderListQuery(f OrderListFilter) *gorm.DB {
+	tx := dao.Mdb.Model(&mdb.Orders{})
+	if f.ParentOnly {
+		tx = tx.Where("parent_trade_id = ?", "")
+	}
+	if f.Status > 0 {
+		tx = tx.Where("status = ?", f.Status)
+	}
+	if f.Network != "" {
+		tx = tx.Where("network = ?", strings.ToLower(f.Network))
+	}
+	if f.Token != "" {
+		tx = tx.Where("token = ?", strings.ToUpper(f.Token))
+	}
+	if f.Address != "" {
+		tx = tx.Where("receive_address = ?", f.Address)
+	}
+	if f.Keyword != "" {
+		kw := "%" + strings.TrimSpace(f.Keyword) + "%"
+		tx = tx.Where("trade_id LIKE ? OR order_id LIKE ? OR block_transaction_id LIKE ?", kw, kw, kw)
+	}
+	if f.StartAt != nil {
+		tx = tx.Where("created_at >= ?", *f.StartAt)
+	}
+	if f.EndAt != nil {
+		tx = tx.Where("created_at <= ?", *f.EndAt)
+	}
+	return tx
+}
+
+// CountOrdersByStatus returns how many orders exist in each status.
+// Used by the dashboard overview card.
+func CountOrdersByStatus() (map[int]int64, error) {
+	type row struct {
+		Status int
+		Total  int64
+	}
+	var rows []row
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Select("status, COUNT(*) AS total").
+		Group("status").
+		Scan(&rows).Error
+	if err != nil {
+		return nil, err
+	}
+	out := map[int]int64{}
+	for _, r := range rows {
+		out[r.Status] = r.Total
+	}
+	return out, nil
+}
+
+// CloseOrderManually transitions a pending order to expired. Only
+// touches rows currently in StatusWaitPay so idempotent / safe.
+func CloseOrderManually(tradeID string) (bool, error) {
+	result := dao.Mdb.Model(&mdb.Orders{}).
+		Where("trade_id = ?", tradeID).
+		Where("status = ?", mdb.StatusWaitPay).
+		Update("status", mdb.StatusExpired)
+	return result.RowsAffected > 0, result.Error
+}
+
+// ReopenOrderCallback flips callback_confirm back to NO so the mq
+// worker picks it up on the next tick. Used by "resend callback".
+func ReopenOrderCallback(tradeID string) (bool, error) {
+	result := dao.Mdb.Model(&mdb.Orders{}).
+		Where("trade_id = ?", tradeID).
+		Where("status = ?", mdb.StatusPaySuccess).
+		Updates(map[string]interface{}{
+			"callback_confirm": mdb.CallBackConfirmNo,
+			"callback_num":     0,
+		})
+	return result.RowsAffected > 0, result.Error
+}
+
+// CountOrdersByAddress returns order counts grouped by receive_address.
+// The admin wallet list annotates each wallet row with this number.
+func CountOrdersByAddress() (map[string]int64, error) {
+	type row struct {
+		Address string `gorm:"column:receive_address"`
+		Total   int64
+	}
+	var rows []row
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Select("receive_address, COUNT(*) AS total").
+		Group("receive_address").
+		Scan(&rows).Error
+	if err != nil {
+		return nil, err
+	}
+	out := map[string]int64{}
+	for _, r := range rows {
+		out[r.Address] = r.Total
+	}
+	return out, nil
+}

src/model/data/order_data.go

@@ -28,10 +28,31 @@ func normalizeLockAmount(amount float64) (int64, string) {
 	return value.Shift(2).IntPart(), value.StringFixed(2)
 }
 
+func normalizeLockNetwork(network string) string {
+	return strings.ToLower(strings.TrimSpace(network))
+}
+
+func normalizeLockAddress(network, address string) string {
+	address = strings.TrimSpace(address)
+	if isEVMNetwork(normalizeLockNetwork(network)) {
+		return strings.ToLower(address)
+	}
+	return address
+}
+
 func normalizeLockToken(token string) string {
 	return strings.ToUpper(strings.TrimSpace(token))
 }
 
+func applyLockAddressFilter(tx *gorm.DB, network, address string) *gorm.DB {
+	network = normalizeLockNetwork(network)
+	address = normalizeLockAddress(network, address)
+	if isEVMNetwork(network) {
+		return tx.Where("lower(address) = ?", address)
+	}
+	return tx.Where("address = ?", address)
+}
+
 // GetOrderInfoByOrderId fetches an order by merchant order id.
 func GetOrderInfoByOrderId(orderId string) (*mdb.Orders, error) {
 	order := new(mdb.Orders)
@@ -142,22 +163,38 @@ func GetSiblingSubOrders(parentTradeId string, excludeTradeId string) ([]mdb.Ord
 	return orders, err
 }
 
-// MarkParentOrderSuccess updates the parent order with the sub-order's payment details.
+// MarkParentOrderSuccess marks the parent order as paid and records which sub-order
-// Token and network are NOT overwritten — the parent keeps its original values.
+// settled it. Only the status, callback_confirm, and pay_by_sub_id fields are updated;
+// the parent's own block_transaction_id, actual_amount, and receive_address are
+// intentionally left unchanged because the parent was not directly paid.
 func MarkParentOrderSuccess(parentTradeId string, sub *mdb.Orders) (bool, error) {
-	result := dao.Mdb.Model(&mdb.Orders{}).
+	return MarkParentOrderSuccessWithTransaction(dao.Mdb, parentTradeId, sub)
+}
+
+// MarkParentOrderSuccessWithTransaction is the transactional variant of
+// MarkParentOrderSuccess.
+func MarkParentOrderSuccessWithTransaction(tx *gorm.DB, parentTradeId string, sub *mdb.Orders) (bool, error) {
+	result := tx.Model(&mdb.Orders{}).
 		Where("trade_id = ?", parentTradeId).
 		Where("status = ?", mdb.StatusWaitPay).
 		Updates(map[string]interface{}{
-			"status":               mdb.StatusPaySuccess,
+			"status":           mdb.StatusPaySuccess,
-			"block_transaction_id": sub.BlockTransactionId,
+			"callback_confirm": mdb.CallBackConfirmNo,
-			"callback_confirm":     mdb.CallBackConfirmNo,
+			"pay_by_sub_id":    sub.ID,
-			"actual_amount":        sub.ActualAmount,
-			"receive_address":      sub.ReceiveAddress,
 		})
 	return result.RowsAffected > 0, result.Error
 }
 
+// ExpireSiblingSubOrdersWithTransaction expires all waiting sibling
+// sub-orders under the same parent in one statement.
+func ExpireSiblingSubOrdersWithTransaction(tx *gorm.DB, parentTradeId string, excludeTradeId string) error {
+	return tx.Model(&mdb.Orders{}).
+		Where("parent_trade_id = ?", parentTradeId).
+		Where("trade_id != ?", excludeTradeId).
+		Where("status = ?", mdb.StatusWaitPay).
+		Update("status", mdb.StatusExpired).Error
+}
+
 // MarkOrderSelected sets is_selected=true for the given trade_id.
 func MarkOrderSelected(tradeId string) error {
 	return dao.Mdb.Model(&mdb.Orders{}).
@@ -191,6 +228,32 @@ func GetActiveSubOrders(parentTradeId string) ([]mdb.Orders, error) {
 	return orders, err
 }
 
+// GetAllSubOrders returns all sub-orders (any status) under a parent order,
+// ordered by creation time ascending.
+func GetAllSubOrders(parentTradeId string) ([]mdb.Orders, error) {
+	var orders []mdb.Orders
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Where("parent_trade_id = ?", parentTradeId).
+		Order("created_at ASC").
+		Find(&orders).Error
+	return orders, err
+}
+
+// GetSubOrdersByParentTradeIds batch-fetches all sub-orders (any status)
+// whose parent_trade_id is in the given set. Ordered by parent_trade_id
+// then created_at ASC so callers can build a grouped map in one pass.
+func GetSubOrdersByParentTradeIds(parentTradeIds []string) ([]mdb.Orders, error) {
+	if len(parentTradeIds) == 0 {
+		return nil, nil
+	}
+	var orders []mdb.Orders
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Where("parent_trade_id IN ?", parentTradeIds).
+		Order("parent_trade_id ASC, created_at ASC").
+		Find(&orders).Error
+	return orders, err
+}
+
 // ExpireOrderByTradeId marks a single order as expired if still waiting.
 func ExpireOrderByTradeId(tradeId string) error {
 	return dao.Mdb.Model(&mdb.Orders{}).
@@ -201,16 +264,17 @@ func ExpireOrderByTradeId(tradeId string) error {
 
 // GetTradeIdByWalletAddressAndAmountAndToken resolves the reserved trade id by network, address, token and amount.
 func GetTradeIdByWalletAddressAndAmountAndToken(network string, address string, token string, amount float64) (string, error) {
+	network = normalizeLockNetwork(network)
+	address = normalizeLockAddress(network, address)
 	scaledAmount, _ := normalizeLockAmount(amount)
 	var lock mdb.TransactionLock
-	err := dao.RuntimeDB.Model(&mdb.TransactionLock{}).
+	query := dao.RuntimeDB.Model(&mdb.TransactionLock{}).
 		Where("network = ?", network).
-		Where("address = ?", address).
 		Where("token = ?", normalizeLockToken(token)).
 		Where("amount_scaled = ?", scaledAmount).
-		Where("expires_at > ?", time.Now()).
+		Where("expires_at > ?", time.Now())
-		Limit(1).
+	query = applyLockAddressFilter(query, network, address)
-		Find(&lock).Error
+	err := query.Limit(1).Find(&lock).Error
 	if err != nil {
 		return "", err
 	}
@@ -222,6 +286,8 @@ func GetTradeIdByWalletAddressAndAmountAndToken(network string, address string,
 
 // LockTransaction reserves a network+address+token+amount pair in sqlite until expiration.
 func LockTransaction(network, address, token, tradeID string, amount float64, expirationTime time.Duration) error {
+	network = normalizeLockNetwork(network)
+	address = normalizeLockAddress(network, address)
 	scaledAmount, amountText := normalizeLockAmount(amount)
 	normalizedToken := normalizeLockToken(token)
 	now := time.Now()
@@ -236,12 +302,12 @@ func LockTransaction(network, address, token, tradeID string, amount float64, ex
 	}
 
 	return dao.RuntimeDB.Transaction(func(tx *gorm.DB) error {
-		if err := tx.Where("network = ?", network).
+		expiredQuery := tx.Where("network = ?", network).
-			Where("address = ?", address).
 			Where("token = ?", normalizedToken).
 			Where("amount_scaled = ?", scaledAmount).
-			Where("expires_at <= ?", now).
+			Where("expires_at <= ?", now)
-			Delete(&mdb.TransactionLock{}).Error; err != nil {
+		expiredQuery = applyLockAddressFilter(expiredQuery, network, address)
+		if err := expiredQuery.Delete(&mdb.TransactionLock{}).Error; err != nil {
 			return err
 		}
 		if err := tx.Where("trade_id = ?", tradeID).Delete(&mdb.TransactionLock{}).Error; err != nil {
@@ -261,13 +327,15 @@ func LockTransaction(network, address, token, tradeID string, amount float64, ex
 
 // UnLockTransaction releases the reservation for network+address+token+amount.
 func UnLockTransaction(network string, address string, token string, amount float64) error {
+	network = normalizeLockNetwork(network)
+	address = normalizeLockAddress(network, address)
 	scaledAmount, _ := normalizeLockAmount(amount)
-	return dao.RuntimeDB.
+	query := dao.RuntimeDB.
 		Where("network = ?", network).
-		Where("address = ?", address).
 		Where("token = ?", normalizeLockToken(token)).
-		Where("amount_scaled = ?", scaledAmount).
+		Where("amount_scaled = ?", scaledAmount)
-		Delete(&mdb.TransactionLock{}).Error
+	query = applyLockAddressFilter(query, network, address)
+	return query.Delete(&mdb.TransactionLock{}).Error
 }
 
 func UnLockTransactionByTradeId(tradeID string) error {

src/model/data/order_data_stats.go

@@ -0,0 +1,319 @@
+package data
+
+import (
+	"time"
+
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/mdb"
+)
+
+// DailyStat is one bucket of day-level aggregation used by the
+// dashboard trend charts.
+// Field "Day" holds "YYYY-MM-DD" for daily buckets and
+// "YYYY-MM-DD HH:00" for hourly buckets.
+type DailyStat struct {
+	Day          string  `json:"day"` // "YYYY-MM-DD" (daily) or "YYYY-MM-DD HH:00" (hourly)
+	OrderCount   int64   `json:"order_count"`
+	SuccessCount int64   `json:"success_count"`
+	TotalAmount  float64 `json:"total_amount"`  // sum of amount (fiat)
+	ActualAmount float64 `json:"actual_amount"` // sum of actual_amount (token)
+}
+
+// AddressDailyStat buckets actual_amount by (day, receive_address) for
+// the stacked asset-trend chart.
+// Field "Day" holds "YYYY-MM-DD" (daily) or "YYYY-MM-DD HH:00" (hourly).
+type AddressDailyStat struct {
+	Day          string  `json:"day"`
+	Address      string  `json:"address"`
+	ActualAmount float64 `json:"actual_amount"`
+}
+
+// DailyOrderStats returns per-day counts/amounts within [start, end],
+// zero-filling any days in the range that have no orders.
+// Only orders in StatusPaySuccess contribute to Amount sums — that's
+// what the user means by "流水". Pending orders count toward OrderCount
+// to keep成交率 computable.
+func DailyOrderStats(start, end time.Time) ([]DailyStat, error) {
+	var rows []DailyStat
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Select(`DATE(created_at) AS day,
+            COUNT(*) AS order_count,
+            SUM(CASE WHEN status = ? THEN 1 ELSE 0 END) AS success_count,
+            SUM(CASE WHEN status = ? THEN amount ELSE 0 END) AS total_amount,
+            SUM(CASE WHEN status = ? THEN actual_amount ELSE 0 END) AS actual_amount`,
+			mdb.StatusPaySuccess, mdb.StatusPaySuccess, mdb.StatusPaySuccess).
+		Where("created_at >= ?", start).
+		Where("created_at <= ?", end).
+		Group("DATE(created_at)").
+		Order("day ASC").
+		Scan(&rows).Error
+	if err != nil {
+		return nil, err
+	}
+	return fillDailyStats(start, end, rows), nil
+}
+
+// HourlyOrderStats returns per-hour counts/amounts within [start, end],
+// zero-filling any hours that have no orders.
+func HourlyOrderStats(start, end time.Time) ([]DailyStat, error) {
+	var rows []DailyStat
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Select(`strftime('%Y-%m-%d %H:00', created_at) AS day,
+            COUNT(*) AS order_count,
+            SUM(CASE WHEN status = ? THEN 1 ELSE 0 END) AS success_count,
+            SUM(CASE WHEN status = ? THEN amount ELSE 0 END) AS total_amount,
+            SUM(CASE WHEN status = ? THEN actual_amount ELSE 0 END) AS actual_amount`,
+			mdb.StatusPaySuccess, mdb.StatusPaySuccess, mdb.StatusPaySuccess).
+		Where("created_at >= ?", start).
+		Where("created_at <= ?", end).
+		Group("strftime('%Y-%m-%d %H:00', created_at)").
+		Order("day ASC").
+		Scan(&rows).Error
+	if err != nil {
+		return nil, err
+	}
+	return fillHourlyStats(start, end, rows), nil
+}
+
+// fillDailyStats generates a zero-filled slice covering every calendar
+// day in [start, end]. Days present in rows overwrite the zero entries.
+func fillDailyStats(start, end time.Time, rows []DailyStat) []DailyStat {
+	byDay := make(map[string]DailyStat, len(rows))
+	for _, r := range rows {
+		byDay[r.Day] = r
+	}
+	var out []DailyStat
+	cur := time.Date(start.Year(), start.Month(), start.Day(), 0, 0, 0, 0, start.Location())
+	last := time.Date(end.Year(), end.Month(), end.Day(), 0, 0, 0, 0, end.Location())
+	for !cur.After(last) {
+		key := cur.Format("2006-01-02")
+		if r, ok := byDay[key]; ok {
+			out = append(out, r)
+		} else {
+			out = append(out, DailyStat{Day: key})
+		}
+		cur = cur.AddDate(0, 0, 1)
+	}
+	return out
+}
+
+// fillHourlyStats generates a zero-filled slice covering every whole
+// hour in [start, end]. Hours present in rows overwrite the zero entries.
+func fillHourlyStats(start, end time.Time, rows []DailyStat) []DailyStat {
+	byHour := make(map[string]DailyStat, len(rows))
+	for _, r := range rows {
+		byHour[r.Day] = r
+	}
+	var out []DailyStat
+	cur := time.Date(start.Year(), start.Month(), start.Day(), start.Hour(), 0, 0, 0, start.Location())
+	endHour := time.Date(end.Year(), end.Month(), end.Day(), end.Hour(), 0, 0, 0, end.Location())
+	for !cur.After(endHour) {
+		key := cur.Format("2006-01-02 15:00")
+		if r, ok := byHour[key]; ok {
+			out = append(out, r)
+		} else {
+			out = append(out, DailyStat{Day: key})
+		}
+		cur = cur.Add(time.Hour)
+	}
+	return out
+}
+
+// DailyAssetByAddress groups paid actual_amount by (day, receive_address)
+// for the per-address stacked chart, zero-filling missing days.
+func DailyAssetByAddress(start, end time.Time) ([]AddressDailyStat, error) {
+	var rows []AddressDailyStat
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Select("DATE(created_at) AS day, receive_address AS address, SUM(actual_amount) AS actual_amount").
+		Where("status = ?", mdb.StatusPaySuccess).
+		Where("created_at >= ?", start).
+		Where("created_at <= ?", end).
+		Group("DATE(created_at), receive_address").
+		Order("day ASC").
+		Scan(&rows).Error
+	if err != nil {
+		return nil, err
+	}
+	return fillAddressDailyStats(start, end, rows), nil
+}
+
+// HourlyAssetByAddress groups paid actual_amount by (hour, receive_address)
+// for the per-address stacked chart, zero-filling missing hours.
+func HourlyAssetByAddress(start, end time.Time) ([]AddressDailyStat, error) {
+	var rows []AddressDailyStat
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Select("strftime('%Y-%m-%d %H:00', created_at) AS day, receive_address AS address, SUM(actual_amount) AS actual_amount").
+		Where("status = ?", mdb.StatusPaySuccess).
+		Where("created_at >= ?", start).
+		Where("created_at <= ?", end).
+		Group("strftime('%Y-%m-%d %H:00', created_at), receive_address").
+		Order("day ASC").
+		Scan(&rows).Error
+	if err != nil {
+		return nil, err
+	}
+	return fillAddressHourlyStats(start, end, rows), nil
+}
+
+// fillAddressDailyStats zero-fills missing day×address combinations.
+// All addresses that appear in rows are represented for every day in range.
+func fillAddressDailyStats(start, end time.Time, rows []AddressDailyStat) []AddressDailyStat {
+	return fillAddressStats(start, end, rows, false)
+}
+
+// fillAddressHourlyStats zero-fills missing hour×address combinations.
+func fillAddressHourlyStats(start, end time.Time, rows []AddressDailyStat) []AddressDailyStat {
+	return fillAddressStats(start, end, rows, true)
+}
+
+func fillAddressStats(start, end time.Time, rows []AddressDailyStat, hourly bool) []AddressDailyStat {
+	type key struct{ day, addr string }
+	byKey := make(map[key]float64, len(rows))
+	addrSet := make(map[string]struct{}, 4)
+	for _, r := range rows {
+		byKey[key{r.Day, r.Address}] = r.ActualAmount
+		addrSet[r.Address] = struct{}{}
+	}
+	if len(addrSet) == 0 {
+		return rows
+	}
+	var periods []string
+	if hourly {
+		cur := time.Date(start.Year(), start.Month(), start.Day(), start.Hour(), 0, 0, 0, start.Location())
+		endH := time.Date(end.Year(), end.Month(), end.Day(), end.Hour(), 0, 0, 0, end.Location())
+		for !cur.After(endH) {
+			periods = append(periods, cur.Format("2006-01-02 15:00"))
+			cur = cur.Add(time.Hour)
+		}
+	} else {
+		cur := time.Date(start.Year(), start.Month(), start.Day(), 0, 0, 0, 0, start.Location())
+		last := time.Date(end.Year(), end.Month(), end.Day(), 0, 0, 0, 0, end.Location())
+		for !cur.After(last) {
+			periods = append(periods, cur.Format("2006-01-02"))
+			cur = cur.AddDate(0, 0, 1)
+		}
+	}
+	var out []AddressDailyStat
+	for _, day := range periods {
+		for addr := range addrSet {
+			out = append(out, AddressDailyStat{
+				Day:          day,
+				Address:      addr,
+				ActualAmount: byKey[key{day, addr}],
+			})
+		}
+	}
+	return out
+}
+
+// SumPaidActualAmount returns the total paid actual_amount across all
+// time. Used by the overview "total asset" card.
+func SumPaidActualAmount() (float64, error) {
+	var sum float64
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Select("COALESCE(SUM(actual_amount), 0)").
+		Where("status = ?", mdb.StatusPaySuccess).
+		Scan(&sum).Error
+	return sum, err
+}
+
+// PaidStatsInRange returns (order_count, success_count, actual_sum) for
+// a given time range. Caller chooses the range (today / last 7 days).
+func PaidStatsInRange(start, end time.Time) (int64, int64, float64, error) {
+	type row struct {
+		OrderCount   int64
+		SuccessCount int64
+		ActualSum    float64
+	}
+	var r row
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Select(`COUNT(*) AS order_count,
+            SUM(CASE WHEN status = ? THEN 1 ELSE 0 END) AS success_count,
+            SUM(CASE WHEN status = ? THEN actual_amount ELSE 0 END) AS actual_sum`,
+			mdb.StatusPaySuccess, mdb.StatusPaySuccess).
+		Where("created_at >= ?", start).
+		Where("created_at <= ?", end).
+		Scan(&r).Error
+	return r.OrderCount, r.SuccessCount, r.ActualSum, err
+}
+
+// ActiveAddressCountInRange returns the number of distinct wallet addresses
+// that appear in at least one order within [start, end].
+func ActiveAddressCountInRange(start, end time.Time) (int64, error) {
+	var count int64
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Where("created_at >= ?", start).
+		Where("created_at <= ?", end).
+		Distinct("receive_address").
+		Count(&count).Error
+	return count, err
+}
+
+// AveragePaymentDurationSeconds returns the mean elapsed time between
+// created_at and updated_at for orders that reached StatusPaySuccess
+// in the given range. Zero-safe when no rows match.
+func AveragePaymentDurationSeconds(start, end time.Time) (float64, error) {
+	type row struct {
+		Avg float64
+	}
+	var r row
+	// Using TIMESTAMPDIFF would be MySQL-specific. Fetch the raw
+	// columns and compute in Go — trend windows are small enough.
+	type pair struct {
+		CreatedAt time.Time
+		UpdatedAt time.Time
+	}
+	var pairs []pair
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Select("created_at, updated_at").
+		Where("status = ?", mdb.StatusPaySuccess).
+		Where("created_at >= ?", start).
+		Where("created_at <= ?", end).
+		Scan(&pairs).Error
+	if err != nil {
+		return 0, err
+	}
+	if len(pairs) == 0 {
+		return 0, nil
+	}
+	total := 0.0
+	for _, p := range pairs {
+		total += p.UpdatedAt.Sub(p.CreatedAt).Seconds()
+	}
+	r.Avg = total / float64(len(pairs))
+	return r.Avg, nil
+}
+
+// CountExpiredInRange returns the number of StatusExpired orders in range.
+func CountExpiredInRange(start, end time.Time) (int64, error) {
+	var n int64
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Where("status = ?", mdb.StatusExpired).
+		Where("created_at >= ?", start).
+		Where("created_at <= ?", end).
+		Count(&n).Error
+	return n, err
+}
+
+// RecentOrders returns the latest N orders regardless of status.
+func RecentOrders(limit int) ([]mdb.Orders, error) {
+	if limit < 1 {
+		limit = 20
+	}
+	if limit > 100 {
+		limit = 100
+	}
+	var rows []mdb.Orders
+	err := dao.Mdb.Model(&mdb.Orders{}).
+		Order("id DESC").
+		Limit(limit).
+		Find(&rows).Error
+	return rows, err
+}
+
+// CountEnabledChains counts chains where Enabled=true.
+func CountEnabledChains() (int64, error) {
+	var n int64
+	err := dao.Mdb.Model(&mdb.Chain{}).Where("enabled = ?", true).Count(&n).Error
+	return n, err
+}

src/model/data/order_data_test.go

@@ -0,0 +1,62 @@
+package data
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/assimon/luuu/internal/testutil"
+	"github.com/assimon/luuu/model/mdb"
+)
+
+func TestEvmTransactionLockAddressIsCaseInsensitive(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	tradeID := "trade-evm-case"
+	address := "0xA1B2c3D4e5F60718293aBcDeF001122334455667"
+
+	if err := LockTransaction("Ethereum", address, "usdt", tradeID, 1.23, time.Hour); err != nil {
+		t.Fatalf("lock transaction: %v", err)
+	}
+
+	gotTradeID, err := GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkEthereum, strings.ToLower(address), "USDT", 1.23)
+	if err != nil {
+		t.Fatalf("lookup transaction lock: %v", err)
+	}
+	if gotTradeID != tradeID {
+		t.Fatalf("trade id = %q, want %q", gotTradeID, tradeID)
+	}
+
+	if err := UnLockTransaction(mdb.NetworkEthereum, strings.ToUpper(address), "USDT", 1.23); err != nil {
+		t.Fatalf("unlock transaction: %v", err)
+	}
+
+	gotTradeID, err = GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkEthereum, address, "USDT", 1.23)
+	if err != nil {
+		t.Fatalf("lookup after unlock: %v", err)
+	}
+	if gotTradeID != "" {
+		t.Fatalf("expected lock to be released, got trade id %q", gotTradeID)
+	}
+}
+
+func TestNonEvmTransactionLockAddressRemainsCaseSensitive(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	tradeID := "trade-tron-case"
+	address := "TCaseSensitiveAddress001"
+
+	if err := LockTransaction(mdb.NetworkTron, address, "USDT", tradeID, 1.00, time.Hour); err != nil {
+		t.Fatalf("lock transaction: %v", err)
+	}
+
+	gotTradeID, err := GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTron, strings.ToLower(address), "USDT", 1.00)
+	if err != nil {
+		t.Fatalf("lookup transaction lock: %v", err)
+	}
+	if gotTradeID != "" {
+		t.Fatalf("tron address lookup should remain case-sensitive, got trade id %q", gotTradeID)
+	}
+}

src/model/data/rpc_node_data.go

@@ -0,0 +1,117 @@
+package data
+
+import (
+	"math/rand"
+	"strings"
+
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/dromara/carbon/v2"
+)
+
+// ListRpcNodes returns rows optionally filtered by network.
+func ListRpcNodes(network string) ([]mdb.RpcNode, error) {
+	var rows []mdb.RpcNode
+	tx := dao.Mdb.Model(&mdb.RpcNode{})
+	if network != "" {
+		tx = tx.Where("network = ?", strings.ToLower(network))
+	}
+	err := tx.Order("id ASC").Find(&rows).Error
+	return rows, err
+}
+
+// GetRpcNodeByID fetches one row.
+func GetRpcNodeByID(id uint64) (*mdb.RpcNode, error) {
+	row := new(mdb.RpcNode)
+	err := dao.Mdb.Model(row).Limit(1).Find(row, id).Error
+	return row, err
+}
+
+// CreateRpcNode inserts a row.
+func CreateRpcNode(row *mdb.RpcNode) error {
+	return dao.Mdb.Create(row).Error
+}
+
+// UpdateRpcNodeFields patches mutable columns.
+func UpdateRpcNodeFields(id uint64, fields map[string]interface{}) error {
+	if len(fields) == 0 {
+		return nil
+	}
+	return dao.Mdb.Model(&mdb.RpcNode{}).Where("id = ?", id).Updates(fields).Error
+}
+
+// DeleteRpcNodeByID soft-deletes the row.
+func DeleteRpcNodeByID(id uint64) error {
+	return dao.Mdb.Where("id = ?", id).Delete(&mdb.RpcNode{}).Error
+}
+
+// SelectRpcNode picks a healthy RPC endpoint for a (network, type) pair.
+// Strategy: weighted random among rows where enabled=true AND status=ok.
+// Falls back to any enabled row when none are healthy yet (bootstrap case
+// where the health check hasn't run). Returns nil if nothing is defined.
+func SelectRpcNode(network, nodeType string) (*mdb.RpcNode, error) {
+	var rows []mdb.RpcNode
+	err := dao.Mdb.Model(&mdb.RpcNode{}).
+		Where("network = ?", strings.ToLower(network)).
+		Where("type = ?", strings.ToLower(nodeType)).
+		Where("enabled = ?", true).
+		Find(&rows).Error
+	if err != nil {
+		return nil, err
+	}
+	if len(rows) == 0 {
+		return nil, nil
+	}
+	healthy := rows[:0]
+	for _, r := range rows {
+		if r.Status == mdb.RpcNodeStatusOk {
+			healthy = append(healthy, r)
+		}
+	}
+	candidates := healthy
+	if len(candidates) == 0 {
+		candidates = rows // bootstrap: no health check has run yet
+	}
+	return pickWeighted(candidates), nil
+}
+
+// pickWeighted chooses one row using the Weight column. Weights < 1 are
+// coerced to 1 so an admin-zeroed row still has a chance (use Enabled=false
+// to truly disable).
+func pickWeighted(rows []mdb.RpcNode) *mdb.RpcNode {
+	total := 0
+	for i := range rows {
+		w := rows[i].Weight
+		if w < 1 {
+			w = 1
+		}
+		total += w
+	}
+	if total <= 0 {
+		return &rows[0]
+	}
+	pick := rand.Intn(total)
+	acc := 0
+	for i := range rows {
+		w := rows[i].Weight
+		if w < 1 {
+			w = 1
+		}
+		acc += w
+		if pick < acc {
+			return &rows[i]
+		}
+	}
+	return &rows[len(rows)-1]
+}
+
+// UpdateRpcNodeHealth stamps status/latency + last_checked_at.
+func UpdateRpcNodeHealth(id uint64, status string, latencyMs int) error {
+	return dao.Mdb.Model(&mdb.RpcNode{}).
+		Where("id = ?", id).
+		Updates(map[string]interface{}{
+			"status":          status,
+			"last_latency_ms": latencyMs,
+			"last_checked_at": carbon.Now().StdTime(),
+		}).Error
+}

src/model/data/settings_data.go

@@ -0,0 +1,166 @@
+package data
+
+import (
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/mdb"
+	"gorm.io/gorm/clause"
+)
+
+// Simple in-process cache. Settings are read frequently (on every order
+// create, every scanner tick, etc.); the DB round-trip isn't free. Cache
+// is invalidated explicitly via SetString/Delete and expires on process
+// restart — that's enough for admin-edit semantics without TTL complexity.
+var (
+	settingsCache   = map[string]string{}
+	settingsCacheMu sync.RWMutex
+	settingsLoadMu  sync.Mutex // serializes the lazy bootstrap load
+	settingsLoaded  bool
+)
+
+func loadAllSettings() error {
+	var rows []mdb.Setting
+	if err := dao.Mdb.Find(&rows).Error; err != nil {
+		return err
+	}
+	settingsCacheMu.Lock()
+	defer settingsCacheMu.Unlock()
+	settingsCache = make(map[string]string, len(rows))
+	for _, r := range rows {
+		settingsCache[r.Key] = r.Value
+	}
+	settingsLoaded = true
+	return nil
+}
+
+// ensureLoaded performs a thread-safe lazy bootstrap of the cache. Uses
+// a dedicated mutex + double-checked flag so two concurrent callers
+// don't both hit the DB. Can't use sync.Once because ReloadSettings
+// needs to be able to rebuild after a failed initial load.
+func ensureLoaded() {
+	settingsCacheMu.RLock()
+	loaded := settingsLoaded
+	settingsCacheMu.RUnlock()
+	if loaded {
+		return
+	}
+	settingsLoadMu.Lock()
+	defer settingsLoadMu.Unlock()
+	// Recheck under the load mutex — another goroutine may have loaded
+	// while we were blocked.
+	settingsCacheMu.RLock()
+	loaded = settingsLoaded
+	settingsCacheMu.RUnlock()
+	if loaded {
+		return
+	}
+	_ = loadAllSettings()
+}
+
+// ReloadSettings forces a refresh from DB. Call after external writes.
+func ReloadSettings() error {
+	settingsLoadMu.Lock()
+	defer settingsLoadMu.Unlock()
+	return loadAllSettings()
+}
+
+// GetSettingString returns the string value for key, or fallback if unset.
+func GetSettingString(key, fallback string) string {
+	ensureLoaded()
+	settingsCacheMu.RLock()
+	defer settingsCacheMu.RUnlock()
+	v, ok := settingsCache[key]
+	if !ok || strings.TrimSpace(v) == "" {
+		return fallback
+	}
+	return v
+}
+
+// GetSettingInt returns the int value for key, or fallback on miss/parse fail.
+func GetSettingInt(key string, fallback int) int {
+	v := GetSettingString(key, "")
+	if v == "" {
+		return fallback
+	}
+	n, err := strconv.Atoi(v)
+	if err != nil {
+		return fallback
+	}
+	return n
+}
+
+// GetSettingFloat returns the float value for key, or fallback on miss/parse fail.
+func GetSettingFloat(key string, fallback float64) float64 {
+	v := GetSettingString(key, "")
+	if v == "" {
+		return fallback
+	}
+	f, err := strconv.ParseFloat(v, 64)
+	if err != nil {
+		return fallback
+	}
+	return f
+}
+
+// GetSettingBool returns the bool value for key, or fallback on miss/parse fail.
+func GetSettingBool(key string, fallback bool) bool {
+	v := GetSettingString(key, "")
+	if v == "" {
+		return fallback
+	}
+	b, err := strconv.ParseBool(v)
+	if err != nil {
+		return fallback
+	}
+	return b
+}
+
+// SetSetting upserts a setting row and refreshes the cache entry.
+func SetSetting(group, key, value, valueType string) error {
+	if valueType == "" {
+		valueType = mdb.SettingTypeString
+	}
+	row := mdb.Setting{Group: group, Key: key, Value: value, Type: valueType}
+	err := dao.Mdb.Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "key"}},
+		DoUpdates: clause.AssignmentColumns([]string{"group", "value", "type", "updated_at"}),
+	}).Create(&row).Error
+	if err != nil {
+		return err
+	}
+	settingsCacheMu.Lock()
+	settingsCache[key] = value
+	settingsCacheMu.Unlock()
+	return nil
+}
+
+// DeleteSetting removes a setting row and drops the cache entry.
+func DeleteSetting(key string) error {
+	if err := dao.Mdb.Where("key = ?", key).Delete(&mdb.Setting{}).Error; err != nil {
+		return err
+	}
+	settingsCacheMu.Lock()
+	delete(settingsCache, key)
+	settingsCacheMu.Unlock()
+	return nil
+}
+
+// sensitiveSettingKeys lists keys that must never be returned to API callers.
+var sensitiveSettingKeys = []string{
+	mdb.SettingKeyJwtSecret,
+}
+
+// ListSettingsByGroup returns all rows for a given group (empty group = all),
+// excluding any keys in sensitiveSettingKeys.
+func ListSettingsByGroup(group string) ([]mdb.Setting, error) {
+	var rows []mdb.Setting
+	tx := dao.Mdb.Model(&mdb.Setting{}).Not("`key`", sensitiveSettingKeys)
+	if group != "" {
+		tx = tx.Where("`group` = ?", group)
+	}
+	err := tx.Order("`key` ASC").Find(&rows).Error
+	return rows, err
+}

src/model/data/supported_asset_data.go

@@ -1,123 +0,0 @@
-package data
-
-import (
-	"strings"
-
-	"github.com/assimon/luuu/model/dao"
-	"github.com/assimon/luuu/model/mdb"
-	"github.com/assimon/luuu/util/constant"
-)
-
-func normalizeNetworkToken(network, token string) (string, string) {
-	return strings.ToLower(strings.TrimSpace(network)), strings.ToUpper(strings.TrimSpace(token))
-}
-
-func AddSupportedAsset(network, token string, status int64) (*mdb.SupportedAsset, error) {
-	network, token = normalizeNetworkToken(network, token)
-	exist, err := GetSupportedAssetByNetworkAndToken(network, token)
-	if err != nil {
-		return nil, err
-	}
-	if exist.ID > 0 {
-		return nil, constant.SupportedAssetAlreadyExists
-	}
-
-	deleted, err := getSupportedAssetByNetworkAndTokenUnscoped(network, token)
-	if err != nil {
-		return nil, err
-	}
-	if deleted.ID > 0 && deleted.DeletedAt.Valid {
-		deleted.Status = status
-		deleted.DeletedAt.Valid = false
-		if err := dao.Mdb.Unscoped().Save(deleted).Error; err != nil {
-			return nil, err
-		}
-		return deleted, nil
-	}
-
-	asset := &mdb.SupportedAsset{
-		Network: network,
-		Token:   token,
-		Status:  status,
-	}
-	err = dao.Mdb.Create(asset).Error
-	return asset, err
-}
-
-func getSupportedAssetByNetworkAndTokenUnscoped(network, token string) (*mdb.SupportedAsset, error) {
-	network, token = normalizeNetworkToken(network, token)
-	asset := new(mdb.SupportedAsset)
-	err := dao.Mdb.Unscoped().Model(asset).
-		Where("network = ?", network).
-		Where("token = ?", token).
-		Limit(1).Find(asset).Error
-	return asset, err
-}
-
-func GetSupportedAssetByNetworkAndToken(network, token string) (*mdb.SupportedAsset, error) {
-	network, token = normalizeNetworkToken(network, token)
-	asset := new(mdb.SupportedAsset)
-	err := dao.Mdb.Model(asset).
-		Where("network = ?", network).
-		Where("token = ?", token).
-		Limit(1).Find(asset).Error
-	return asset, err
-}
-
-func GetSupportedAssetByID(id uint64) (*mdb.SupportedAsset, error) {
-	asset := new(mdb.SupportedAsset)
-	err := dao.Mdb.Model(asset).Limit(1).Find(asset, id).Error
-	return asset, err
-}
-
-func UpdateSupportedAsset(id uint64, network, token string, status int64) (*mdb.SupportedAsset, error) {
-	network, token = normalizeNetworkToken(network, token)
-
-	asset, err := GetSupportedAssetByID(id)
-	if err != nil {
-		return nil, err
-	}
-	if asset.ID <= 0 {
-		return nil, constant.SupportedAssetNotFound
-	}
-
-	exist, err := GetSupportedAssetByNetworkAndToken(network, token)
-	if err != nil {
-		return nil, err
-	}
-	if exist.ID > 0 && exist.ID != id {
-		return nil, constant.SupportedAssetAlreadyExists
-	}
-
-	asset.Network = network
-	asset.Token = token
-	asset.Status = status
-	if err := dao.Mdb.Save(asset).Error; err != nil {
-		return nil, err
-	}
-	return asset, nil
-}
-
-func DeleteSupportedAssetByID(id uint64) error {
-	return dao.Mdb.Where("id = ?", id).Delete(&mdb.SupportedAsset{}).Error
-}
-
-func ListSupportedAssets(network string) ([]mdb.SupportedAsset, error) {
-	network = strings.ToLower(strings.TrimSpace(network))
-	var list []mdb.SupportedAsset
-	tx := dao.Mdb.Model(&mdb.SupportedAsset{})
-	if network != "" {
-		tx = tx.Where("network = ?", network)
-	}
-	err := tx.Order("network asc, token asc").Find(&list).Error
-	return list, err
-}
-
-func ListEnabledSupportedAssets() ([]mdb.SupportedAsset, error) {
-	var list []mdb.SupportedAsset
-	err := dao.Mdb.Model(&mdb.SupportedAsset{}).
-		Where("status = ?", mdb.TokenStatusEnable).
-		Order("network asc, token asc").
-		Find(&list).Error
-	return list, err
-}

src/model/data/wallet_address_data.go

@@ -22,15 +22,22 @@ func isEVMNetwork(network string) bool {
 	return false
 }
 
+func normalizeWalletNetwork(network string) string {
+	return strings.ToLower(strings.TrimSpace(network))
+}
+
+func normalizeWalletAddressByNetwork(network, address string) string {
+	address = strings.TrimSpace(address)
+	if isEVMNetwork(normalizeWalletNetwork(network)) {
+		return strings.ToLower(address)
+	}
+	return address
+}
+
 // AddWalletAddressWithNetwork 创建指定网络的钱包地址
 func AddWalletAddressWithNetwork(network, address string) (*mdb.WalletAddress, error) {
-	network = strings.ToLower(strings.TrimSpace(network))
+	network = normalizeWalletNetwork(network)
-	address = strings.TrimSpace(address)
+	address = normalizeWalletAddressByNetwork(network, address)
-
-	// evm 网络地址统一小写，tron 和 solana 保持原样
-	if isEVMNetwork(network) {
-		address = strings.ToLower(address)
-	}
 
 	exist, err := GetWalletAddressByNetworkAndAddress(network, address)
 	if err != nil {
@@ -39,6 +46,23 @@ func AddWalletAddressWithNetwork(network, address string) (*mdb.WalletAddress, e
 	if exist.ID > 0 {
 		return nil, constant.WalletAddressAlreadyExists
 	}
+
+	// Check for a soft-deleted record with the same (network, address) and restore it.
+	deleted := new(mdb.WalletAddress)
+	err = dao.Mdb.Unscoped().
+		Where("network = ? AND address = ? AND deleted_at IS NOT NULL", network, address).
+		Limit(1).Find(deleted).Error
+	if err != nil {
+		return nil, err
+	}
+	if deleted.ID > 0 {
+		err = dao.Mdb.Unscoped().Model(deleted).Updates(map[string]interface{}{
+			"deleted_at": nil,
+			"status":     mdb.TokenStatusEnable,
+		}).Error
+		return deleted, err
+	}
+
 	walletAddress := &mdb.WalletAddress{
 		Network: network,
 		Address: address,
@@ -50,6 +74,8 @@ func AddWalletAddressWithNetwork(network, address string) (*mdb.WalletAddress, e
 
 // GetWalletAddressByNetworkAndAddress 通过网络和地址查询
 func GetWalletAddressByNetworkAndAddress(network, address string) (*mdb.WalletAddress, error) {
+	network = normalizeWalletNetwork(network)
+	address = normalizeWalletAddressByNetwork(network, address)
 	walletAddress := new(mdb.WalletAddress)
 	err := dao.Mdb.Model(walletAddress).
 		Where("network = ?", network).
@@ -87,11 +113,20 @@ func GetAvailableWalletAddress() ([]mdb.WalletAddress, error) {
 
 // GetAvailableWalletAddressByNetwork 获得指定网络的所有可用钱包地址
 func GetAvailableWalletAddressByNetwork(network string) ([]mdb.WalletAddress, error) {
+	network = normalizeWalletNetwork(network)
 	var list []mdb.WalletAddress
 	err := dao.Mdb.Model(list).
 		Where("status = ?", mdb.TokenStatusEnable).
 		Where("network = ?", network).
 		Find(&list).Error
+	if err != nil {
+		return nil, err
+	}
+	if isEVMNetwork(network) {
+		for i := range list {
+			list[i].Address = strings.ToLower(strings.TrimSpace(list[i].Address))
+		}
+	}
 	return list, err
 }
 
@@ -104,8 +139,17 @@ func GetAllWalletAddress() ([]mdb.WalletAddress, error) {
 
 // GetAllWalletAddressByNetwork 获得指定网络的所有钱包地址
 func GetAllWalletAddressByNetwork(network string) ([]mdb.WalletAddress, error) {
+	network = normalizeWalletNetwork(network)
 	var list []mdb.WalletAddress
 	err := dao.Mdb.Model(list).Where("network = ?", network).Find(&list).Error
+	if err != nil {
+		return nil, err
+	}
+	if isEVMNetwork(network) {
+		for i := range list {
+			list[i].Address = strings.ToLower(strings.TrimSpace(list[i].Address))
+		}
+	}
 	return list, err
 }
 

src/model/data/wallet_address_data_test.go

@@ -0,0 +1,83 @@
+package data
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/assimon/luuu/internal/testutil"
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/mdb"
+)
+
+func TestAddWalletAddressWithNetworkNormalizesEvmAddressToLowercase(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	input := "0xA1B2c3D4e5F60718293aBcDeF001122334455667"
+	row, err := AddWalletAddressWithNetwork(mdb.NetworkEthereum, input)
+	if err != nil {
+		t.Fatalf("add wallet: %v", err)
+	}
+	if row.Address != strings.ToLower(input) {
+		t.Fatalf("wallet address = %q, want %q", row.Address, strings.ToLower(input))
+	}
+
+	loaded, err := GetWalletAddressByNetworkAndAddress(mdb.NetworkEthereum, strings.ToUpper(input))
+	if err != nil {
+		t.Fatalf("load wallet by mixed-case address: %v", err)
+	}
+	if loaded.ID == 0 {
+		t.Fatal("expected to find wallet by mixed-case query")
+	}
+	if loaded.Address != strings.ToLower(input) {
+		t.Fatalf("stored wallet address = %q, want lowercase", loaded.Address)
+	}
+}
+
+func TestGetAvailableWalletAddressByNetworkReturnsLowercaseForEvm(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	mixed := "0xA1B2c3D4e5F60718293aBcDeF001122334455667"
+	if err := dao.Mdb.Create(&mdb.WalletAddress{
+		Network: mdb.NetworkEthereum,
+		Address: mixed,
+		Status:  mdb.TokenStatusEnable,
+	}).Error; err != nil {
+		t.Fatalf("seed mixed-case wallet: %v", err)
+	}
+
+	rows, err := GetAvailableWalletAddressByNetwork("Ethereum")
+	if err != nil {
+		t.Fatalf("list wallets: %v", err)
+	}
+	if len(rows) != 1 {
+		t.Fatalf("wallet count = %d, want 1", len(rows))
+	}
+	if rows[0].Address != strings.ToLower(mixed) {
+		t.Fatalf("listed wallet address = %q, want %q", rows[0].Address, strings.ToLower(mixed))
+	}
+}
+
+func TestAddWalletAddressWithNetworkKeepsOriginalCaseForNonEvm(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	tronAddress := "TCaseSensitiveTronAddress001"
+	tronRow, err := AddWalletAddressWithNetwork(mdb.NetworkTron, tronAddress)
+	if err != nil {
+		t.Fatalf("add tron wallet: %v", err)
+	}
+	if tronRow.Address != tronAddress {
+		t.Fatalf("tron wallet address = %q, want %q", tronRow.Address, tronAddress)
+	}
+
+	solAddress := "SoLAnACaseSensitiveAddress111111111111111111"
+	solRow, err := AddWalletAddressWithNetwork(mdb.NetworkSolana, solAddress)
+	if err != nil {
+		t.Fatalf("add solana wallet: %v", err)
+	}
+	if solRow.Address != solAddress {
+		t.Fatalf("solana wallet address = %q, want %q", solRow.Address, solAddress)
+	}
+}

src/model/mdb/admin_user.go

@@ -0,0 +1,21 @@
+package mdb
+
+import "github.com/dromara/carbon/v2"
+
+const (
+	AdminUserStatusEnable  = 1
+	AdminUserStatusDisable = 2
+)
+
+type AdminUser struct {
+	Username     string `gorm:"column:username;uniqueIndex:admin_users_username_uindex;size:64" json:"username" example:"admin"`
+	PasswordHash string `gorm:"column:password_hash;size:255" json:"-"`
+	// 状态 1=启用 2=禁用
+	Status      int         `gorm:"column:status;default:1" json:"status" enums:"1,2" example:"1"`
+	LastLoginAt carbon.Time `gorm:"column:last_login_at" json:"last_login_at" example:"2026-04-16 12:00:00"`
+	BaseModel
+}
+
+func (a *AdminUser) TableName() string {
+	return "admin_users"
+}

src/model/mdb/api_key.go

@@ -0,0 +1,29 @@
+package mdb
+
+import "github.com/dromara/carbon/v2"
+
+const (
+	ApiKeyStatusEnable  = 1
+	ApiKeyStatusDisable = 2
+)
+
+// ApiKey stores a universal merchant credential (PID + secret) that is
+// valid for both EPAY and GMPAY payment flows. Identification at
+// request time is always by PID; the gateway flow is chosen by the
+// route (not by any property of the row).
+type ApiKey struct {
+	Name        string `gorm:"column:name;size:128" json:"name" example:"My API Key"`
+	Pid         string `gorm:"column:pid;size:128;uniqueIndex:api_keys_pid_uindex" json:"pid" example:"1000"`
+	SecretKey   string `gorm:"column:secret_key;size:255" json:"-"`
+	IpWhitelist string `gorm:"column:ip_whitelist;type:text" json:"ip_whitelist" example:"192.168.1.0/24,10.0.0.1"`
+	NotifyUrl   string `gorm:"column:notify_url;size:512" json:"notify_url" example:"https://example.com/notify"`
+	// 状态 1=启用 2=禁用
+	Status     int         `gorm:"column:status;default:1" json:"status" enums:"1,2" example:"1"`
+	CallCount  int64       `gorm:"column:call_count;default:0" json:"call_count" example:"342"`
+	LastUsedAt carbon.Time `gorm:"column:last_used_at" json:"last_used_at" example:"2026-04-16 12:00:00"`
+	BaseModel
+}
+
+func (a *ApiKey) TableName() string {
+	return "api_keys"
+}

src/model/mdb/base.go

@@ -6,8 +6,8 @@ import (
 )
 
 type BaseModel struct {
-	ID        uint64         `gorm:"column:id;primary_key;autoIncrement" json:"id"`
+	ID        uint64         `gorm:"column:id;primary_key;autoIncrement" json:"id" example:"1"`
-	CreatedAt carbon.Time    `gorm:"column:created_at" json:"created_at"`
+	CreatedAt carbon.Time    `gorm:"column:created_at" json:"created_at" example:"2026-04-16 12:00:00"`
-	UpdatedAt carbon.Time    `gorm:"column:updated_at" json:"updated_at"`
+	UpdatedAt carbon.Time    `gorm:"column:updated_at" json:"updated_at" example:"2026-04-16 12:00:00"`
 	DeletedAt gorm.DeletedAt `gorm:"index" json:"deleted_at"`
 }

src/model/mdb/chain.go

@@ -0,0 +1,19 @@
+package mdb
+
+// Chain represents an enabled blockchain network.
+// Scanner tasks read this table on each polling tick to decide whether to
+// process the network. When Enabled=false the scanner skips the chain
+// entirely without restarting.
+type Chain struct {
+	Network          string `gorm:"column:network;uniqueIndex:chains_network_uindex;size:32" json:"network" example:"tron"`
+	DisplayName      string `gorm:"column:display_name;size:64" json:"display_name" example:"Tron"`
+	Enabled          bool   `gorm:"column:enabled;default:true" json:"enabled" example:"true"`
+	MinConfirmations int    `gorm:"column:min_confirmations;default:1" json:"min_confirmations" example:"20"`
+	ScanIntervalSec  int    `gorm:"column:scan_interval_sec;default:5" json:"scan_interval_sec" example:"5"`
+	Extra            string `gorm:"column:extra;type:text" json:"extra" example:"{}"`
+	BaseModel
+}
+
+func (c *Chain) TableName() string {
+	return "chains"
+}

src/model/mdb/chain_token.go

@@ -0,0 +1,24 @@
+package mdb
+
+const (
+	ChainTokenStatusEnable  = 1
+	ChainTokenStatusDisable = 2
+)
+
+// ChainToken describes a token to watch on a given chain. Replaces the
+// hardcoded USDT/USDC contract addresses in task/listen_eth.go. Scanners
+// load this table on startup (and refresh periodically) to learn which
+// contracts to subscribe to.
+type ChainToken struct {
+	Network         string  `gorm:"column:network;size:32;uniqueIndex:chain_tokens_network_symbol_uindex,priority:1" json:"network" example:"tron"`
+	Symbol          string  `gorm:"column:symbol;size:32;uniqueIndex:chain_tokens_network_symbol_uindex,priority:2" json:"symbol" example:"USDT"`
+	ContractAddress string  `gorm:"column:contract_address;size:128" json:"contract_address" example:"TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t"`
+	Decimals        int     `gorm:"column:decimals;default:6" json:"decimals" example:"6"`
+	Enabled         bool    `gorm:"column:enabled;default:true" json:"enabled" example:"true"`
+	MinAmount       float64 `gorm:"column:min_amount;default:0" json:"min_amount" example:"1.0"`
+	BaseModel
+}
+
+func (c *ChainToken) TableName() string {
+	return "chain_tokens"
+}

src/model/mdb/notification_channel.go

@@ -0,0 +1,36 @@
+package mdb
+
+const (
+	NotificationTypeTelegram = "telegram"
+	NotificationTypeWebhook  = "webhook"
+	NotificationTypeEmail    = "email"
+)
+
+const (
+	NotificationStatusEnable  = 1
+	NotificationStatusDisable = 2
+)
+
+// Notification events (JSON keys in Events column).
+const (
+	NotifyEventPaySuccess   = "pay_success"
+	NotifyEventOrderExpired = "order_expired"
+	NotifyEventDailyReport  = "daily_report"
+)
+
+// NotificationChannel represents one push target instance.
+// Config/Events are JSON strings consumed by the notify dispatcher.
+// For telegram, Config = {"bot_token":"...","chat_id":"...","proxy":"..."}.
+// For webhook, Config = {"url":"...","headers":{...},"secret":"..."}.
+type NotificationChannel struct {
+	Type    string `gorm:"column:type;size:32;index:notification_channels_type_enabled_index,priority:1" json:"type" enums:"telegram,webhook,email" example:"telegram"`
+	Name    string `gorm:"column:name;size:128" json:"name" example:"主通知群"`
+	Config  string `gorm:"column:config;type:text" json:"config" example:"{\"bot_token\":\"123:ABC\",\"chat_id\":\"456\"}"`
+	Events  string `gorm:"column:events;type:text" json:"events" example:"{\"pay_success\":true,\"order_expired\":true}"`
+	Enabled bool   `gorm:"column:enabled;default:true;index:notification_channels_type_enabled_index,priority:2" json:"enabled" example:"true"`
+	BaseModel
+}
+
+func (n *NotificationChannel) TableName() string {
+	return "notification_channels"
+}

src/model/mdb/orders_mdb.go

@@ -13,24 +13,30 @@ const (
 )
 
 type Orders struct {
-	TradeId            string  `gorm:"column:trade_id;uniqueIndex:orders_trade_id_uindex" json:"trade_id"`
+	TradeId            string  `gorm:"column:trade_id;uniqueIndex:orders_trade_id_uindex" json:"trade_id" example:"T2026041612345678"`
-	OrderId            string  `gorm:"column:order_id;uniqueIndex:orders_order_id_uindex" json:"order_id"` // the order id is generated by client, and will notify client when order is paid
+	OrderId            string  `gorm:"column:order_id;uniqueIndex:orders_order_id_uindex" json:"order_id" example:"ORD20260416001"`
 	ParentTradeId      string  `gorm:"column:parent_trade_id;index:idx_orders_parent_trade_id;default:''" json:"parent_trade_id"`
-	BlockTransactionId string  `gorm:"index:orders_block_transaction_id_index;column:block_transaction_id" json:"block_transaction_id"`
+	BlockTransactionId string  `gorm:"index:orders_block_transaction_id_index;column:block_transaction_id" json:"block_transaction_id" example:"0xabc123..."`
-	Amount             float64 `gorm:"column:amount" json:"amount"`
+	Amount             float64 `gorm:"column:amount" json:"amount" example:"100.0000"`
-	Currency           string  `gorm:"column:currency" json:"currency"`
+	Currency           string  `gorm:"column:currency" json:"currency" example:"CNY"`
-	ActualAmount       float64 `gorm:"column:actual_amount" json:"actual_amount"`
+	ActualAmount       float64 `gorm:"column:actual_amount" json:"actual_amount" example:"14.2857"`
-	ReceiveAddress     string  `gorm:"column:receive_address" json:"receive_address"`
+	ReceiveAddress     string  `gorm:"column:receive_address" json:"receive_address" example:"TTestTronAddress001"`
-	Token              string  `gorm:"column:token" json:"token"`
+	Token              string  `gorm:"column:token" json:"token" example:"USDT"`
-	Network            string  `gorm:"column:network" json:"network"`
+	Network            string  `gorm:"column:network" json:"network" example:"tron"`
-	Status             int     `gorm:"column:status;default:1" json:"status"`
+	// 订单状态 1=等待支付 2=支付成功 3=已过期
-	NotifyUrl          string  `gorm:"column:notify_url" json:"notify_url"`
+	Status      int    `gorm:"column:status;default:1" json:"status" enums:"1,2,3" example:"1"`
-	RedirectUrl        string  `gorm:"column:redirect_url" json:"redirect_url"`
+	NotifyUrl   string `gorm:"column:notify_url" json:"notify_url" example:"https://example.com/notify"`
-	Name               string  `gorm:"column:name" json:"name"`
+	RedirectUrl string `gorm:"column:redirect_url" json:"redirect_url" example:"https://example.com/success"`
-	CallbackNum        int     `gorm:"column:callback_num;default:0" json:"callback_num"`
+	Name        string `gorm:"column:name" json:"name" example:"VIP月卡"`
-	CallBackConfirm    int     `gorm:"column:callback_confirm;default:2" json:"callback_confirm"`
+	CallbackNum int    `gorm:"column:callback_num;default:0" json:"callback_num" example:"0"`
-	IsSelected         bool    `gorm:"column:is_selected;default:false" json:"is_selected"`
+	// 回调确认状态 1=回调成功 2=未回调/回调失败
-	PaymentType        string  `gorm:"column:payment_type" json:"payment_type"`
+	CallBackConfirm int    `gorm:"column:callback_confirm;default:2" json:"callback_confirm" enums:"1,2" example:"2"`
+	IsSelected      bool   `gorm:"column:is_selected;default:false" json:"is_selected" example:"false"`
+	PaymentType     string `gorm:"column:payment_type" json:"payment_type" example:"Epay"`
+	ApiKeyID        uint64 `gorm:"column:api_key_id;default:0;index:orders_api_key_id_index" json:"api_key_id" example:"1"`
+	// PayBySubId holds the primary-key ID of the sub-order that settled this parent order.
+	// Zero when the parent order was paid directly (no sub-order involved).
+	PayBySubId uint64 `gorm:"column:pay_by_sub_id;default:0" json:"pay_by_sub_id" example:"0"`
 	BaseModel
 }
 

src/model/mdb/rpc_node.go

@@ -0,0 +1,36 @@
+package mdb
+
+import "github.com/dromara/carbon/v2"
+
+const (
+	RpcNodeTypeHttp = "http"
+	RpcNodeTypeWs   = "ws"
+)
+
+const (
+	RpcNodeStatusUnknown = "unknown"
+	RpcNodeStatusOk      = "ok"
+	RpcNodeStatusDown    = "down"
+)
+
+// RpcNode records one RPC endpoint for a network. Clients select a node
+// by weight among rows where Enabled=true AND Status=ok. A periodic
+// task/rpc_health_job writes Status/LastLatencyMs/LastCheckedAt.
+type RpcNode struct {
+	Network       string      `gorm:"column:network;size:32;index:rpc_nodes_network_status_index,priority:1" json:"network" example:"tron"`
+	Url string `gorm:"column:url;size:512" json:"url" example:"https://api.trongrid.io"`
+	// 连接类型 http=HTTP请求 ws=WebSocket长连接
+	Type string `gorm:"column:type;size:16" json:"type" enums:"http,ws" example:"http"`
+	Weight        int         `gorm:"column:weight;default:1" json:"weight" example:"1"`
+	ApiKey        string      `gorm:"column:api_key;size:255" json:"api_key" example:"your-api-key"`
+	Enabled bool `gorm:"column:enabled;default:true" json:"enabled" example:"true"`
+	// 健康状态 unknown=未知 ok=正常 down=异常
+	Status string `gorm:"column:status;size:16;default:unknown;index:rpc_nodes_network_status_index,priority:2" json:"status" enums:"unknown,ok,down" example:"ok"`
+	LastLatencyMs int         `gorm:"column:last_latency_ms;default:-1" json:"last_latency_ms" example:"120"`
+	LastCheckedAt carbon.Time `gorm:"column:last_checked_at" json:"last_checked_at" example:"2026-04-16 12:00:00"`
+	BaseModel
+}
+
+func (r *RpcNode) TableName() string {
+	return "rpc_nodes"
+}

src/model/mdb/settings.go

@@ -0,0 +1,54 @@
+package mdb
+
+// Setting stores non-credential runtime configuration as key/value pairs.
+// Groups: brand, rate, system, epay. Merchant credentials (pid + secret_key)
+// live in the api_keys table; notification configs live in NotificationChannel.
+// Default rows for the epay group are seeded on first startup (see
+// model/dao/mdb_table_init.go seedDefaultSettings). All other groups start
+// empty and fall back to hardcoded defaults until an admin sets them.
+// Only exception: system.jwt_secret is auto-generated on first startup.
+const (
+	SettingGroupBrand  = "brand"
+	SettingGroupRate   = "rate"
+	SettingGroupSystem = "system"
+	SettingGroupEpay   = "epay"
+)
+
+const (
+	SettingTypeString = "string"
+	SettingTypeInt    = "int"
+	SettingTypeBool   = "bool"
+	SettingTypeJSON   = "json"
+)
+
+const (
+	SettingKeyJwtSecret         = "system.jwt_secret"
+	SettingKeyOrderExpiration   = "system.order_expiration_time"
+	SettingKeyBrandSiteName     = "brand.site_name"
+	SettingKeyBrandLogoUrl      = "brand.logo_url"
+	SettingKeyBrandPageTitle    = "brand.page_title"
+	SettingKeyBrandPaySuccess   = "brand.pay_success_text"
+	SettingKeyBrandSupportUrl   = "brand.support_url"
+	SettingKeyRateForcedUsdt    = "rate.forced_usdt_rate"
+	SettingKeyRateAdjustPercent = "rate.adjust_percent"
+	SettingKeyRateOkxC2cEnabled = "rate.okx_c2c_enabled"
+	SettingKeyRateApiUrl        = "rate.api_url"
+
+	// EPAY route defaults — can be overridden via admin settings.
+	SettingKeyEpayDefaultToken    = "epay.default_token"
+	SettingKeyEpayDefaultCurrency = "epay.default_currency"
+	SettingKeyEpayDefaultNetwork  = "epay.default_network"
+)
+
+type Setting struct {
+	Group       string `gorm:"column:group;size:32;index:settings_group_index" json:"group" enums:"brand,rate,system" example:"rate"`
+	Key         string `gorm:"column:key;uniqueIndex:settings_key_uindex;size:128" json:"key" example:"rate.forced_usdt_rate"`
+	Value       string `gorm:"column:value;type:text" json:"value" example:"7.2"`
+	Type        string `gorm:"column:type;size:16;default:string" json:"type" enums:"string,int,bool,json" example:"string"`
+	Description string `gorm:"column:description;size:255" json:"description" example:"强制USDT汇率"`
+	BaseModel
+}
+
+func (s *Setting) TableName() string {
+	return "settings"
+}

src/model/mdb/supported_asset_mdb.go

@@ -1,12 +0,0 @@
-package mdb
-
-type SupportedAsset struct {
-	Network string `gorm:"column:network;uniqueIndex:supported_asset_network_token_uindex,priority:1" json:"network"`
-	Token   string `gorm:"column:token;uniqueIndex:supported_asset_network_token_uindex,priority:2" json:"token"`
-	Status  int64  `gorm:"column:status;default:1" json:"status"`
-	BaseModel
-}
-
-func (s *SupportedAsset) TableName() string {
-	return "supported_asset"
-}

src/model/mdb/wallet_address_mdb.go

@@ -14,10 +14,18 @@ const (
 	NetworkPlasma   = "plasma"
 )
 
+const (
+	WalletSourceManual = "manual"
+	WalletSourceImport = "import"
+)
+
 type WalletAddress struct {
-	Network string `gorm:"column:network;uniqueIndex:wallet_address_network_address_uindex" json:"network"`
+	Network string `gorm:"column:network;uniqueIndex:wallet_address_network_address_uindex" json:"network" example:"tron"`
-	Address string `gorm:"column:address;uniqueIndex:wallet_address_network_address_uindex" json:"address"`
+	Address string `gorm:"column:address;uniqueIndex:wallet_address_network_address_uindex" json:"address" example:"TTestTronAddress001"`
-	Status  int64  `gorm:"column:status;default:1" json:"status"`
+	// 状态 1=启用 2=禁用
+	Status int64  `gorm:"column:status;default:1" json:"status" enums:"1,2" example:"1"`
+	Remark string `gorm:"column:remark;size:255" json:"remark" example:"主钱包"`
+	Source string `gorm:"column:source;size:16;default:manual" json:"source" enums:"manual,import" example:"manual"`
 	BaseModel
 }
 

src/model/request/base.go

@@ -8,8 +8,8 @@ const (
 var OrderByFuncList = []string{OrderByFuncDesc, OrderByFuncAsc}
 
 type BaseRequest struct {
-	Page       int    `json:"page"`        // 页数
+	Page       int    `json:"page" example:"1"`              // 页数
-	PageSize   int    `json:"page_size"`   // 每页条数
+	PageSize   int    `json:"page_size" example:"20"`        // 每页条数
-	OrderField string `json:"order_field"` // 排序字段
+	OrderField string `json:"order_field" example:"created_at"` // 排序字段
-	OrderFunc  string `json:"order_func"`  // 排序方法
+	OrderFunc  string `json:"order_func" enums:"DESC,ASC" example:"DESC"` // 排序方法
 }

src/model/request/order_request.go

@@ -4,16 +4,16 @@ import "github.com/gookit/validate"
 
 // CreateTransactionRequest 创建交易请求
 type CreateTransactionRequest struct {
-	OrderId     string  `json:"order_id" validate:"required|maxLen:32"`
+	OrderId     string  `json:"order_id" form:"order_id" validate:"required|maxLen:32" example:"ORD20260416001"`
-	Currency    string  `json:"currency" validate:"required"` // 法币 如：cny
+	Currency    string  `json:"currency" form:"currency" validate:"required" example:"cny"` // 法币 如：cny
-	Token       string  `json:"token" validate:"required"`    // 币种 如：usdt
+	Token       string  `json:"token" form:"token" validate:"required" example:"usdt"`      // 币种 如：usdt
-	Network     string  `json:"network" validate:"required"`  // 网络 如：TRON
+	Network     string  `json:"network" form:"network" validate:"required" example:"tron"`  // 网络 如：tron
-	Amount      float64 `json:"amount" validate:"required|isFloat|gt:0.01"`
+	Amount      float64 `json:"amount" form:"amount" validate:"required|isFloat|gt:0.01" example:"100.00"`
-	NotifyUrl   string  `json:"notify_url" validate:"required"`
+	NotifyUrl   string  `json:"notify_url" form:"notify_url" validate:"required" example:"https://example.com/notify"`
-	Signature   string  `json:"signature"  validate:"required"`
+	Signature   string  `json:"signature" form:"signature" validate:"required" example:"a1b2c3d4e5f6..."`
-	RedirectUrl string  `json:"redirect_url"`
+	RedirectUrl string  `json:"redirect_url" form:"redirect_url" example:"https://example.com/success"`
-	Name        string  `json:"name"`
+	Name        string  `json:"name" form:"name" example:"VIP月卡"`
-	PaymentType string  `json:"payment_type"`
+	PaymentType string  `json:"payment_type" form:"payment_type" example:"Epay"`
 }
 
 func (r CreateTransactionRequest) Translates() map[string]string {
@@ -41,9 +41,9 @@ type OrderProcessingRequest struct {
 
 // SwitchNetworkRequest 切换支付网络
 type SwitchNetworkRequest struct {
-	TradeId string `json:"trade_id" validate:"required"`
+	TradeId string `json:"trade_id" validate:"required" example:"T2026041612345678"`
-	Token   string `json:"token" validate:"required"`
+	Token   string `json:"token" validate:"required" example:"USDT"`
-	Network string `json:"network" validate:"required"`
+	Network string `json:"network" validate:"required" example:"ethereum"`
 }
 
 func (r SwitchNetworkRequest) Translates() map[string]string {

src/model/response/base.go

@@ -0,0 +1,11 @@
+package response
+
+// ApiResponse is the standard JSON envelope used by all API endpoints.
+// Used for swagger documentation only — the actual response is built
+// by util/http.Resp.
+type ApiResponse struct {
+	StatusCode int         `json:"status_code" example:"200"`
+	Message    string      `json:"message" example:"success"`
+	Data       interface{} `json:"data"`
+	RequestID  string      `json:"request_id" example:"req-123456"`
+}

src/model/response/order_response.go

@@ -2,39 +2,41 @@ package response
 
 // CreateTransactionResponse 创建订单成功返回
 type CreateTransactionResponse struct {
-	TradeId        string  `json:"trade_id"`        //  epusdt订单号
+	TradeId        string  `json:"trade_id" example:"T2026041612345678"`        //  epusdt订单号
-	OrderId        string  `json:"order_id"`        //  客户交易id
+	OrderId        string  `json:"order_id" example:"ORD20260416001"`           //  客户交易id
-	Amount         float64 `json:"amount"`          //  订单金额，保留4位小数
+	Amount         float64 `json:"amount" example:"100.0000"`                   //  订单金额，保留4位小数
-	Currency       string  `json:"currency"`        //  订单货币类型 CNY USD......
+	Currency       string  `json:"currency" example:"CNY"`                      //  订单货币类型 CNY USD......
-	ActualAmount   float64 `json:"actual_amount"`   //  订单实际需要支付的金额，保留4位小数
+	ActualAmount   float64 `json:"actual_amount" example:"14.2857"`             //  订单实际需要支付的金额，保留4位小数
-	ReceiveAddress string  `json:"receive_address"` //  收款钱包地址
+	ReceiveAddress string  `json:"receive_address" example:"TTestTronAddress001"` //  收款钱包地址
-	Token          string  `json:"token"`           // 所属币种 TRX USDT......
+	Token          string  `json:"token" example:"USDT"`                        // 所属币种 TRX USDT......
-	ExpirationTime int64   `json:"expiration_time"` // 过期时间 时间戳
+	ExpirationTime int64   `json:"expiration_time" example:"1713264600"`        // 过期时间 时间戳
-	PaymentUrl     string  `json:"payment_url"`     // 收银台地址
+	PaymentUrl     string  `json:"payment_url" example:"https://pay.example.com/checkout/T2026041612345678"` // 收银台地址
 }
 
 // OrderNotifyResponse 订单异步回调结构体
 type OrderNotifyResponse struct {
-	TradeId            string  `json:"trade_id"`             //  epusdt订单号
+	Pid                string  `json:"pid" example:"1000"`                               //  签名使用的商户 PID，商户据此查本地 secret 验签
-	OrderId            string  `json:"order_id"`             //  客户交易id
+	TradeId            string  `json:"trade_id" example:"T2026041612345678"`             //  epusdt订单号
-	Amount             float64 `json:"amount"`               //  订单金额，保留4位小数
+	OrderId            string  `json:"order_id" example:"ORD20260416001"`                //  客户交易id
-	ActualAmount       float64 `json:"actual_amount"`        //  订单实际需要支付的金额，保留4位小数
+	Amount             float64 `json:"amount" example:"100.0000"`                        //  订单金额，保留4位小数
-	ReceiveAddress     string  `json:"receive_address"`      //  收款钱包地址
+	ActualAmount       float64 `json:"actual_amount" example:"14.2857"`                  //  订单实际需要支付的金额，保留4位小数
-	Token              string  `json:"token"`                // 所属币种 TRX USDT......
+	ReceiveAddress     string  `json:"receive_address" example:"TTestTronAddress001"`    //  收款钱包地址
-	BlockTransactionId string  `json:"block_transaction_id"` // 区块id
+	Token              string  `json:"token" example:"USDT"`                             // 所属币种 TRX USDT......
-	Signature          string  `json:"signature"`            // 签名
+	BlockTransactionId string  `json:"block_transaction_id" example:"0xabc123..."`       // 区块id
-	Status             int     `json:"status"`               //  1：等待支付，2：支付成功，3：已过期
+	Signature          string  `json:"signature" example:"a1b2c3d4e5f6..."`              // 签名 MD5(sorted_params + secret_key)
+	//  订单状态 1=等待支付 2=支付成功 3=已过期
+	Status int `json:"status" enums:"1,2,3" example:"2"`
 }
 
 // OrderNotifyResponseEpay epay订单异步回调结构体
 type OrderNotifyResponseEpay struct {
-	PID         int    `json:"pid"`          // 商户ID
+	PID         int    `json:"pid" example:"1001"`                   // 商户ID
-	TradeNo     string `json:"trade_no"`     // 平台订单号
+	TradeNo     string `json:"trade_no" example:"T2026041612345678"` // 平台订单号
-	OutTradeNo  string `json:"out_trade_no"` // 商户订单号
+	OutTradeNo  string `json:"out_trade_no" example:"ORD20260416001"` // 商户订单号
-	Type        string `json:"type"`         // 订单类型
+	Type        string `json:"type" example:"usdt"`                  // 订单类型
-	Name        string `json:"name"`         // 商品名称
+	Name        string `json:"name" example:"VIP月卡"`                 // 商品名称
-	Money       string `json:"money"`        // 订单金额，保留4位小数
+	Money       string `json:"money" example:"100.0000"`             // 订单金额，保留4位小数
-	Sign        string `json:"sign"`         // 签名
+	Sign        string `json:"sign" example:"a1b2c3d4..."`           // 签名
-	SignType    string `json:"sign_type"`    // 签名类型 // MD5
+	SignType    string `json:"sign_type" example:"MD5"`              // 签名类型
-	TradeStatus string `json:"trade_status"` // 订单状态 // only has "TRADE_SUCCESS" for now
+	TradeStatus string `json:"trade_status" example:"TRADE_SUCCESS"` // 订单状态
 }

src/model/response/pay_response.go

@@ -1,20 +1,21 @@
 package response
 
 type CheckoutCounterResponse struct {
-	TradeId        string  `json:"trade_id"`        //  epusdt订单号
+	TradeId        string  `json:"trade_id" example:"T2026041612345678"`        //  epusdt订单号
-	Amount         float64 `json:"amount"`          //  订单金额，保留4位小数 法币金额
+	Amount         float64 `json:"amount" example:"100.0000"`                   //  订单金额，保留4位小数 法币金额
-	ActualAmount   float64 `json:"actual_amount"`   //  订单实际需要支付的金额，保留4位小数 加密货币金额
+	ActualAmount   float64 `json:"actual_amount" example:"14.2857"`             //  订单实际需要支付的金额，保留4位小数 加密货币金额
-	Token          string  `json:"token"`           //  所属币种 TRX USDT......
+	Token          string  `json:"token" example:"USDT"`                        //  所属币种 TRX USDT......
-	Currency       string  `json:"currency"`        //  法币币种 CNY USD ...
+	Currency       string  `json:"currency" example:"CNY"`                      //  法币币种 CNY USD ...
-	ReceiveAddress string  `json:"receive_address"` //  收款钱包地址
+	ReceiveAddress string  `json:"receive_address" example:"TTestTronAddress001"` //  收款钱包地址
-	Network        string  `json:"network"`         //  网络 TRON ETH ...
+	Network        string  `json:"network" example:"tron"`                      //  网络 TRON ETH ...
-	ExpirationTime int64   `json:"expiration_time"` // 过期时间 时间戳
+	ExpirationTime int64   `json:"expiration_time" example:"1713264600"`        // 过期时间 时间戳
-	RedirectUrl    string  `json:"redirect_url"`
+	RedirectUrl    string  `json:"redirect_url" example:"https://example.com/success"`
-	CreatedAt      int64   `json:"created_at"` // 订单创建时间 时间戳
+	CreatedAt      int64   `json:"created_at" example:"1713264000"` // 订单创建时间 时间戳
-	IsSelected     bool    `json:"is_selected"`
+	IsSelected     bool    `json:"is_selected" example:"false"`
 }
 
 type CheckStatusResponse struct {
-	TradeId string `json:"trade_id"` //  epusdt订单号
+	TradeId string `json:"trade_id" example:"T2026041612345678"` //  epusdt订单号
-	Status  int    `json:"status"`
+	// 订单状态 1=等待支付 2=支付成功 3=已过期
+	Status int `json:"status" enums:"1,2,3" example:"1"`
 }

src/model/response/support_response.go

@@ -1,8 +1,8 @@
 package response
 
 type NetworkTokenSupport struct {
-	Network string   `json:"network"`
+	Network string   `json:"network" example:"tron"`
-	Tokens  []string `json:"tokens"`
+	Tokens  []string `json:"tokens" example:"USDT,USDC"`
 }
 
 type SupportedAssetsResponse struct {

src/model/service/order_service.go

@@ -33,8 +33,28 @@ var (
 	gOrderProcessingLock   sync.Mutex
 )
 
+// apiKeyID safely extracts the primary key from an ApiKey row.
+// Returns 0 when apiKey is nil (middleware didn't run — shouldn't happen on authed routes).
+func apiKeyID(apiKey *mdb.ApiKey) uint64 {
+	if apiKey == nil {
+		return 0
+	}
+	return apiKey.ID
+}
+
+func normalizeOrderAddressByNetwork(network, address string) string {
+	network = strings.ToLower(strings.TrimSpace(network))
+	address = strings.TrimSpace(address)
+	switch network {
+	case mdb.NetworkEthereum, mdb.NetworkBsc, mdb.NetworkPolygon, mdb.NetworkPlasma:
+		return strings.ToLower(address)
+	default:
+		return address
+	}
+}
+
 // CreateTransaction creates a new payment order.
-func CreateTransaction(req *request.CreateTransactionRequest) (*response.CreateTransactionResponse, error) {
+func CreateTransaction(req *request.CreateTransactionRequest, apiKey *mdb.ApiKey) (*response.CreateTransactionResponse, error) {
 	gCreateTransactionLock.Lock()
 	defer gCreateTransactionLock.Unlock()
 
@@ -64,6 +84,9 @@ func CreateTransaction(req *request.CreateTransactionRequest) (*response.CreateT
 		return nil, constant.OrderAlreadyExists
 	}
 
+	if !data.IsChainEnabled(network) {
+		return nil, constant.ChainNotEnabled
+	}
 	walletAddress, err := data.GetAvailableWalletAddressByNetwork(network)
 	if err != nil {
 		return nil, err
@@ -97,6 +120,7 @@ func CreateTransaction(req *request.CreateTransactionRequest) (*response.CreateT
 		RedirectUrl:    req.RedirectUrl,
 		Name:           req.Name,
 		PaymentType:    req.PaymentType,
+		ApiKeyID:       apiKeyID(apiKey),
 	}
 	if err = data.CreateOrderWithTransaction(tx, order); err != nil {
 		tx.Rollback()
@@ -161,7 +185,7 @@ func OrderProcessing(req *request.OrderProcessingRequest) error {
 	// Load order to check parent-child relationship
 	order, err := data.GetOrderInfoByTradeId(req.TradeId)
 	if err != nil {
-		return nil
+		return fmt.Errorf("load paid order failed, trade_id=%s: %w", req.TradeId, err)
 	}
 
 	// Parent order paid directly: expire all sub-orders and release their locks
@@ -169,7 +193,7 @@ func OrderProcessing(req *request.OrderProcessingRequest) error {
 		subs, subErr := data.GetActiveSubOrders(order.TradeId)
 		if subErr != nil {
 			log.Sugar.Errorf("[order] get sub-orders for parent failed, trade_id=%s, err=%v", order.TradeId, subErr)
-			return nil
+			return fmt.Errorf("load sub-orders failed, parent_trade_id=%s: %w", order.TradeId, subErr)
 		}
 		for _, sub := range subs {
 			if err = data.ExpireOrderByTradeId(sub.TradeId); err != nil {
@@ -182,22 +206,48 @@ func OrderProcessing(req *request.OrderProcessingRequest) error {
 		return nil
 	}
 
-	// Sub-order should not trigger its own callback (notify_url is empty).
-	// OrderSuccessWithTransaction unconditionally sets callback_confirm=No,
-	// reset it here to prevent the callback worker from retrying an empty URL.
-	if err = data.ResetCallbackConfirmOk(order.TradeId); err != nil {
-		log.Sugar.Warnf("[order] reset sub-order callback_confirm failed, trade_id=%s, err=%v", order.TradeId, err)
-	}
-
 	parent, err := data.GetOrderInfoByTradeId(order.ParentTradeId)
 	if err != nil {
 		log.Sugar.Errorf("[order] load parent order failed, parent_trade_id=%s, err=%v", order.ParentTradeId, err)
-		return nil
+		return fmt.Errorf("load parent order failed, parent_trade_id=%s: %w", order.ParentTradeId, err)
 	}
 
+	// Snapshot siblings for lock release after DB state transition commits.
+	siblings, err := data.GetSiblingSubOrders(parent.TradeId, order.TradeId)
+	if err != nil {
+		log.Sugar.Errorf("[order] get sibling sub-orders failed, parent_trade_id=%s, err=%v", parent.TradeId, err)
+		return fmt.Errorf("load sibling sub-orders failed, parent_trade_id=%s: %w", parent.TradeId, err)
+	}
+
+	finalizeTx := dao.Mdb.Begin()
+
 	// Mark parent as paid with sub-order's payment details
-	if _, err = data.MarkParentOrderSuccess(parent.TradeId, order); err != nil {
+	updatedParent, markErr := data.MarkParentOrderSuccessWithTransaction(finalizeTx, parent.TradeId, order)
-		log.Sugar.Errorf("[order] mark parent success failed, parent_trade_id=%s, err=%v", parent.TradeId, err)
+	if markErr != nil {
+		finalizeTx.Rollback()
+		log.Sugar.Errorf("[order] mark parent success failed, parent_trade_id=%s, err=%v", parent.TradeId, markErr)
+		return fmt.Errorf("mark parent success failed, parent_trade_id=%s: %w", parent.TradeId, markErr)
+	}
+	if !updatedParent {
+		finalizeTx.Rollback()
+		return fmt.Errorf("parent order not updated, trade_id=%s is not in wait-pay status", parent.TradeId)
+	}
+
+	if err = data.ExpireSiblingSubOrdersWithTransaction(finalizeTx, parent.TradeId, order.TradeId); err != nil {
+		finalizeTx.Rollback()
+		return fmt.Errorf("expire sibling sub-orders failed, parent_trade_id=%s: %w", parent.TradeId, err)
+	}
+
+	if err = finalizeTx.Commit().Error; err != nil {
+		finalizeTx.Rollback()
+		return fmt.Errorf("commit parent finalize tx failed, parent_trade_id=%s: %w", parent.TradeId, err)
+	}
+
+	// Sub-order should not trigger its own callback (notify_url is empty).
+	// OrderSuccessWithTransaction unconditionally sets callback_confirm=No,
+	// reset it only after the parent order is successfully finalized.
+	if err = data.ResetCallbackConfirmOk(order.TradeId); err != nil {
+		log.Sugar.Warnf("[order] reset sub-order callback_confirm failed, trade_id=%s, err=%v", order.TradeId, err)
 	}
 
 	// Release parent's own wallet lock
@@ -205,16 +255,8 @@ func OrderProcessing(req *request.OrderProcessingRequest) error {
 		log.Sugar.Warnf("[order] unlock parent transaction failed, parent_trade_id=%s, err=%v", parent.TradeId, err)
 	}
 
-	// Expire sibling sub-orders and release their locks
+	// Release sibling locks after their status transitions commit.
-	siblings, err := data.GetSiblingSubOrders(parent.TradeId, order.TradeId)
-	if err != nil {
-		log.Sugar.Errorf("[order] get sibling sub-orders failed, parent_trade_id=%s, err=%v", parent.TradeId, err)
-		return nil
-	}
 	for _, sib := range siblings {
-		if err = data.ExpireOrderByTradeId(sib.TradeId); err != nil {
-			log.Sugar.Warnf("[order] expire sibling failed, trade_id=%s, err=%v", sib.TradeId, err)
-		}
 		if err = data.UnLockTransaction(sib.Network, sib.ReceiveAddress, sib.Token, sib.ActualAmount); err != nil {
 			log.Sugar.Warnf("[order] unlock sibling transaction failed, trade_id=%s, err=%v", sib.TradeId, err)
 		}
@@ -230,9 +272,10 @@ func ReserveAvailableWalletAndAmount(tradeID string, network string, token strin
 
 	tryLockWalletFunc := func(targetAmount float64) (string, error) {
 		for _, address := range walletAddress {
-			err := data.LockTransaction(network, address.Address, token, tradeID, targetAmount, config.GetOrderExpirationTimeDuration())
+			normalizedAddress := normalizeOrderAddressByNetwork(network, address.Address)
+			err := data.LockTransaction(network, normalizedAddress, token, tradeID, targetAmount, config.GetOrderExpirationTimeDuration())
 			if err == nil {
-				return address.Address, nil
+				return normalizedAddress, nil
 			}
 			if errors.Is(err, data.ErrTransactionLocked) {
 				continue
@@ -344,6 +387,9 @@ func SwitchNetwork(req *request.SwitchNetworkRequest) (*response.CheckoutCounter
 	}
 
 	// 6. Find and lock wallet
+	if !data.IsChainEnabled(network) {
+		return nil, constant.ChainNotEnabled
+	}
 	walletAddress, err := data.GetAvailableWalletAddressByNetwork(network)
 	if err != nil {
 		return nil, err
@@ -381,6 +427,7 @@ func SwitchNetwork(req *request.SwitchNetworkRequest) (*response.CheckoutCounter
 		Name:            parent.Name,
 		CallBackConfirm: mdb.CallBackConfirmOk, // don't trigger callback on sub-order
 		PaymentType:     parent.PaymentType,
+		ApiKeyID:        parent.ApiKeyID, // inherit from parent so resolveOrderApiKey never fails
 	}
 	if err = data.CreateOrderWithTransaction(tx, subOrder); err != nil {
 		tx.Rollback()

src/model/service/order_service_test.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"fmt"
+	"strings"
 	"sync"
 	"testing"
 
@@ -32,11 +33,11 @@ func TestCreateTransactionAssignsIncrementedAmountsAndLocks(t *testing.T) {
 		t.Fatalf("add wallet: %v", err)
 	}
 
-	resp1, err := CreateTransaction(newCreateTransactionRequest("order_1", 1))
+	resp1, err := CreateTransaction(newCreateTransactionRequest("order_1", 1), nil)
 	if err != nil {
 		t.Fatalf("create first transaction: %v", err)
 	}
-	resp2, err := CreateTransaction(newCreateTransactionRequest("order_2", 1))
+	resp2, err := CreateTransaction(newCreateTransactionRequest("order_2", 1), nil)
 	if err != nil {
 		t.Fatalf("create second transaction: %v", err)
 	}
@@ -71,6 +72,49 @@ func TestCreateTransactionAssignsIncrementedAmountsAndLocks(t *testing.T) {
 	}
 }
 
+func TestCreateTransactionNormalizesEvmReceiveAddressToLowercase(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	mixedAddress := "0xA1B2c3D4e5F60718293aBcDeF001122334455667"
+	if err := dao.Mdb.Create(&mdb.WalletAddress{
+		Network: mdb.NetworkEthereum,
+		Address: mixedAddress,
+		Status:  mdb.TokenStatusEnable,
+	}).Error; err != nil {
+		t.Fatalf("seed mixed-case wallet: %v", err)
+	}
+
+	req := newCreateTransactionRequest("order_evm_1", 1)
+	req.Network = mdb.NetworkEthereum
+
+	resp, err := CreateTransaction(req, nil)
+	if err != nil {
+		t.Fatalf("create transaction: %v", err)
+	}
+
+	expectedAddress := strings.ToLower(mixedAddress)
+	if resp.ReceiveAddress != expectedAddress {
+		t.Fatalf("receive address = %q, want %q", resp.ReceiveAddress, expectedAddress)
+	}
+
+	order, err := data.GetOrderInfoByTradeId(resp.TradeId)
+	if err != nil {
+		t.Fatalf("load order: %v", err)
+	}
+	if order.ReceiveAddress != expectedAddress {
+		t.Fatalf("stored order address = %q, want %q", order.ReceiveAddress, expectedAddress)
+	}
+
+	tradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkEthereum, strings.ToUpper(mixedAddress), resp.Token, resp.ActualAmount)
+	if err != nil {
+		t.Fatalf("lookup runtime lock: %v", err)
+	}
+	if tradeID != resp.TradeId {
+		t.Fatalf("runtime lock trade_id = %q, want %q", tradeID, resp.TradeId)
+	}
+}
+
 func TestOrderProcessingMarksPaidAndReleasesLock(t *testing.T) {
 	cleanup := testutil.SetupTestDatabases(t)
 	defer cleanup()
@@ -79,7 +123,7 @@ func TestOrderProcessingMarksPaidAndReleasesLock(t *testing.T) {
 		t.Fatalf("add wallet: %v", err)
 	}
 
-	resp, err := CreateTransaction(newCreateTransactionRequest("order_1", 1))
+	resp, err := CreateTransaction(newCreateTransactionRequest("order_1", 1), nil)
 	if err != nil {
 		t.Fatalf("create transaction: %v", err)
 	}
@@ -127,7 +171,7 @@ func TestOrderProcessingRejectsDuplicateBlockForSameOrder(t *testing.T) {
 		t.Fatalf("add wallet: %v", err)
 	}
 
-	resp, err := CreateTransaction(newCreateTransactionRequest("order_1", 1))
+	resp, err := CreateTransaction(newCreateTransactionRequest("order_1", 1), nil)
 	if err != nil {
 		t.Fatalf("create transaction: %v", err)
 	}
@@ -169,7 +213,7 @@ func TestOrderProcessingDoesNotReviveExpiredOrder(t *testing.T) {
 		t.Fatalf("add wallet: %v", err)
 	}
 
-	resp, err := CreateTransaction(newCreateTransactionRequest("order_1", 1))
+	resp, err := CreateTransaction(newCreateTransactionRequest("order_1", 1), nil)
 	if err != nil {
 		t.Fatalf("create transaction: %v", err)
 	}
@@ -215,11 +259,11 @@ func TestOrderProcessingOnlyOneOrderClaimsABlockTransaction(t *testing.T) {
 		t.Fatalf("add wallet: %v", err)
 	}
 
-	resp1, err := CreateTransaction(newCreateTransactionRequest("order_1", 1))
+	resp1, err := CreateTransaction(newCreateTransactionRequest("order_1", 1), nil)
 	if err != nil {
 		t.Fatalf("create first transaction: %v", err)
 	}
-	resp2, err := CreateTransaction(newCreateTransactionRequest("order_2", 2))
+	resp2, err := CreateTransaction(newCreateTransactionRequest("order_2", 2), nil)
 	if err != nil {
 		t.Fatalf("create second transaction: %v", err)
 	}
@@ -303,3 +347,285 @@ func TestOrderProcessingOnlyOneOrderClaimsABlockTransaction(t *testing.T) {
 		t.Fatalf("paid=%d pending=%d, want 1 and 1", paidCount, pendingCount)
 	}
 }
+
+func TestOrderProcessingSubOrderReturnsErrorWhenParentNotWaitPay(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if _, err := data.AddWalletAddress("TTestTronAddress001"); err != nil {
+		t.Fatalf("add tron wallet: %v", err)
+	}
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkEthereum, "0xA1B2c3D4e5F60718293aBcDeF001122334455667"); err != nil {
+		t.Fatalf("add ethereum wallet: %v", err)
+	}
+
+	parentReq := newCreateTransactionRequest("order_parent_for_sub", 1)
+	parentReq.Network = mdb.NetworkTron
+	parentResp, err := CreateTransaction(parentReq, nil)
+	if err != nil {
+		t.Fatalf("create parent order: %v", err)
+	}
+
+	subResp, err := SwitchNetwork(&request.SwitchNetworkRequest{
+		TradeId: parentResp.TradeId,
+		Token:   "usdt",
+		Network: mdb.NetworkEthereum,
+	})
+	if err != nil {
+		t.Fatalf("switch network create sub-order: %v", err)
+	}
+
+	if err := dao.Mdb.Model(&mdb.Orders{}).
+		Where("trade_id = ?", parentResp.TradeId).
+		Update("status", mdb.StatusExpired).Error; err != nil {
+		t.Fatalf("force parent expired: %v", err)
+	}
+
+	err = OrderProcessing(&request.OrderProcessingRequest{
+		ReceiveAddress:     subResp.ReceiveAddress,
+		Token:              strings.ToUpper(subResp.Token),
+		Network:            strings.ToLower(subResp.Network),
+		TradeId:            subResp.TradeId,
+		Amount:             subResp.ActualAmount,
+		BlockTransactionId: "block_sub_parent_not_wait",
+	})
+	if err == nil {
+		t.Fatal("expected error when parent order is not wait-pay")
+	}
+}
+
+func TestOrderProcessingSubOrderReturnsErrorWhenParentMissing(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if _, err := data.AddWalletAddress("TTestTronAddress001"); err != nil {
+		t.Fatalf("add tron wallet: %v", err)
+	}
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkEthereum, "0xA1B2c3D4e5F60718293aBcDeF001122334455667"); err != nil {
+		t.Fatalf("add ethereum wallet: %v", err)
+	}
+
+	parentReq := newCreateTransactionRequest("order_parent_missing", 1)
+	parentReq.Network = mdb.NetworkTron
+	parentResp, err := CreateTransaction(parentReq, nil)
+	if err != nil {
+		t.Fatalf("create parent order: %v", err)
+	}
+
+	subResp, err := SwitchNetwork(&request.SwitchNetworkRequest{
+		TradeId: parentResp.TradeId,
+		Token:   "usdt",
+		Network: mdb.NetworkEthereum,
+	})
+	if err != nil {
+		t.Fatalf("switch network create sub-order: %v", err)
+	}
+
+	if err := dao.Mdb.Where("trade_id = ?", parentResp.TradeId).Delete(&mdb.Orders{}).Error; err != nil {
+		t.Fatalf("delete parent order: %v", err)
+	}
+
+	err = OrderProcessing(&request.OrderProcessingRequest{
+		ReceiveAddress:     subResp.ReceiveAddress,
+		Token:              strings.ToUpper(subResp.Token),
+		Network:            strings.ToLower(subResp.Network),
+		TradeId:            subResp.TradeId,
+		Amount:             subResp.ActualAmount,
+		BlockTransactionId: "block_sub_parent_missing",
+	})
+	if err == nil {
+		t.Fatal("expected error when parent order is missing")
+	}
+}
+
+// TestOrderProcessingSubOrderPaidParentKeepsOwnFields verifies the new behavior:
+// when a sub-order is paid, the parent order is marked as paid but its own
+// block_transaction_id, actual_amount, and receive_address are NOT overwritten.
+// The sub-order's primary-key ID is recorded in the parent's pay_by_sub_id field.
+// Also verifies: parent callback_confirm=No (callback queued), sub-order callback_confirm=Ok.
+func TestOrderProcessingSubOrderPaidParentKeepsOwnFields(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if _, err := data.AddWalletAddress("TTestTronAddress001"); err != nil {
+		t.Fatalf("add tron wallet: %v", err)
+	}
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkEthereum, "0xA1B2c3D4e5F60718293aBcDeF001122334455667"); err != nil {
+		t.Fatalf("add ethereum wallet: %v", err)
+	}
+
+	parentReq := newCreateTransactionRequest("order_sub_pay_test", 1)
+	parentReq.Network = mdb.NetworkTron
+	parentResp, err := CreateTransaction(parentReq, nil)
+	if err != nil {
+		t.Fatalf("create parent order: %v", err)
+	}
+
+	// Snapshot the parent's original fields before any payment.
+	originalParent, err := data.GetOrderInfoByTradeId(parentResp.TradeId)
+	if err != nil {
+		t.Fatalf("load original parent: %v", err)
+	}
+
+	subResp, err := SwitchNetwork(&request.SwitchNetworkRequest{
+		TradeId: parentResp.TradeId,
+		Token:   "usdt",
+		Network: mdb.NetworkEthereum,
+	})
+	if err != nil {
+		t.Fatalf("switch network create sub-order: %v", err)
+	}
+
+	// Load the sub-order to get its DB primary-key ID.
+	subOrder, err := data.GetOrderInfoByTradeId(subResp.TradeId)
+	if err != nil {
+		t.Fatalf("load sub-order: %v", err)
+	}
+
+	err = OrderProcessing(&request.OrderProcessingRequest{
+		ReceiveAddress:     subResp.ReceiveAddress,
+		Token:              strings.ToUpper(subResp.Token),
+		Network:            strings.ToLower(subResp.Network),
+		TradeId:            subResp.TradeId,
+		Amount:             subResp.ActualAmount,
+		BlockTransactionId: "block_sub_paid",
+	})
+	if err != nil {
+		t.Fatalf("order processing sub-order: %v", err)
+	}
+
+	// Sub-order must be paid with the block hash and no pending callback.
+	sub, err := data.GetOrderInfoByTradeId(subResp.TradeId)
+	if err != nil {
+		t.Fatalf("reload sub-order: %v", err)
+	}
+	if sub.Status != mdb.StatusPaySuccess {
+		t.Fatalf("sub-order status = %d, want %d", sub.Status, mdb.StatusPaySuccess)
+	}
+	if sub.BlockTransactionId != "block_sub_paid" {
+		t.Fatalf("sub-order block_transaction_id = %q, want %q", sub.BlockTransactionId, "block_sub_paid")
+	}
+	if sub.CallBackConfirm != mdb.CallBackConfirmOk {
+		t.Fatalf("sub-order callback_confirm = %d, want %d (no callback for sub-order)", sub.CallBackConfirm, mdb.CallBackConfirmOk)
+	}
+
+	// Parent must be paid but its own fields must be unchanged.
+	parent, err := data.GetOrderInfoByTradeId(parentResp.TradeId)
+	if err != nil {
+		t.Fatalf("reload parent order: %v", err)
+	}
+	if parent.Status != mdb.StatusPaySuccess {
+		t.Fatalf("parent status = %d, want %d", parent.Status, mdb.StatusPaySuccess)
+	}
+	if parent.BlockTransactionId != "" {
+		t.Fatalf("parent block_transaction_id = %q, want empty (parent was not directly paid)", parent.BlockTransactionId)
+	}
+	if parent.ReceiveAddress != originalParent.ReceiveAddress {
+		t.Fatalf("parent receive_address changed: got %q, want %q", parent.ReceiveAddress, originalParent.ReceiveAddress)
+	}
+	if parent.ActualAmount != originalParent.ActualAmount {
+		t.Fatalf("parent actual_amount changed: got %v, want %v", parent.ActualAmount, originalParent.ActualAmount)
+	}
+	if parent.PayBySubId != subOrder.ID {
+		t.Fatalf("parent pay_by_sub_id = %d, want %d (sub-order ID)", parent.PayBySubId, subOrder.ID)
+	}
+	if parent.CallBackConfirm != mdb.CallBackConfirmNo {
+		t.Fatalf("parent callback_confirm = %d, want %d (callback must be queued)", parent.CallBackConfirm, mdb.CallBackConfirmNo)
+	}
+}
+
+// TestOrderProcessingSubOrderExpiresSiblingsAndReleasesLocks verifies that when one
+// sub-order is paid all sibling sub-orders are expired and their runtime locks (as
+// well as the parent's lock) are released.
+func TestOrderProcessingSubOrderExpiresSiblingsAndReleasesLocks(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	if _, err := data.AddWalletAddress("TTestTronAddress001"); err != nil {
+		t.Fatalf("add tron wallet: %v", err)
+	}
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkEthereum, "0xA1B2c3D4e5F60718293aBcDeF001122334455667"); err != nil {
+		t.Fatalf("add ethereum wallet: %v", err)
+	}
+	if _, err := data.AddWalletAddressWithNetwork(mdb.NetworkBsc, "0xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"); err != nil {
+		t.Fatalf("add bsc wallet: %v", err)
+	}
+
+	parentReq := newCreateTransactionRequest("order_sib_expiry_test", 1)
+	parentReq.Network = mdb.NetworkTron
+	parentResp, err := CreateTransaction(parentReq, nil)
+	if err != nil {
+		t.Fatalf("create parent order: %v", err)
+	}
+
+	// Create two sub-orders on different networks.
+	subEthResp, err := SwitchNetwork(&request.SwitchNetworkRequest{
+		TradeId: parentResp.TradeId,
+		Token:   "usdt",
+		Network: mdb.NetworkEthereum,
+	})
+	if err != nil {
+		t.Fatalf("switch to ethereum sub-order: %v", err)
+	}
+
+	subBscResp, err := SwitchNetwork(&request.SwitchNetworkRequest{
+		TradeId: parentResp.TradeId,
+		Token:   "usdt",
+		Network: mdb.NetworkBsc,
+	})
+	if err != nil {
+		t.Fatalf("switch to bsc sub-order: %v", err)
+	}
+
+	// Pay the Ethereum sub-order.
+	err = OrderProcessing(&request.OrderProcessingRequest{
+		ReceiveAddress:     subEthResp.ReceiveAddress,
+		Token:              strings.ToUpper(subEthResp.Token),
+		Network:            strings.ToLower(subEthResp.Network),
+		TradeId:            subEthResp.TradeId,
+		Amount:             subEthResp.ActualAmount,
+		BlockTransactionId: "block_sib_eth",
+	})
+	if err != nil {
+		t.Fatalf("order processing eth sub-order: %v", err)
+	}
+
+	// BSC sibling must be expired.
+	subBsc, err := data.GetOrderInfoByTradeId(subBscResp.TradeId)
+	if err != nil {
+		t.Fatalf("reload bsc sub-order: %v", err)
+	}
+	if subBsc.Status != mdb.StatusExpired {
+		t.Fatalf("bsc sibling status = %d, want %d (expired)", subBsc.Status, mdb.StatusExpired)
+	}
+
+	// Parent runtime lock must be released.
+	parentLock, err := data.GetTradeIdByWalletAddressAndAmountAndToken(
+		mdb.NetworkTron, parentResp.ReceiveAddress, parentResp.Token, parentResp.ActualAmount)
+	if err != nil {
+		t.Fatalf("check parent runtime lock: %v", err)
+	}
+	if parentLock != "" {
+		t.Fatalf("parent runtime lock still held: trade_id=%s", parentLock)
+	}
+
+	// BSC sibling runtime lock must be released.
+	sibLock, err := data.GetTradeIdByWalletAddressAndAmountAndToken(
+		mdb.NetworkBsc, subBscResp.ReceiveAddress, subBscResp.Token, subBscResp.ActualAmount)
+	if err != nil {
+		t.Fatalf("check bsc sibling runtime lock: %v", err)
+	}
+	if sibLock != "" {
+		t.Fatalf("bsc sibling runtime lock still held: trade_id=%s", sibLock)
+	}
+
+	// Ethereum sub-order runtime lock must also be released.
+	ethLock, err := data.GetTradeIdByWalletAddressAndAmountAndToken(
+		mdb.NetworkEthereum, subEthResp.ReceiveAddress, subEthResp.Token, subEthResp.ActualAmount)
+	if err != nil {
+		t.Fatalf("check eth sub-order runtime lock: %v", err)
+	}
+	if ethLock != "" {
+		t.Fatalf("eth sub-order runtime lock still held: trade_id=%s", ethLock)
+	}
+}

src/model/service/sol_task.go

@@ -45,6 +45,33 @@ func SolCallBack(address string, wg *sync.WaitGroup) {
 		}
 	}()
 
+	// Load enabled Solana tokens from chain_tokens. The contract_address
+	// column holds the mint for SPL tokens; a special entry with
+	// symbol=SOL and empty contract_address enables native SOL payments.
+	tokens, err := data.ListEnabledChainTokensByNetwork(mdb.NetworkSolana)
+	if err != nil {
+		log.Sugar.Errorf("[SOL][%s] load chain_tokens err=%v", address, err)
+		return
+	}
+	if len(tokens) == 0 {
+		log.Sugar.Debugf("[SOL][%s] no enabled chain_tokens, skipping", address)
+		return
+	}
+	mintTokens := make(map[string]*mdb.ChainToken, len(tokens))
+	var nativeSolToken *mdb.ChainToken
+	for i := range tokens {
+		sym := strings.ToUpper(strings.TrimSpace(tokens[i].Symbol))
+		mint := strings.TrimSpace(tokens[i].ContractAddress)
+		if sym == "SOL" && mint == "" {
+			nativeSolToken = &tokens[i]
+			continue
+		}
+		if mint == "" {
+			continue
+		}
+		mintTokens[mint] = &tokens[i]
+	}
+
 	// Clean up old entries from processed cache (older than 1 hour)
 	cleanupCutoff := time.Now().Add(-1 * time.Hour).Unix()
 	gProcessedSignatures.Range(func(key, value interface{}) bool {
@@ -56,17 +83,15 @@ func SolCallBack(address string, wg *sync.WaitGroup) {
 
 	limit := 1000
 
-	// 查询钱包地址 + USDT ATA + USDC ATA 三个地址的签名
+	// 查询钱包地址 + 每个已启用 SPL 代币 ATA 的签名
 	queryAddrs := []string{address}
-	if usdtAta, err := FindATAAddress(address, USDT_Mint); err == nil {
+	for mint := range mintTokens {
-		queryAddrs = append(queryAddrs, usdtAta)
+		ata, err := FindATAAddress(address, mint)
-	} else {
+		if err != nil {
-		log.Sugar.Errorf("[SOL][%s] failed to derive USDT ATA: %v", address, err)
+			log.Sugar.Errorf("[SOL][%s] failed to derive ATA for mint %s: %v", address, mint, err)
-	}
+			continue
-	if usdcAta, err := FindATAAddress(address, USDC_Mint); err == nil {
+		}
-		queryAddrs = append(queryAddrs, usdcAta)
+		queryAddrs = append(queryAddrs, ata)
-	} else {
-		log.Sugar.Errorf("[SOL][%s] failed to derive USDC ATA: %v", address, err)
 	}
 
 	// 拉取签名并去重
@@ -177,7 +202,7 @@ func SolCallBack(address string, wg *sync.WaitGroup) {
 				continue
 			}
 
-			token, amount := getTokenTypeAndAmount(transferInfo)
+			token, amount := resolveSolTokenAndAmount(transferInfo, mintTokens, nativeSolToken)
 			if token == "" || amount <= 0 {
 				continue
 			}
@@ -363,35 +388,42 @@ func isTransferToAddress(transfer *TransferInfo, targetAddress string) bool {
 	return MatchAtaAddress(targetAddress, transfer.Mint, transfer.Destination)
 }
 
-// getTokenTypeAndAmount 根据 mint 识别代币类型并计算可读金额
+// resolveSolTokenAndAmount identifies the token from a transfer using
-func getTokenTypeAndAmount(transfer *TransferInfo) (string, float64) {
+// the admin-configured chain_tokens list. mintTokens maps SPL mint
+// addresses to their ChainToken config; nativeSolToken is non-nil when a
+// native SOL entry exists in chain_tokens. Returns ("", 0) for
+// transfers whose mint is not configured or below min_amount.
+func resolveSolTokenAndAmount(transfer *TransferInfo, mintTokens map[string]*mdb.ChainToken, nativeSolToken *mdb.ChainToken) (string, float64) {
 	mint := transfer.Mint
 
 	// Native SOL
 	if mint == "SOL" {
-		return "SOL", transfer.Amount
+		if nativeSolToken == nil {
+			return "", 0
+		}
+		amount := transfer.Amount
+		if nativeSolToken.MinAmount > 0 && amount < nativeSolToken.MinAmount {
+			return "", 0
+		}
+		return strings.ToUpper(strings.TrimSpace(nativeSolToken.Symbol)), amount
 	}
 
-	// SPL Tokens
+	cfg, ok := mintTokens[mint]
-	switch mint {
+	if !ok || cfg == nil {
-	case USDT_Mint:
-		decimals := USDT_Decimals
-		if transfer.Decimals != nil {
-			decimals = int(*transfer.Decimals)
-		}
-		return "USDT", ADJustAmount(transfer.RawAmount, decimals)
-
-	case USDC_Mint:
-		decimals := USDC_Decimals
-		if transfer.Decimals != nil {
-			decimals = int(*transfer.Decimals)
-		}
-		return "USDC", ADJustAmount(transfer.RawAmount, decimals)
-
-	default:
-		// Unsupported token
 		return "", 0
 	}
+	decimals := cfg.Decimals
+	if transfer.Decimals != nil {
+		decimals = int(*transfer.Decimals)
+	}
+	if decimals <= 0 {
+		decimals = 6
+	}
+	amount := ADJustAmount(transfer.RawAmount, decimals)
+	if cfg.MinAmount > 0 && amount < cfg.MinAmount {
+		return "", 0
+	}
+	return strings.ToUpper(strings.TrimSpace(cfg.Symbol)), amount
 }
 
 const (
@@ -437,7 +469,7 @@ func ADJustAmount(amount uint64, decimals int) float64 {
 func MatchUsdtAtaAddress(address string, ataTo string) bool {
 	ata, err := FindATAAddress(address, USDT_Mint)
 	if err != nil {
-		fmt.Printf("FindATAAddress failed: %v\n", err)
+		log.Sugar.Errorf("FindATAAddress failed: %v", err)
 		return false
 	}
 
@@ -447,7 +479,7 @@ func MatchUsdtAtaAddress(address string, ataTo string) bool {
 func MatchUsdcAtaAddress(address string, ataTo string) bool {
 	ata, err := FindATAAddress(address, USDC_Mint)
 	if err != nil {
-		fmt.Printf("FindATAAddress failed: %v\n", err)
+		log.Sugar.Errorf("FindATAAddress failed: %v", err)
 		return false
 	}
 
@@ -457,7 +489,7 @@ func MatchUsdcAtaAddress(address string, ataTo string) bool {
 func MatchAtaAddress(address string, mint string, ataTo string) bool {
 	ata, err := FindATAAddress(address, mint)
 	if err != nil {
-		fmt.Printf("FindATAAddress failed: %v\n", err)
+		log.Sugar.Errorf("FindATAAddress failed: %v", err)
 		return false
 	}
 

src/model/service/task_service.go

@@ -14,7 +14,7 @@ import (
 	"github.com/assimon/luuu/model/data"
 	"github.com/assimon/luuu/model/mdb"
 	"github.com/assimon/luuu/model/request"
-	"github.com/assimon/luuu/telegram"
+	"github.com/assimon/luuu/notify"
 	"github.com/assimon/luuu/util/constant"
 	"github.com/assimon/luuu/util/http_client"
 	"github.com/assimon/luuu/util/log"
@@ -26,7 +26,20 @@ import (
 	"github.com/tidwall/gjson"
 )
 
-const TRC20_USDT_ID = "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t"
+// tronNodeDefault is the fallback when no rpc_nodes row exists for TRON.
+const tronNodeDefault = "https://api.trongrid.io"
+
+// resolveTronNode returns (baseURL, apiKey) for the TRON HTTP RPC node.
+// It reads the first healthy (or any enabled) row from the rpc_nodes table;
+// if none exists it falls back to the hard-coded default URL and the
+// tron_grid_api_key value from .env (config.TRON_GRID_API_KEY).
+func resolveTronNode() (string, string) {
+	node, err := data.SelectRpcNode(mdb.NetworkTron, mdb.RpcNodeTypeHttp)
+	if err == nil && node != nil && node.ID > 0 {
+		return strings.TrimRight(node.Url, "/"), node.ApiKey
+	}
+	return tronNodeDefault, config.TRON_GRID_API_KEY
+}
 
 func Trc20CallBack(address string, wg *sync.WaitGroup) {
 	defer wg.Done()
@@ -45,16 +58,29 @@ func Trc20CallBack(address string, wg *sync.WaitGroup) {
 
 func checkTrxTransfers(address string, wg *sync.WaitGroup) {
 	defer wg.Done()
-	defer func() {
+
-		if err := recover(); err != nil {
+	// Native TRX is gated by a chain_tokens row with empty
-			log.Sugar.Errorf("[TRX][%s] panic recovered: %v", address, err)
+	// contract_address and symbol=TRX. Admin can disable this row to
-		}
+	// stop scanning native transfers without touching the chain toggle.
-	}()
+	trxCfg, err := data.GetEnabledChainTokenBySymbol(mdb.NetworkTron, "TRX")
+	if err != nil {
+		log.Sugar.Errorf("[TRX][%s] load chain_tokens err=%v", address, err)
+		return
+	}
+	if trxCfg == nil || trxCfg.ID == 0 {
+		log.Sugar.Debugf("[TRX][%s] native TRX disabled in chain_tokens, skipping", address)
+		return
+	}
+	trxDecimals := trxCfg.Decimals
+	if trxDecimals <= 0 {
+		trxDecimals = 6
+	}
 
 	client := http_client.GetHttpClient()
 	startTime := carbon.Now().AddHours(-24).TimestampMilli()
 	endTime := carbon.Now().TimestampMilli()
-	url := fmt.Sprintf("https://api.trongrid.io/v1/accounts/%s/transactions", address)
+	tronBaseURL, tronAPIKey := resolveTronNode()
+	url := fmt.Sprintf("%s/v1/accounts/%s/transactions", tronBaseURL, address)
 
 	resp, err := client.R().SetQueryParams(map[string]string{
 		"order_by":      "block_timestamp,desc",
@@ -62,17 +88,20 @@ func checkTrxTransfers(address string, wg *sync.WaitGroup) {
 		"only_to":       "true",
 		"min_timestamp": stdutil.ToString(startTime),
 		"max_timestamp": stdutil.ToString(endTime),
-	}).SetHeader("TRON-PRO-API-KEY", config.TRON_GRID_API_KEY).Get(url)
+	}).SetHeader("TRON-PRO-API-KEY", tronAPIKey).Get(url)
 	if err != nil {
-		panic(err)
+		log.Sugar.Errorf("[TRX][%s] HTTP request failed: %v", address, err)
+		return
 	}
 	if resp.StatusCode() != http.StatusOK {
-		panic(fmt.Sprintf("TRX API returned status %d", resp.StatusCode()))
+		log.Sugar.Errorf("[TRX][%s] API returned status %d", address, resp.StatusCode())
+		return
 	}
 
 	success := gjson.GetBytes(resp.Body(), "success").Bool()
 	if !success {
-		panic("TRX API response indicates failure")
+		log.Sugar.Errorf("[TRX][%s] API response indicates failure", address)
+		return
 	}
 
 	transfers := gjson.GetBytes(resp.Body(), "data").Array()
@@ -106,15 +135,19 @@ func checkTrxTransfers(address string, wg *sync.WaitGroup) {
 			log.Sugar.Errorf("[TRX][%s] parse amount failed on tx #%d: %v", address, i, err)
 			continue
 		}
-		amount := math.MustParsePrecFloat64(decimalQuant.Div(decimal.NewFromInt(1000000)).InexactFloat64(), 2)
+		amount := math.MustParsePrecFloat64(decimalQuant.Div(decimal.New(1, int32(trxDecimals))).InexactFloat64(), 2)
+		if trxCfg.MinAmount > 0 && amount < trxCfg.MinAmount {
+			continue
+		}
 		if amount <= 0 {
 			continue
 		}
 
 		txID := transfer.Get("txID").String()
-		tradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTron, address, "TRX", amount)
+		tradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTron, address, strings.ToUpper(strings.TrimSpace(trxCfg.Symbol)), amount)
 		if err != nil {
-			panic(err)
+			log.Sugar.Errorf("[TRX][%s] lookup trade_id failed hash=%s err=%v", address, txID, err)
+			continue
 		}
 		if tradeID == "" {
 			log.Sugar.Debugf("[TRX][%s] skip unmatched tx hash=%s amount=%.2f", address, txID, amount)
@@ -124,7 +157,8 @@ func checkTrxTransfers(address string, wg *sync.WaitGroup) {
 
 		order, err := data.GetOrderInfoByTradeId(tradeID)
 		if err != nil {
-			panic(err)
+			log.Sugar.Errorf("[TRX][%s] get order failed trade_id=%s err=%v", address, tradeID, err)
+			continue
 		}
 		blockTimestamp := transfer.Get("block_timestamp").Int()
 		createTime := order.CreatedAt.TimestampMilli()
@@ -135,7 +169,7 @@ func checkTrxTransfers(address string, wg *sync.WaitGroup) {
 
 		req := &request.OrderProcessingRequest{
 			ReceiveAddress:     address,
-			Token:              "TRX",
+			Token:              strings.ToUpper(strings.TrimSpace(trxCfg.Symbol)),
 			Network:            mdb.NetworkTron,
 			TradeId:            tradeID,
 			Amount:             amount,
@@ -147,7 +181,8 @@ func checkTrxTransfers(address string, wg *sync.WaitGroup) {
 				log.Sugar.Infof("[TRX][%s] skip resolved transfer trade_id=%s hash=%s err=%v", address, tradeID, txID, err)
 				continue
 			}
-			panic(err)
+			log.Sugar.Errorf("[TRX][%s] order processing failed trade_id=%s hash=%s err=%v", address, tradeID, txID, err)
+			continue
 		}
 
 		sendPaymentNotification(order)
@@ -157,16 +192,33 @@ func checkTrxTransfers(address string, wg *sync.WaitGroup) {
 
 func checkTrc20Transfers(address string, wg *sync.WaitGroup) {
 	defer wg.Done()
-	defer func() {
+
-		if err := recover(); err != nil {
+	// Build contract -> token map for the TRON network. If nothing is
-			log.Sugar.Errorf("[TRC20][%s] panic recovered: %v", address, err)
+	// configured, skip — preserves the previous behavior of only watching
+	// admin-approved tokens.
+	tokens, err := data.ListEnabledChainTokensByNetwork(mdb.NetworkTron)
+	if err != nil {
+		log.Sugar.Errorf("[TRC20][%s] load chain_tokens err=%v", address, err)
+		return
+	}
+	if len(tokens) == 0 {
+		log.Sugar.Debugf("[TRC20][%s] no enabled chain_tokens, skipping", address)
+		return
+	}
+	contractTokens := make(map[string]*mdb.ChainToken, len(tokens))
+	for i := range tokens {
+		c := strings.TrimSpace(tokens[i].ContractAddress)
+		if c == "" {
+			continue
 		}
-	}()
+		contractTokens[c] = &tokens[i]
+	}
 
 	client := http_client.GetHttpClient()
 	startTime := carbon.Now().AddHours(-24).TimestampMilli()
 	endTime := carbon.Now().TimestampMilli()
-	url := fmt.Sprintf("https://api.trongrid.io/v1/accounts/%s/transactions/trc20", address)
+	tronBaseURL, tronAPIKey := resolveTronNode()
+	url := fmt.Sprintf("%s/v1/accounts/%s/transactions/trc20", tronBaseURL, address)
 
 	resp, err := client.R().SetQueryParams(map[string]string{
 		"order_by":      "block_timestamp,desc",
@@ -174,17 +226,20 @@ func checkTrc20Transfers(address string, wg *sync.WaitGroup) {
 		"only_to":       "true",
 		"min_timestamp": stdutil.ToString(startTime),
 		"max_timestamp": stdutil.ToString(endTime),
-	}).SetHeader("TRON-PRO-API-KEY", config.TRON_GRID_API_KEY).Get(url)
+	}).SetHeader("TRON-PRO-API-KEY", tronAPIKey).Get(url)
 	if err != nil {
-		panic(err)
+		log.Sugar.Errorf("[TRC20][%s] HTTP request failed: %v", address, err)
+		return
 	}
 	if resp.StatusCode() != http.StatusOK {
-		panic(fmt.Sprintf("TRC20 API returned status %d", resp.StatusCode()))
+		log.Sugar.Errorf("[TRC20][%s] API returned status %d", address, resp.StatusCode())
+		return
 	}
 
 	success := gjson.GetBytes(resp.Body(), "success").Bool()
 	if !success {
-		panic("TRC20 API response indicates failure")
+		log.Sugar.Errorf("[TRC20][%s] API response indicates failure", address)
+		return
 	}
 
 	transfers := gjson.GetBytes(resp.Body(), "data").Array()
@@ -195,12 +250,15 @@ func checkTrc20Transfers(address string, wg *sync.WaitGroup) {
 	log.Sugar.Debugf("[TRC20][%s] fetched %d transfer records", address, len(transfers))
 
 	for i, transfer := range transfers {
-		if transfer.Get("token_info.address").String() != TRC20_USDT_ID {
+		contractAddr := transfer.Get("token_info.address").String()
+		cfg, ok := contractTokens[contractAddr]
+		if !ok {
 			continue
 		}
 		if transfer.Get("to").String() != address {
 			continue
 		}
+		tokenSym := strings.ToUpper(strings.TrimSpace(cfg.Symbol))
 
 		valueStr := transfer.Get("value").String()
 		decimalQuant, err := decimal.NewFromString(valueStr)
@@ -209,25 +267,33 @@ func checkTrc20Transfers(address string, wg *sync.WaitGroup) {
 			continue
 		}
 		tokenDecimals := transfer.Get("token_info.decimals").Int()
+		if tokenDecimals <= 0 {
+			tokenDecimals = int64(cfg.Decimals)
+		}
 		amount := math.MustParsePrecFloat64(decimalQuant.Div(decimal.New(1, int32(tokenDecimals))).InexactFloat64(), 2)
+		if cfg.MinAmount > 0 && amount < cfg.MinAmount {
+			continue
+		}
 		if amount <= 0 {
 			continue
 		}
 
 		txID := transfer.Get("transaction_id").String()
-		tradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTron, address, "USDT", amount)
+		tradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTron, address, tokenSym, amount)
 		if err != nil {
-			panic(err)
+			log.Sugar.Errorf("[TRC20][%s] lookup trade_id failed hash=%s err=%v", address, txID, err)
-		}
-		if tradeID == "" {
-			log.Sugar.Debugf("[TRC20][%s] skip unmatched tx hash=%s amount=%.2f", address, txID, amount)
 			continue
 		}
-		log.Sugar.Infof("[TRC20][%s] matched trade_id=%s hash=%s amount=%.2f", address, tradeID, txID, amount)
+		if tradeID == "" {
+			log.Sugar.Debugf("[TRC20][%s] skip unmatched %s tx hash=%s amount=%.2f", address, tokenSym, txID, amount)
+			continue
+		}
+		log.Sugar.Infof("[TRC20][%s] matched %s trade_id=%s hash=%s amount=%.2f", address, tokenSym, tradeID, txID, amount)
 
 		order, err := data.GetOrderInfoByTradeId(tradeID)
 		if err != nil {
-			panic(err)
+			log.Sugar.Errorf("[TRC20][%s] get order failed trade_id=%s err=%v", address, tradeID, err)
+			continue
 		}
 		blockTimestamp := transfer.Get("block_timestamp").Int()
 		createTime := order.CreatedAt.TimestampMilli()
@@ -238,7 +304,7 @@ func checkTrc20Transfers(address string, wg *sync.WaitGroup) {
 
 		req := &request.OrderProcessingRequest{
 			ReceiveAddress:     address,
-			Token:              "USDT",
+			Token:              tokenSym,
 			Network:            mdb.NetworkTron,
 			TradeId:            tradeID,
 			Amount:             amount,
@@ -250,7 +316,8 @@ func checkTrc20Transfers(address string, wg *sync.WaitGroup) {
 				log.Sugar.Infof("[TRC20][%s] skip resolved transfer trade_id=%s hash=%s err=%v", address, tradeID, txID, err)
 				continue
 			}
-			panic(err)
+			log.Sugar.Errorf("[TRC20][%s] order processing failed trade_id=%s hash=%s err=%v", address, tradeID, txID, err)
+			continue
 		}
 
 		sendPaymentNotification(order)
@@ -273,7 +340,9 @@ func evmChainLogLabel(chainNetwork string) string {
 	}
 }
 
-// TryProcessEvmERC20Transfer 处理各 EVM 链上 USDT/USDC（及 Polygon USDC.e）的 Transfer 入账（合约与 network 需一致）。
+// TryProcessEvmERC20Transfer 处理各 EVM 链上代币的 Transfer 入账。
+// 代币识别、符号和 decimals 全部从 chain_tokens 表动态查询 —
+// 管理后台新增 token 即可立即生效，无需代码改动。
 func TryProcessEvmERC20Transfer(chainNetwork string, contract common.Address, toAddr common.Address, rawValue *big.Int, txHash string, blockTsMs int64) {
 	defer func() {
 		if err := recover(); err != nil {
@@ -281,46 +350,38 @@ func TryProcessEvmERC20Transfer(chainNetwork string, contract common.Address, to
 		}
 	}()
 
-	var usdt, usdc common.Address
-	var polygonUsdcE common.Address
-	switch chainNetwork {
-	case mdb.NetworkEthereum:
-		usdt = common.HexToAddress("0xdAC17F958D2ee523a2206206994597C13D831ec7")
-		usdc = common.HexToAddress("0xA0b86991c6218b36c1d19d4a2e9eb0ce3606eb48")
-	case mdb.NetworkBsc:
-		usdt = common.HexToAddress("0x55d398326f99059fF775485246999027B3197955")
-		usdc = common.HexToAddress("0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d")
-	case mdb.NetworkPolygon:
-		usdt = common.HexToAddress("0xc2132D05D31c914a87C6611C10748AEb04B58e8F")
-		usdc = common.HexToAddress("0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359")
-		polygonUsdcE = common.HexToAddress("0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174")
-	case mdb.NetworkPlasma:
-		// USDT0（官方），6 decimals；链上暂无与 ETH 同级的 Circle USDC 部署，仅匹配 USDT 订单
-		usdt = common.HexToAddress("0xB8CE59FC3717ada4C02eaDF9682A9e934F625ebb")
-	default:
-		return
-	}
-
-	var tokenSym string
-	switch {
-	case contract == usdt:
-		tokenSym = "USDT"
-	case contract == usdc || (polygonUsdcE != (common.Address{}) && contract == polygonUsdcE):
-		tokenSym = "USDC"
-	default:
-		net := evmChainLogLabel(chainNetwork)
-		log.Sugar.Warnf("[%s-WS] skip unsupported contract %s", net, contract.Hex())
-		return
-	}
-
 	net := evmChainLogLabel(chainNetwork)
+	token, err := data.GetEnabledChainTokenByContract(chainNetwork, contract.Hex())
+	if err != nil {
+		log.Sugar.Warnf("[%s-WS] chain_tokens lookup err=%v contract=%s", net, err, contract.Hex())
+		return
+	}
+	if token == nil || token.ID == 0 {
+		log.Sugar.Debugf("[%s-WS] skip unconfigured contract %s", net, contract.Hex())
+		return
+	}
+	tokenSym := strings.ToUpper(strings.TrimSpace(token.Symbol))
+	if tokenSym == "" {
+		log.Sugar.Warnf("[%s-WS] chain_token id=%d has empty symbol", net, token.ID)
+		return
+	}
+	decimals := token.Decimals
+	if decimals <= 0 {
+		decimals = 6
+	}
+
 	walletAddr := strings.ToLower(toAddr.Hex())
 	if rawValue == nil || rawValue.Sign() <= 0 {
 		log.Sugar.Infof("[%s-%s][%s] skip non-positive or nil amount", net, tokenSym, walletAddr)
 		return
 	}
+	divisor := decimal.New(1, int32(decimals))
 	decimalQuant := decimal.NewFromBigInt(rawValue, 0)
-	amount := math.MustParsePrecFloat64(decimalQuant.Div(decimal.NewFromInt(1_000_000)).InexactFloat64(), 2)
+	amount := math.MustParsePrecFloat64(decimalQuant.Div(divisor).InexactFloat64(), 2)
+	if token.MinAmount > 0 && amount < token.MinAmount {
+		log.Sugar.Debugf("[%s-%s][%s] skip amount %.2f below min_amount %.2f", net, tokenSym, walletAddr, amount, token.MinAmount)
+		return
+	}
 	if amount <= 0 {
 		log.Sugar.Warnf("[%s-%s][%s] skip non-positive amount %.2f", net, tokenSym, walletAddr, amount)
 		return
@@ -351,6 +412,11 @@ func TryProcessEvmERC20Transfer(chainNetwork string, contract common.Address, to
 		log.Sugar.Warnf("[%s-%s][%s] skip trade_id=%s token mismatch order=%s", net, tokenSym, walletAddr, tradeID, order.Token)
 		return
 	}
+	if blockTsMs > 0 && blockTsMs < order.CreatedAt.TimestampMilli() {
+		log.Sugar.Warnf("[%s-%s][%s] skip tx %s because block_time_ms=%d is before order created_ms=%d",
+			net, tokenSym, walletAddr, txHash, blockTsMs, order.CreatedAt.TimestampMilli())
+		return
+	}
 
 	req := &request.OrderProcessingRequest{
 		ReceiveAddress:     walletAddr,
@@ -374,80 +440,6 @@ func TryProcessEvmERC20Transfer(chainNetwork string, contract common.Address, to
 	log.Sugar.Infof("[%s-%s][%s] payment processed trade_id=%s hash=%s", net, tokenSym, walletAddr, tradeID, txHash)
 }
 
-// TryProcessTronTRC20Transfer 处理 Tron 链上 TRC20-USDT 的 Transfer 入账。
-func TryProcessTronTRC20Transfer(toAddr string, rawValue *big.Int, txHash string, blockTsMs int64) {
-	defer func() {
-		if err := recover(); err != nil {
-			log.Sugar.Errorf("[TRON-WS] TryProcessTronTRC20Transfer panic: %v", err)
-		}
-	}()
-
-	walletAddr := strings.TrimSpace(toAddr)
-	if walletAddr == "" {
-		return
-	}
-	if rawValue == nil || rawValue.Sign() <= 0 {
-		log.Sugar.Infof("[TRON-USDT][%s] skip non-positive or nil amount", walletAddr)
-		return
-	}
-
-	decimalQuant := decimal.NewFromBigInt(rawValue, 0)
-	amount := math.MustParsePrecFloat64(decimalQuant.Div(decimal.NewFromInt(1_000_000)).InexactFloat64(), 2)
-	if amount <= 0 {
-		log.Sugar.Warnf("[TRON-USDT][%s] skip non-positive amount %.2f", walletAddr, amount)
-		return
-	}
-
-	tradeID, err := data.GetTradeIdByWalletAddressAndAmountAndToken(mdb.NetworkTron, walletAddr, "USDT", amount)
-	if err != nil {
-		log.Sugar.Warnf("[TRON-USDT][%s] lock lookup: %v", walletAddr, err)
-		return
-	}
-	if tradeID == "" {
-		log.Sugar.Debugf("[TRON-USDT][%s] skip unmatched tx hash=%s amount=%.2f", walletAddr, txHash, amount)
-		return
-	}
-
-	order, err := data.GetOrderInfoByTradeId(tradeID)
-	if err != nil {
-		log.Sugar.Warnf("[TRON-USDT][%s] load order: %v", walletAddr, err)
-		return
-	}
-	if blockTsMs > 0 && blockTsMs < order.CreatedAt.TimestampMilli() {
-		log.Sugar.Warnf("[TRON-USDT][%s] skip tx %s because block time %d is before order create time %d", walletAddr, txHash, blockTsMs, order.CreatedAt.TimestampMilli())
-		return
-	}
-	if strings.ToLower(strings.TrimSpace(order.Network)) != mdb.NetworkTron {
-		log.Sugar.Warnf("[TRON-USDT][%s] skip trade_id=%s network=%q", walletAddr, tradeID, order.Network)
-		return
-	}
-	if strings.ToUpper(strings.TrimSpace(order.Token)) != "USDT" {
-		log.Sugar.Warnf("[TRON-USDT][%s] skip trade_id=%s token mismatch order=%s", walletAddr, tradeID, order.Token)
-		return
-	}
-
-	req := &request.OrderProcessingRequest{
-		ReceiveAddress:     walletAddr,
-		Token:              "USDT",
-		Network:            mdb.NetworkTron,
-		TradeId:            tradeID,
-		Amount:             amount,
-		BlockTransactionId: txHash,
-	}
-	err = OrderProcessing(req)
-	if err != nil {
-		if errors.Is(err, constant.OrderBlockAlreadyProcess) || errors.Is(err, constant.OrderStatusConflict) {
-			log.Sugar.Infof("[TRON-USDT][%s] skip resolved trade_id=%s hash=%s err=%v", walletAddr, tradeID, txHash, err)
-			return
-		}
-		log.Sugar.Errorf("[TRON-USDT][%s] OrderProcessing: %v", walletAddr, err)
-		return
-	}
-
-	sendPaymentNotification(order)
-	log.Sugar.Infof("[TRON-USDT][%s] payment processed trade_id=%s hash=%s", walletAddr, tradeID, txHash)
-}
-
 func sendPaymentNotification(order *mdb.Orders) {
 	msg := fmt.Sprintf(
 		"🎉 <b>收款成功通知</b>\n\n"+
@@ -473,7 +465,7 @@ func sendPaymentNotification(order *mdb.Orders) {
 		order.CreatedAt.ToDateTimeString(),
 		carbon.Now().ToDateTimeString(),
 	)
-	telegram.SendToBot(msg)
+	notify.Dispatch(mdb.NotifyEventPaySuccess, msg)
 }
 
 func networkDisplay(n string) string {

src/model/service/task_tron_test.go

@@ -0,0 +1,92 @@
+package service
+
+import (
+	"testing"
+
+	"github.com/assimon/luuu/config"
+	"github.com/assimon/luuu/internal/testutil"
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/mdb"
+)
+
+// TestResolveTronNode_NoRow verifies that resolveTronNode falls back to the
+// hard-coded default when the rpc_nodes table has no TRON row.
+func TestResolveTronNode_NoRow(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	config.TRON_GRID_API_KEY = "fallback-key"
+
+	gotURL, gotKey := resolveTronNode()
+	if gotURL != tronNodeDefault {
+		t.Errorf("url = %q, want %q", gotURL, tronNodeDefault)
+	}
+	if gotKey != "fallback-key" {
+		t.Errorf("apiKey = %q, want \"fallback-key\"", gotKey)
+	}
+}
+
+// TestResolveTronNode_WithRow verifies that resolveTronNode uses the DB row
+// when an enabled TRON HTTP node is present.
+func TestResolveTronNode_WithRow(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	config.TRON_GRID_API_KEY = "fallback-key"
+
+	// Insert an enabled TRON http node.
+	node := &mdb.RpcNode{
+		Network: mdb.NetworkTron,
+		Url:     "https://custom-tron.example.com",
+		Type:    mdb.RpcNodeTypeHttp,
+		ApiKey:  "db-api-key",
+		Weight:  1,
+		Enabled: true,
+		Status:  mdb.RpcNodeStatusOk,
+	}
+	if err := dao.Mdb.Create(node).Error; err != nil {
+		t.Fatalf("seed rpc_node: %v", err)
+	}
+
+	gotURL, gotKey := resolveTronNode()
+	if gotURL != "https://custom-tron.example.com" {
+		t.Errorf("url = %q, want https://custom-tron.example.com", gotURL)
+	}
+	if gotKey != "db-api-key" {
+		t.Errorf("apiKey = %q, want \"db-api-key\"", gotKey)
+	}
+}
+
+// TestResolveTronNode_DisabledRow verifies that a disabled row is ignored and
+// the fallback is used.
+func TestResolveTronNode_DisabledRow(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	config.TRON_GRID_API_KEY = "fallback-key"
+
+	node := &mdb.RpcNode{
+		Network: mdb.NetworkTron,
+		Url:     "https://disabled-tron.example.com",
+		Type:    mdb.RpcNodeTypeHttp,
+		ApiKey:  "disabled-key",
+		Weight:  1,
+		Enabled: true, // start enabled, then disable below
+		Status:  mdb.RpcNodeStatusOk,
+	}
+	if err := dao.Mdb.Create(node).Error; err != nil {
+		t.Fatalf("seed rpc_node: %v", err)
+	}
+	// Explicitly disable — GORM does not save bool zero-value on Create.
+	if err := dao.Mdb.Model(node).Update("enabled", false).Error; err != nil {
+		t.Fatalf("disable rpc_node: %v", err)
+	}
+
+	gotURL, gotKey := resolveTronNode()
+	if gotURL != tronNodeDefault {
+		t.Errorf("url = %q, want %q (disabled row should be ignored)", gotURL, tronNodeDefault)
+	}
+	if gotKey != "fallback-key" {
+		t.Errorf("apiKey = %q, want \"fallback-key\"", gotKey)
+	}
+}

src/mq/worker.go

@@ -3,9 +3,8 @@ package mq
 import (
 	"errors"
 	"fmt"
-	"io"
 	"net/http"
-	"net/url"
+	"strconv"
 	"strings"
 	"time"
 
@@ -19,6 +18,29 @@ import (
 	"github.com/assimon/luuu/util/sign"
 )
 
+// resolveOrderApiKey returns the api_keys row that signed the order.
+// Every order must carry an ApiKeyID (the default key is always seeded
+// at bootstrap, and the middleware/EPAY inline flow always stamps it).
+// If the row is missing or disabled, we return an error — using any
+// other secret would produce a signature the merchant can't verify.
+// The admin can resend the callback after fixing the key.
+func resolveOrderApiKey(order *mdb.Orders) (*mdb.ApiKey, error) {
+	if order.ApiKeyID == 0 {
+		return nil, fmt.Errorf("order trade_id=%s has no api_key_id", order.TradeId)
+	}
+	row, err := data.GetApiKeyByID(order.ApiKeyID)
+	if err != nil {
+		return nil, fmt.Errorf("lookup api_key_id=%d: %w", order.ApiKeyID, err)
+	}
+	if row.ID == 0 {
+		return nil, fmt.Errorf("api_key_id=%d not found (deleted?)", order.ApiKeyID)
+	}
+	if row.Status != mdb.ApiKeyStatusEnable {
+		return nil, fmt.Errorf("api_key_id=%d is disabled", order.ApiKeyID)
+	}
+	return row, nil
+}
+
 const batchSize = 100
 
 const sqliteBusyRetryAttempts = 3
@@ -165,56 +187,62 @@ func processCallback(tradeID string) {
 }
 
 func sendOrderCallback(order *mdb.Orders) error {
+	apiKeyRow, err := resolveOrderApiKey(order)
+	if err != nil || apiKeyRow == nil || apiKeyRow.ID == 0 {
+		return errors.New("no api key row available for callback")
+	}
 
 	switch order.PaymentType {
 	case mdb.PaymentTypeEpay:
-		// 构造 EPay 标准回调参数
+		// EPAY uses pid (integer) and secret_key as "key".
+		pidInt, convErr := strconv.Atoi(apiKeyRow.Pid)
+		if convErr != nil {
+			return fmt.Errorf("epay pid not numeric: %s", apiKeyRow.Pid)
+		}
 		notifyData := response.OrderNotifyResponseEpay{
-			PID:        config.GetEpayPid(),
+			PID:         pidInt,
-			TradeNo:    order.TradeId, // epusdt 订单号作为 EPay 平台订单号
+			TradeNo:     order.TradeId,
-			OutTradeNo: order.OrderId, // 注意：EPay 回调要求商户订单号使用 out_trade_no 参数
+			OutTradeNo:  order.OrderId,
-
 			Type:        "alipay",
 			Name:        order.Name,
 			Money:       fmt.Sprintf("%.4f", order.Amount),
 			TradeStatus: "TRADE_SUCCESS",
 		}
 
-		signstr2, err := sign.Get(notifyData, config.GetEpayKey())
+		signstr2, err := sign.Get(notifyData, apiKeyRow.SecretKey)
 		if err != nil {
 			return err
 		}
 
-		// 使用 form-encoded POST（EPay 标准协议格式）
+		formData := map[string]string{
-		formData := url.Values{
+			"pid":          fmt.Sprintf("%d", notifyData.PID),
-			"pid":          {fmt.Sprintf("%d", notifyData.PID)},
+			"trade_no":     notifyData.TradeNo,
-			"trade_no":     {notifyData.TradeNo},
+			"out_trade_no": notifyData.OutTradeNo,
-			"out_trade_no": {notifyData.OutTradeNo},
+			"type":         notifyData.Type,
-			"type":         {notifyData.Type},
+			"name":         notifyData.Name,
-			"name":         {notifyData.Name},
+			"money":        notifyData.Money,
-			"money":        {notifyData.Money},
+			"trade_status": notifyData.TradeStatus,
-			"trade_status": {notifyData.TradeStatus},
+			"sign":         signstr2,
-			"sign":         {signstr2},
+			"sign_type":    "MD5",
-			"sign_type":    {"MD5"},
 		}
 
-		resp, err := http.PostForm(order.NotifyUrl, formData)
+		epayResp, err := http_client.GetHttpClient().R().SetQueryParams(formData).Get(order.NotifyUrl)
 		if err != nil {
 			return err
 		}
-		defer resp.Body.Close()
+		log.Sugar.Infof("[mq] epay notify_url response status: %d, body: %s", epayResp.StatusCode(), string(epayResp.Body()))
-
+		if epayResp.StatusCode() != http.StatusOK {
-		responseBody, err := io.ReadAll(resp.Body)
+			return errors.New(epayResp.Status())
-		if err != nil {
+		}
-			return err
+		if !isCallbackAck(epayResp.Body()) {
+			return errors.New("not ok")
 		}
-
-		fmt.Printf("notify_url response status: %d, body: %s\n", resp.StatusCode, string(responseBody))
 
 	default:
 
 		client := http_client.GetHttpClient()
 		orderResp := response.OrderNotifyResponse{
+			Pid:                apiKeyRow.Pid,
 			TradeId:            order.TradeId,
 			OrderId:            order.OrderId,
 			Amount:             order.Amount,
@@ -224,7 +252,7 @@ func sendOrderCallback(order *mdb.Orders) error {
 			BlockTransactionId: order.BlockTransactionId,
 			Status:             mdb.StatusPaySuccess,
 		}
-		signature, err := sign.Get(orderResp, config.GetApiAuthToken())
+		signature, err := sign.Get(orderResp, apiKeyRow.SecretKey)
 		if err != nil {
 			return err
 		}
@@ -240,7 +268,7 @@ func sendOrderCallback(order *mdb.Orders) error {
 		if resp.StatusCode() != http.StatusOK {
 			return errors.New(resp.Status())
 		}
-		if string(resp.Body()) != "ok" {
+		if !isCallbackAck(resp.Body()) {
 			return errors.New("not ok")
 		}
 	}
@@ -248,6 +276,11 @@ func sendOrderCallback(order *mdb.Orders) error {
 	return nil
 }
 
+func isCallbackAck(body []byte) bool {
+	ack := strings.ToLower(strings.TrimSpace(string(body)))
+	return ack == "ok" || ack == "success"
+}
+
 func cleanupExpiredTransactionLocks() {
 	if err := data.CleanupExpiredTransactionLocks(); err != nil {
 		log.Sugar.Errorf("[mq] cleanup expired transaction locks failed: %v", err)

src/mq/worker_test.go

@@ -1,6 +1,7 @@
 package mq
 
 import (
+	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -13,6 +14,7 @@ import (
 	"github.com/assimon/luuu/model/dao"
 	"github.com/assimon/luuu/model/data"
 	"github.com/assimon/luuu/model/mdb"
+	"github.com/assimon/luuu/util/sign"
 )
 
 func TestProcessExpiredOrdersExpiresWaitingOrdersAndReleasesLocks(t *testing.T) {
@@ -158,6 +160,7 @@ func TestDispatchPendingCallbacksHonorsBackoffAndPersistsSuccess(t *testing.T) {
 		BlockTransactionId: "block_callback",
 		CallbackNum:        1,
 		CallBackConfirm:    mdb.CallBackConfirmNo,
+		ApiKeyID:           1, // seeded by testutil.SetupTestDatabases
 	}
 	if err := dao.Mdb.Create(order).Error; err != nil {
 		t.Fatalf("create callback order: %v", err)
@@ -218,6 +221,7 @@ func TestDispatchPendingCallbacksResumesRetryAfterRestart(t *testing.T) {
 		BlockTransactionId: "block_callback_restart",
 		CallbackNum:        0,
 		CallBackConfirm:    mdb.CallBackConfirmNo,
+		ApiKeyID:           1, // seeded by testutil.SetupTestDatabases
 	}
 	if err := dao.Mdb.Create(order).Error; err != nil {
 		t.Fatalf("create callback order: %v", err)
@@ -259,6 +263,403 @@ func TestDispatchPendingCallbacksResumesRetryAfterRestart(t *testing.T) {
 	}
 }
 
+func TestDispatchPendingCallbacksEpayRequiresAck(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	callbackLimiter = make(chan struct{}, 1)
+	callbackInflight = sync.Map{}
+
+	epayKey, err := data.GetEnabledApiKey("1001")
+	if err != nil || epayKey == nil || epayKey.ID == 0 {
+		t.Fatalf("load epay key: %v", err)
+	}
+
+	var requestCount int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		atomic.AddInt32(&requestCount, 1)
+		http.Error(w, "fail", http.StatusInternalServerError)
+	}))
+	defer server.Close()
+
+	order := &mdb.Orders{
+		TradeId:            "trade_callback_epay_fail",
+		OrderId:            "order_callback_epay_fail",
+		Amount:             1,
+		Currency:           "CNY",
+		ActualAmount:       1,
+		ReceiveAddress:     "wallet_epay_fail",
+		Token:              "USDT",
+		Status:             mdb.StatusPaySuccess,
+		NotifyUrl:          server.URL,
+		BlockTransactionId: "block_callback_epay_fail",
+		CallbackNum:        0,
+		CallBackConfirm:    mdb.CallBackConfirmNo,
+		PaymentType:        mdb.PaymentTypeEpay,
+		ApiKeyID:           epayKey.ID,
+	}
+	if err := dao.Mdb.Create(order).Error; err != nil {
+		t.Fatalf("create callback order: %v", err)
+	}
+
+	dispatchPendingCallbacks()
+
+	waitFor(t, 3*time.Second, func() bool {
+		current, innerErr := data.GetOrderInfoByTradeId(order.TradeId)
+		if innerErr != nil || current.ID <= 0 {
+			return false
+		}
+		return current.CallBackConfirm == mdb.CallBackConfirmNo && current.CallbackNum == 1
+	})
+
+	if got := atomic.LoadInt32(&requestCount); got != 1 {
+		t.Fatalf("callback request count = %d, want 1", got)
+	}
+}
+
+func TestDispatchPendingCallbacksEpayAcceptsTrimmedOk(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	callbackLimiter = make(chan struct{}, 1)
+	callbackInflight = sync.Map{}
+
+	epayKey, err := data.GetEnabledApiKey("1001")
+	if err != nil || epayKey == nil || epayKey.ID == 0 {
+		t.Fatalf("load epay key: %v", err)
+	}
+
+	var requestCount int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		atomic.AddInt32(&requestCount, 1)
+		_, _ = io.WriteString(w, " ok\n")
+	}))
+	defer server.Close()
+
+	order := &mdb.Orders{
+		TradeId:            "trade_callback_epay_ok",
+		OrderId:            "order_callback_epay_ok",
+		Amount:             1,
+		Currency:           "CNY",
+		ActualAmount:       1,
+		ReceiveAddress:     "wallet_epay_ok",
+		Token:              "USDT",
+		Status:             mdb.StatusPaySuccess,
+		NotifyUrl:          server.URL,
+		BlockTransactionId: "block_callback_epay_ok",
+		CallbackNum:        0,
+		CallBackConfirm:    mdb.CallBackConfirmNo,
+		PaymentType:        mdb.PaymentTypeEpay,
+		ApiKeyID:           epayKey.ID,
+	}
+	if err := dao.Mdb.Create(order).Error; err != nil {
+		t.Fatalf("create callback order: %v", err)
+	}
+
+	dispatchPendingCallbacks()
+
+	waitFor(t, 3*time.Second, func() bool {
+		current, innerErr := data.GetOrderInfoByTradeId(order.TradeId)
+		if innerErr != nil || current.ID <= 0 {
+			return false
+		}
+		return current.CallBackConfirm == mdb.CallBackConfirmOk && current.CallbackNum == 1
+	})
+
+	if got := atomic.LoadInt32(&requestCount); got != 1 {
+		t.Fatalf("callback request count = %d, want 1", got)
+	}
+}
+
+// Orders must always carry an ApiKeyID (the default key is seeded at
+// bootstrap and the signing middleware / EPAY inline flow always
+// stamps it). If ApiKeyID is 0, resolveOrderApiKey returns an error —
+// the callback won't sign with a guess.
+func TestResolveOrderApiKeyRejectsZeroApiKeyID(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	order := &mdb.Orders{
+		TradeId:  "no-api-key-id",
+		ApiKeyID: 0,
+	}
+	if _, err := resolveOrderApiKey(order); err == nil {
+		t.Fatal("expected error for ApiKeyID=0")
+	}
+}
+
+// Happy path: when ApiKeyID points at an enabled row, resolveOrderApiKey
+// returns it.
+func TestResolveOrderApiKeyReturnsEnabledRow(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	row := &mdb.ApiKey{
+		Name:      "target",
+		Pid:       "target-key",
+		SecretKey: "target-secret",
+		Status:    mdb.ApiKeyStatusEnable,
+	}
+	if err := dao.Mdb.Create(row).Error; err != nil {
+		t.Fatalf("create api key: %v", err)
+	}
+	order := &mdb.Orders{
+		TradeId:  "happy-path",
+		ApiKeyID: row.ID,
+	}
+	got, err := resolveOrderApiKey(order)
+	if err != nil {
+		t.Fatalf("resolve: %v", err)
+	}
+	if got == nil || got.ID != row.ID {
+		t.Fatalf("resolved row = %+v, want id=%d", got, row.ID)
+	}
+}
+
+func TestSendOrderCallbackGmpayUsesApiKeySecretByPid(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	key := &mdb.ApiKey{
+		Name:      "gmpay-key",
+		Pid:       "9001",
+		SecretKey: "gmpay-secret-9001",
+		Status:    mdb.ApiKeyStatusEnable,
+	}
+	if err := dao.Mdb.Create(key).Error; err != nil {
+		t.Fatalf("create gmpay api key: %v", err)
+	}
+
+	warningKey := &mdb.ApiKey{
+		Name:      "wrong-key",
+		Pid:       "9002",
+		SecretKey: "wrong-secret-9002",
+		Status:    mdb.ApiKeyStatusEnable,
+	}
+	if err := dao.Mdb.Create(warningKey).Error; err != nil {
+		t.Fatalf("create wrong api key: %v", err)
+	}
+
+	var received map[string]interface{}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		defer r.Body.Close()
+		body, _ := io.ReadAll(r.Body)
+		_ = json.Unmarshal(body, &received)
+		_, _ = io.WriteString(w, "ok")
+	}))
+	defer server.Close()
+
+	order := &mdb.Orders{
+		TradeId:            "trade_gmpay_sign",
+		OrderId:            "order_gmpay_sign",
+		Amount:             1,
+		Currency:           "CNY",
+		ActualAmount:       1,
+		ReceiveAddress:     "wallet_gmpay",
+		Token:              "USDT",
+		Status:             mdb.StatusPaySuccess,
+		NotifyUrl:          server.URL,
+		BlockTransactionId: "block_gmpay_sign",
+		ApiKeyID:           key.ID,
+	}
+
+	if err := sendOrderCallback(order); err != nil {
+		t.Fatalf("send callback: %v", err)
+	}
+
+	if received == nil {
+		t.Fatal("expected callback payload")
+	}
+	if gotPid, _ := received["pid"].(string); gotPid != key.Pid {
+		t.Fatalf("payload pid = %q, want %q", gotPid, key.Pid)
+	}
+
+	recvSig, _ := received["signature"].(string)
+	if recvSig == "" {
+		t.Fatal("payload signature is empty")
+	}
+	delete(received, "signature")
+
+	calcSig, err := sign.Get(received, key.SecretKey)
+	if err != nil {
+		t.Fatalf("calc signature with target secret: %v", err)
+	}
+	if recvSig != calcSig {
+		t.Fatalf("signature mismatch: got %q want %q", recvSig, calcSig)
+	}
+
+	wrongSig, err := sign.Get(received, warningKey.SecretKey)
+	if err != nil {
+		t.Fatalf("calc signature with wrong secret: %v", err)
+	}
+	if recvSig == wrongSig {
+		t.Fatal("signature should not match wrong api key secret")
+	}
+}
+
+func TestSendOrderCallbackEpayUsesApiKeySecretByPid(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	key := &mdb.ApiKey{
+		Name:      "epay-key",
+		Pid:       "9101",
+		SecretKey: "epay-secret-9101",
+		Status:    mdb.ApiKeyStatusEnable,
+	}
+	if err := dao.Mdb.Create(key).Error; err != nil {
+		t.Fatalf("create epay api key: %v", err)
+	}
+
+	warningKey := &mdb.ApiKey{
+		Name:      "wrong-epay-key",
+		Pid:       "9102",
+		SecretKey: "wrong-epay-secret-9102",
+		Status:    mdb.ApiKeyStatusEnable,
+	}
+	if err := dao.Mdb.Create(warningKey).Error; err != nil {
+		t.Fatalf("create wrong epay api key: %v", err)
+	}
+
+	formPayload := map[string]string{}
+	callbackMethod := ""
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		callbackMethod = r.Method
+		if err := r.ParseForm(); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+		for k, v := range r.Form {
+			if len(v) > 0 {
+				formPayload[k] = v[0]
+			}
+		}
+		_, _ = io.WriteString(w, "ok")
+	}))
+	defer server.Close()
+
+	order := &mdb.Orders{
+		TradeId:            "trade_epay_sign",
+		OrderId:            "order_epay_sign",
+		Amount:             1,
+		Currency:           "CNY",
+		ActualAmount:       1,
+		ReceiveAddress:     "wallet_epay",
+		Token:              "USDT",
+		Name:               "VIP",
+		Status:             mdb.StatusPaySuccess,
+		NotifyUrl:          server.URL,
+		BlockTransactionId: "block_epay_sign",
+		PaymentType:        mdb.PaymentTypeEpay,
+		ApiKeyID:           key.ID,
+	}
+
+	if err := sendOrderCallback(order); err != nil {
+		t.Fatalf("send epay callback: %v", err)
+	}
+
+	if callbackMethod != http.MethodGet {
+		t.Fatalf("callback method = %s, want %s", callbackMethod, http.MethodGet)
+	}
+	if formPayload["sign_type"] != "MD5" {
+		t.Fatalf("sign_type = %q, want MD5", formPayload["sign_type"])
+	}
+	if formPayload["type"] != "alipay" {
+		t.Fatalf("type = %q, want alipay", formPayload["type"])
+	}
+	if formPayload["trade_status"] != "TRADE_SUCCESS" {
+		t.Fatalf("trade_status = %q, want TRADE_SUCCESS", formPayload["trade_status"])
+	}
+
+	if formPayload["pid"] != key.Pid {
+		t.Fatalf("form pid = %q, want %q", formPayload["pid"], key.Pid)
+	}
+	recvSig := formPayload["sign"]
+	if recvSig == "" {
+		t.Fatal("epay sign is empty")
+	}
+
+	signParams := map[string]interface{}{
+		"pid":          formPayload["pid"],
+		"trade_no":     formPayload["trade_no"],
+		"out_trade_no": formPayload["out_trade_no"],
+		"type":         formPayload["type"],
+		"name":         formPayload["name"],
+		"money":        formPayload["money"],
+		"trade_status": formPayload["trade_status"],
+	}
+
+	calcSig, err := sign.Get(signParams, key.SecretKey)
+	if err != nil {
+		t.Fatalf("calc epay signature with target secret: %v", err)
+	}
+	if recvSig != calcSig {
+		t.Fatalf("epay signature mismatch: got %q want %q", recvSig, calcSig)
+	}
+
+	wrongSig, err := sign.Get(signParams, warningKey.SecretKey)
+	if err != nil {
+		t.Fatalf("calc epay signature with wrong secret: %v", err)
+	}
+	if recvSig == wrongSig {
+		t.Fatal("epay signature should not match wrong api key secret")
+	}
+}
+
+func TestDispatchPendingCallbacksEpayAcceptsSuccessAck(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	callbackLimiter = make(chan struct{}, 1)
+	callbackInflight = sync.Map{}
+
+	epayKey, err := data.GetEnabledApiKey("1001")
+	if err != nil || epayKey == nil || epayKey.ID == 0 {
+		t.Fatalf("load epay key: %v", err)
+	}
+
+	var requestCount int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		atomic.AddInt32(&requestCount, 1)
+		_, _ = io.WriteString(w, "success")
+	}))
+	defer server.Close()
+
+	order := &mdb.Orders{
+		TradeId:            "trade_callback_epay_success",
+		OrderId:            "order_callback_epay_success",
+		Amount:             1,
+		Currency:           "CNY",
+		ActualAmount:       1,
+		ReceiveAddress:     "wallet_epay_success",
+		Token:              "USDT",
+		Status:             mdb.StatusPaySuccess,
+		NotifyUrl:          server.URL,
+		BlockTransactionId: "block_callback_epay_success",
+		CallbackNum:        0,
+		CallBackConfirm:    mdb.CallBackConfirmNo,
+		PaymentType:        mdb.PaymentTypeEpay,
+		ApiKeyID:           epayKey.ID,
+	}
+	if err := dao.Mdb.Create(order).Error; err != nil {
+		t.Fatalf("create callback order: %v", err)
+	}
+
+	dispatchPendingCallbacks()
+
+	waitFor(t, 3*time.Second, func() bool {
+		current, innerErr := data.GetOrderInfoByTradeId(order.TradeId)
+		if innerErr != nil || current.ID <= 0 {
+			return false
+		}
+		return current.CallBackConfirm == mdb.CallBackConfirmOk && current.CallbackNum == 1
+	})
+
+	if got := atomic.LoadInt32(&requestCount); got != 1 {
+		t.Fatalf("callback request count = %d, want 1", got)
+	}
+}
+
 func waitFor(t *testing.T, timeout time.Duration, fn func() bool) {
 	t.Helper()
 

src/notify/dispatcher.go

@@ -0,0 +1,70 @@
+// Package notify fans out domain events (order paid, order expired,
+// etc.) to every NotificationChannel subscribed to the event. Senders
+// are type-keyed (telegram/webhook/email/...) so adding a new push
+// method means registering one function; no callers change.
+package notify
+
+import (
+	"encoding/json"
+	"sync"
+
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/assimon/luuu/util/log"
+)
+
+// Sender delivers an already-rendered text message via a channel row.
+// Config is the channel's Config JSON string (type-specific shape).
+type Sender func(config, text string) error
+
+var (
+	sendersMu sync.RWMutex
+	senders   = map[string]Sender{}
+)
+
+// RegisterSender wires a Sender for a channel type. Called once at
+// package init of each sender file (e.g. telegram_sender.go).
+func RegisterSender(channelType string, s Sender) {
+	sendersMu.Lock()
+	senders[channelType] = s
+	sendersMu.Unlock()
+}
+
+func getSender(channelType string) (Sender, bool) {
+	sendersMu.RLock()
+	defer sendersMu.RUnlock()
+	s, ok := senders[channelType]
+	return s, ok
+}
+
+// Dispatch delivers text to every enabled channel subscribed to event.
+// Per-channel failures are logged but don't abort the fan-out — one
+// broken TG token shouldn't prevent webhook delivery.
+func Dispatch(event, text string) {
+	channels, err := data.ListEnabledChannelsByEvent(event)
+	if err != nil {
+		log.Sugar.Errorf("[notify] list channels failed: %v", err)
+		return
+	}
+	for _, ch := range channels {
+		sender, ok := getSender(ch.Type)
+		if !ok {
+			log.Sugar.Warnf("[notify] no sender registered for type=%s (channel_id=%d)", ch.Type, ch.ID)
+			continue
+		}
+		go func(c mdb.NotificationChannel) {
+			if err := sender(c.Config, text); err != nil {
+				log.Sugar.Errorf("[notify] send failed type=%s channel_id=%d: %v", c.Type, c.ID, err)
+			}
+		}(ch)
+	}
+}
+
+// ParseConfig helper for senders: unmarshal channel Config JSON into
+// an arbitrary struct, returning a typed error on invalid JSON.
+func ParseConfig(raw string, out interface{}) error {
+	if raw == "" {
+		return ErrEmptyConfig
+	}
+	return json.Unmarshal([]byte(raw), out)
+}

src/notify/errors.go

@@ -0,0 +1,8 @@
+package notify
+
+import "errors"
+
+var (
+	ErrNoSender    = errors.New("no sender registered for channel type")
+	ErrEmptyConfig = errors.New("channel config is empty")
+)

src/notify/telegram_sender.go

@@ -0,0 +1,147 @@
+package notify
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	tb "gopkg.in/telebot.v3"
+)
+
+// TelegramConfig mirrors the Config JSON of a telegram channel row.
+type TelegramConfig struct {
+	BotToken string `json:"bot_token"`
+	ChatID   int64  `json:"chat_id"`
+	Proxy    string `json:"proxy"`
+}
+
+func init() {
+	RegisterSender("telegram", sendTelegram)
+}
+
+// botCache caches *tb.Bot instances keyed by bot_token so we don't
+// create a new Bot (and call getMe) on every notification.
+var (
+	botCacheMu sync.RWMutex
+	botCache   = map[string]*tb.Bot{}
+)
+
+func getOrCreateBot(cfg *TelegramConfig) (*tb.Bot, error) {
+	botCacheMu.RLock()
+	bot, ok := botCache[cfg.BotToken]
+	botCacheMu.RUnlock()
+	if ok {
+		return bot, nil
+	}
+
+	settings := tb.Settings{
+		Token:       cfg.BotToken,
+		Poller:      &tb.LongPoller{Timeout: 1 * time.Second},
+		Synchronous: true,
+		Offline:     true,
+	}
+	if cfg.Proxy != "" {
+		settings.URL = cfg.Proxy
+	}
+	bot, err := tb.NewBot(settings)
+	if err != nil {
+		return nil, err
+	}
+
+	botCacheMu.Lock()
+	botCache[cfg.BotToken] = bot
+	botCacheMu.Unlock()
+	return bot, nil
+}
+
+// ParseTelegramConfig decodes telegram channel config and supports
+// chat_id in either numeric or string form so API clients can send
+// both JSON number and quoted text.
+func ParseTelegramConfig(raw string) (*TelegramConfig, error) {
+	if strings.TrimSpace(raw) == "" {
+		return nil, ErrEmptyConfig
+	}
+
+	var payload map[string]interface{}
+	if err := json.Unmarshal([]byte(raw), &payload); err != nil {
+		return nil, err
+	}
+
+	cfg := &TelegramConfig{}
+	cfg.BotToken = pickFirstString(payload, "bot_token", "botToken", "bot-token")
+	if cfg.BotToken == "" {
+		return nil, fmt.Errorf("telegram config.bot_token required")
+	}
+
+	chatRaw, ok := pickFirstValue(payload, "chat_id", "chatId", "chat-id")
+	if !ok {
+		return nil, fmt.Errorf("telegram config.chat_id required")
+	}
+	chatID, err := parseTelegramChatID(chatRaw)
+	if err != nil {
+		return nil, err
+	}
+	cfg.ChatID = chatID
+
+	cfg.Proxy = pickFirstString(payload, "proxy", "proxy_url", "proxyUrl")
+
+	return cfg, nil
+}
+
+func pickFirstString(payload map[string]interface{}, keys ...string) string {
+	for _, k := range keys {
+		if v, ok := payload[k].(string); ok {
+			s := strings.TrimSpace(v)
+			if s != "" {
+				return s
+			}
+		}
+	}
+	return ""
+}
+
+func pickFirstValue(payload map[string]interface{}, keys ...string) (interface{}, bool) {
+	for _, k := range keys {
+		if v, ok := payload[k]; ok {
+			return v, true
+		}
+	}
+	return nil, false
+}
+
+func parseTelegramChatID(v interface{}) (int64, error) {
+	switch t := v.(type) {
+	case float64:
+		return int64(t), nil
+	case json.Number:
+		return t.Int64()
+	case string:
+		s := strings.TrimSpace(t)
+		if s == "" {
+			return 0, fmt.Errorf("telegram config.chat_id required")
+		}
+		id, err := strconv.ParseInt(s, 10, 64)
+		if err != nil {
+			return 0, fmt.Errorf("telegram config.chat_id invalid: %w", err)
+		}
+		return id, nil
+	default:
+		return 0, fmt.Errorf("telegram config.chat_id invalid type")
+	}
+}
+
+func sendTelegram(configJSON, text string) error {
+	cfg, err := ParseTelegramConfig(configJSON)
+	if err != nil {
+		return err
+	}
+	bot, err := getOrCreateBot(cfg)
+	if err != nil {
+		return err
+	}
+	_, err = bot.Send(&tb.User{ID: cfg.ChatID}, text, &tb.SendOptions{ParseMode: tb.ModeHTML})
+	return err
+}

src/notify/telegram_sender_test.go

@@ -0,0 +1,53 @@
+package notify
+
+import "testing"
+
+func TestParseTelegramConfigAcceptsNumericChatID(t *testing.T) {
+	raw := `{"bot_token":"123:ABC","chat_id":123456789}`
+	cfg, err := ParseTelegramConfig(raw)
+	if err != nil {
+		t.Fatalf("parse config: %v", err)
+	}
+	if cfg.BotToken != "123:ABC" {
+		t.Fatalf("bot token = %q, want %q", cfg.BotToken, "123:ABC")
+	}
+	if cfg.ChatID != 123456789 {
+		t.Fatalf("chat id = %d, want %d", cfg.ChatID, 123456789)
+	}
+}
+
+func TestParseTelegramConfigAcceptsStringChatID(t *testing.T) {
+	raw := `{"bot_token":"123:ABC","chat_id":"-1001234567890"}`
+	cfg, err := ParseTelegramConfig(raw)
+	if err != nil {
+		t.Fatalf("parse config: %v", err)
+	}
+	if cfg.ChatID != -1001234567890 {
+		t.Fatalf("chat id = %d, want %d", cfg.ChatID, int64(-1001234567890))
+	}
+}
+
+func TestParseTelegramConfigRejectsInvalidChatID(t *testing.T) {
+	raw := `{"bot_token":"123:ABC","chat_id":"not-a-number"}`
+	_, err := ParseTelegramConfig(raw)
+	if err == nil {
+		t.Fatal("expected parse error for invalid chat_id")
+	}
+}
+
+func TestParseTelegramConfigAcceptsCamelCaseKeys(t *testing.T) {
+	raw := `{"botToken":"123:ABC","chatId":"-1001234567890","proxyUrl":"http://127.0.0.1:7890"}`
+	cfg, err := ParseTelegramConfig(raw)
+	if err != nil {
+		t.Fatalf("parse config: %v", err)
+	}
+	if cfg.BotToken != "123:ABC" {
+		t.Fatalf("bot token = %q, want %q", cfg.BotToken, "123:ABC")
+	}
+	if cfg.ChatID != -1001234567890 {
+		t.Fatalf("chat id = %d, want %d", cfg.ChatID, int64(-1001234567890))
+	}
+	if cfg.Proxy != "http://127.0.0.1:7890" {
+		t.Fatalf("proxy = %q, want %q", cfg.Proxy, "http://127.0.0.1:7890")
+	}
+}

src/route/admin_router_test.go

@@ -0,0 +1,806 @@
+package route
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/labstack/echo/v4"
+)
+
+const (
+	testAdminUsername = "admin"
+	testAdminPassword = "test-admin-pass-123"
+)
+
+// setupAdminTestEnv sets up the test environment with a seeded admin user
+// and returns the echo instance and a valid JWT token.
+func setupAdminTestEnv(t *testing.T) (*echo.Echo, string) {
+	t.Helper()
+	e := setupTestEnv(t)
+
+	// Seed admin user with a known password.
+	hash, err := data.HashPassword(testAdminPassword)
+	if err != nil {
+		t.Fatalf("HashPassword: %v", err)
+	}
+	dao.Mdb.Create(&mdb.AdminUser{
+		Username:     testAdminUsername,
+		PasswordHash: hash,
+		Status:       mdb.AdminUserStatusEnable,
+	})
+
+	// Login to obtain a JWT for subsequent authenticated requests.
+	token := adminLogin(t, e, testAdminUsername, testAdminPassword)
+	return e, token
+}
+
+// adminLogin performs a login request and returns the JWT token.
+func adminLogin(t *testing.T, e *echo.Echo, username, password string) string {
+	t.Helper()
+	body := map[string]interface{}{
+		"username": username,
+		"password": password,
+	}
+	rec := doPost(e, "/admin/api/v1/auth/login", body)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("login failed: status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var resp map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("login unmarshal: %v", err)
+	}
+	dataObj, ok := resp["data"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("login response missing data field: %s", rec.Body.String())
+	}
+	token, ok := dataObj["token"].(string)
+	if !ok || token == "" {
+		t.Fatalf("login response missing token: %s", rec.Body.String())
+	}
+	return token
+}
+
+// doGetAdmin sends an authenticated GET request with a Bearer JWT.
+func doGetAdmin(e *echo.Echo, path, token string) *httptest.ResponseRecorder {
+	req := httptest.NewRequest(http.MethodGet, path, nil)
+	req.Header.Set(echo.HeaderAuthorization, "Bearer "+token)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	return rec
+}
+
+// doPostAdmin sends an authenticated POST request with a Bearer JWT.
+func doPostAdmin(e *echo.Echo, path string, body map[string]interface{}, token string) *httptest.ResponseRecorder {
+	jsonBytes, _ := json.Marshal(body)
+	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(string(jsonBytes)))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	req.Header.Set(echo.HeaderAuthorization, "Bearer "+token)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	return rec
+}
+
+// doPatchAdmin sends an authenticated PATCH request with a Bearer JWT.
+func doPatchAdmin(e *echo.Echo, path string, body map[string]interface{}, token string) *httptest.ResponseRecorder {
+	jsonBytes, _ := json.Marshal(body)
+	req := httptest.NewRequest(http.MethodPatch, path, strings.NewReader(string(jsonBytes)))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	req.Header.Set(echo.HeaderAuthorization, "Bearer "+token)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	return rec
+}
+
+// doDeleteAdmin sends an authenticated DELETE request with a Bearer JWT.
+func doDeleteAdmin(e *echo.Echo, path, token string) *httptest.ResponseRecorder {
+	req := httptest.NewRequest(http.MethodDelete, path, nil)
+	req.Header.Set(echo.HeaderAuthorization, "Bearer "+token)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	return rec
+}
+
+// doPutAdmin sends an authenticated PUT request with a Bearer JWT.
+func doPutAdmin(e *echo.Echo, path string, body map[string]interface{}, token string) *httptest.ResponseRecorder {
+	jsonBytes, _ := json.Marshal(body)
+	req := httptest.NewRequest(http.MethodPut, path, strings.NewReader(string(jsonBytes)))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	req.Header.Set(echo.HeaderAuthorization, "Bearer "+token)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	return rec
+}
+
+// assertOK asserts the response status is 200 and the status_code field is 200.
+func assertOK(t *testing.T, rec *httptest.ResponseRecorder) map[string]interface{} {
+	t.Helper()
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", rec.Code, rec.Body.String())
+	}
+	var resp map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("unmarshal response: %v", err)
+	}
+	code, _ := resp["status_code"].(float64)
+	if code != 200 {
+		t.Fatalf("expected status_code=200, got %v: %s", code, rec.Body.String())
+	}
+	return resp
+}
+
+// assertUnauthorized asserts that a request without a valid JWT returns 401.
+func assertUnauthorized(t *testing.T, rec *httptest.ResponseRecorder) {
+	t.Helper()
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d: %s", rec.Code, rec.Body.String())
+	}
+}
+
+// TestAdminLogin_Success verifies correct credentials return 200 + JWT.
+func TestAdminLogin_Success(t *testing.T) {
+	e := setupTestEnv(t)
+	hash, _ := data.HashPassword(testAdminPassword)
+	dao.Mdb.Create(&mdb.AdminUser{
+		Username:     testAdminUsername,
+		PasswordHash: hash,
+		Status:       mdb.AdminUserStatusEnable,
+	})
+
+	rec := doPost(e, "/admin/api/v1/auth/login", map[string]interface{}{
+		"username": testAdminUsername,
+		"password": testAdminPassword,
+	})
+	t.Logf("Login response: %s", rec.Body.String())
+
+	resp := assertOK(t, rec)
+	dataObj, _ := resp["data"].(map[string]interface{})
+	if dataObj["token"] == "" || dataObj["token"] == nil {
+		t.Fatal("expected non-empty token in login response")
+	}
+}
+
+// TestAdminLogin_WrongPassword verifies wrong credentials return 4xx.
+func TestAdminLogin_WrongPassword(t *testing.T) {
+	e := setupTestEnv(t)
+	hash, _ := data.HashPassword(testAdminPassword)
+	dao.Mdb.Create(&mdb.AdminUser{
+		Username:     testAdminUsername,
+		PasswordHash: hash,
+		Status:       mdb.AdminUserStatusEnable,
+	})
+
+	rec := doPost(e, "/admin/api/v1/auth/login", map[string]interface{}{
+		"username": testAdminUsername,
+		"password": "wrong-password",
+	})
+	t.Logf("Login wrong-password response: status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code == http.StatusOK {
+		var resp map[string]interface{}
+		json.Unmarshal(rec.Body.Bytes(), &resp)
+		if code, _ := resp["code"].(float64); code == 200 {
+			t.Fatal("expected failure for wrong password, got 200")
+		}
+	}
+}
+
+// TestAdminLogin_MissingFields verifies missing required fields return 4xx.
+func TestAdminLogin_MissingFields(t *testing.T) {
+	e := setupTestEnv(t)
+	rec := doPost(e, "/admin/api/v1/auth/login", map[string]interface{}{
+		"username": testAdminUsername,
+		// password missing
+	})
+	t.Logf("Login missing-fields response: status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code == http.StatusOK {
+		var resp map[string]interface{}
+		json.Unmarshal(rec.Body.Bytes(), &resp)
+		if code, _ := resp["code"].(float64); code == 200 {
+			t.Fatal("expected validation failure, got code=200")
+		}
+	}
+}
+
+// TestAdminProtectedRoute_NoToken verifies protected routes reject unauthenticated requests.
+func TestAdminProtectedRoute_NoToken(t *testing.T) {
+	e := setupTestEnv(t)
+	protectedRoutes := []string{
+		"/admin/api/v1/auth/me",
+		"/admin/api/v1/api-keys",
+		"/admin/api/v1/chains",
+		"/admin/api/v1/wallets",
+		"/admin/api/v1/orders",
+		"/admin/api/v1/dashboard/overview",
+		"/admin/api/v1/settings",
+		"/admin/api/v1/rpc-nodes",
+		"/admin/api/v1/notification-channels",
+	}
+	for _, path := range protectedRoutes {
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		rec := httptest.NewRecorder()
+		e.ServeHTTP(rec, req)
+		t.Logf("GET %s → %d", path, rec.Code)
+		assertUnauthorized(t, rec)
+	}
+}
+
+// TestAdminMe verifies the /auth/me route returns current user info.
+func TestAdminMe(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	rec := doGetAdmin(e, "/admin/api/v1/auth/me", token)
+	t.Logf("Me response: %s", rec.Body.String())
+	resp := assertOK(t, rec)
+	dataObj, _ := resp["data"].(map[string]interface{})
+	if dataObj["username"] != testAdminUsername {
+		t.Fatalf("expected username=%s, got %v", testAdminUsername, dataObj["username"])
+	}
+}
+
+// TestAdminLogout verifies the /auth/logout route succeeds with a valid token.
+func TestAdminLogout(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	rec := doPostAdmin(e, "/admin/api/v1/auth/logout", nil, token)
+	t.Logf("Logout response: %s", rec.Body.String())
+	assertOK(t, rec)
+}
+
+// TestAdminChangePassword verifies the change-password route works correctly.
+func TestAdminChangePassword(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	rec := doPostAdmin(e, "/admin/api/v1/auth/password", map[string]interface{}{
+		"old_password": testAdminPassword,
+		"new_password": "new-pass-456",
+	}, token)
+	t.Logf("ChangePassword response: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Verify old password no longer works.
+	rec2 := doPost(e, "/admin/api/v1/auth/login", map[string]interface{}{
+		"username": testAdminUsername,
+		"password": testAdminPassword,
+	})
+	var resp2 map[string]interface{}
+	json.Unmarshal(rec2.Body.Bytes(), &resp2)
+	code2, _ := resp2["code"].(float64)
+	if code2 == 200 {
+		t.Fatal("old password should no longer work after change")
+	}
+}
+
+// ─── API Keys ────────────────────────────────────────────────────────────────
+
+// TestAdminApiKeys_CRUD verifies list, create, update, status change, secret,
+// stats, rotate, and delete for API keys.
+func TestAdminApiKeys_CRUD(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	// List — should contain seeded keys from setupTestEnv.
+	rec := doGetAdmin(e, "/admin/api/v1/api-keys", token)
+	t.Logf("ListApiKeys: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Create a new key.
+	rec = doPostAdmin(e, "/admin/api/v1/api-keys", map[string]interface{}{
+		"name": "test-created-key",
+	}, token)
+	t.Logf("CreateApiKey: %s", rec.Body.String())
+	resp := assertOK(t, rec)
+	dataObj, _ := resp["data"].(map[string]interface{})
+	keyID := dataObj["id"]
+	if keyID == nil {
+		t.Fatal("CreateApiKey response missing id")
+	}
+	keyIDStr := fmt.Sprintf("%.0f", keyID.(float64))
+
+	// Update.
+	rec = doPatchAdmin(e, "/admin/api/v1/api-keys/"+keyIDStr, map[string]interface{}{
+		"name": "renamed-key",
+	}, token)
+	t.Logf("UpdateApiKey: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Get secret.
+	rec = doGetAdmin(e, "/admin/api/v1/api-keys/"+keyIDStr+"/secret", token)
+	t.Logf("GetApiKeySecret: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Get stats.
+	rec = doGetAdmin(e, "/admin/api/v1/api-keys/"+keyIDStr+"/stats", token)
+	t.Logf("GetApiKeyStats: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Change status.
+	rec = doPostAdmin(e, "/admin/api/v1/api-keys/"+keyIDStr+"/status", map[string]interface{}{
+		"status": 2, // disable
+	}, token)
+	t.Logf("ChangeApiKeyStatus: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Rotate secret.
+	rec = doPostAdmin(e, "/admin/api/v1/api-keys/"+keyIDStr+"/rotate-secret", nil, token)
+	t.Logf("RotateApiKeySecret: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Delete.
+	rec = doDeleteAdmin(e, "/admin/api/v1/api-keys/"+keyIDStr, token)
+	t.Logf("DeleteApiKey: %s", rec.Body.String())
+	assertOK(t, rec)
+}
+
+// ─── Chains ──────────────────────────────────────────────────────────────────
+
+// TestAdminChains_ListAndUpdate verifies listing and updating chains.
+func TestAdminChains_ListAndUpdate(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	// List chains — seeded in setupTestEnv.
+	rec := doGetAdmin(e, "/admin/api/v1/chains", token)
+	t.Logf("ListChains: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Update the tron chain display name.
+	rec = doPatchAdmin(e, "/admin/api/v1/chains/tron", map[string]interface{}{
+		"display_name": "TRON Updated",
+	}, token)
+	t.Logf("UpdateChain: %s", rec.Body.String())
+	assertOK(t, rec)
+}
+
+// ─── Chain Tokens ─────────────────────────────────────────────────────────────
+
+// TestAdminChainTokens_CRUD verifies CRUD operations for chain tokens.
+func TestAdminChainTokens_CRUD(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	// List — seeded chain tokens.
+	rec := doGetAdmin(e, "/admin/api/v1/chain-tokens", token)
+	t.Logf("ListChainTokens: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Create.
+	rec = doPostAdmin(e, "/admin/api/v1/chain-tokens", map[string]interface{}{
+		"network":          "ethereum",
+		"symbol":           "TEST",
+		"contract_address": "0xTESTADDRESS",
+		"decimals":         18,
+	}, token)
+	t.Logf("CreateChainToken: %s", rec.Body.String())
+	resp := assertOK(t, rec)
+	dataObj, _ := resp["data"].(map[string]interface{})
+	tokenID := dataObj["id"]
+	if tokenID == nil {
+		t.Fatal("CreateChainToken missing id")
+	}
+	tokenIDStr := fmt.Sprintf("%.0f", tokenID.(float64))
+
+	// Update.
+	rec = doPatchAdmin(e, "/admin/api/v1/chain-tokens/"+tokenIDStr, map[string]interface{}{
+		"symbol": "TEST2",
+	}, token)
+	t.Logf("UpdateChainToken: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Change status.
+	rec = doPostAdmin(e, "/admin/api/v1/chain-tokens/"+tokenIDStr+"/status", map[string]interface{}{
+		"enabled": false,
+	}, token)
+	t.Logf("ChangeChainTokenStatus: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Delete.
+	rec = doDeleteAdmin(e, "/admin/api/v1/chain-tokens/"+tokenIDStr, token)
+	t.Logf("DeleteChainToken: %s", rec.Body.String())
+	assertOK(t, rec)
+}
+
+// ─── RPC Nodes ────────────────────────────────────────────────────────────────
+
+// TestAdminRpcNodes_CRUD verifies CRUD operations for RPC nodes.
+func TestAdminRpcNodes_CRUD(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	// List — empty initially.
+	rec := doGetAdmin(e, "/admin/api/v1/rpc-nodes", token)
+	t.Logf("ListRpcNodes: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Create.
+	rec = doPostAdmin(e, "/admin/api/v1/rpc-nodes", map[string]interface{}{
+		"network": "ethereum",
+		"url":     "https://eth-mainnet.example.com",
+		"type":    "http",
+	}, token)
+	t.Logf("CreateRpcNode: %s", rec.Body.String())
+	resp := assertOK(t, rec)
+	dataObj, _ := resp["data"].(map[string]interface{})
+	nodeID := dataObj["id"]
+	if nodeID == nil {
+		t.Fatal("CreateRpcNode missing id")
+	}
+	nodeIDStr := fmt.Sprintf("%.0f", nodeID.(float64))
+
+	// Update.
+	rec = doPatchAdmin(e, "/admin/api/v1/rpc-nodes/"+nodeIDStr, map[string]interface{}{
+		"url": "https://eth-mainnet2.example.com",
+	}, token)
+	t.Logf("UpdateRpcNode: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Health check — network likely unreachable in test, but route must not 404/500.
+	rec = doPostAdmin(e, "/admin/api/v1/rpc-nodes/"+nodeIDStr+"/health-check", nil, token)
+	t.Logf("HealthCheckRpcNode: status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code == http.StatusNotFound {
+		t.Fatalf("health-check route returned 404")
+	}
+
+	// Delete.
+	rec = doDeleteAdmin(e, "/admin/api/v1/rpc-nodes/"+nodeIDStr, token)
+	t.Logf("DeleteRpcNode: %s", rec.Body.String())
+	assertOK(t, rec)
+}
+
+// ─── Wallets ─────────────────────────────────────────────────────────────────
+
+// TestAdminWallets_CRUD verifies wallet management routes.
+func TestAdminWallets_CRUD(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	// List — two wallets seeded in setupTestEnv.
+	rec := doGetAdmin(e, "/admin/api/v1/wallets", token)
+	t.Logf("ListWallets: %s", rec.Body.String())
+	resp := assertOK(t, rec)
+	_ = resp
+
+	// Add a new wallet.
+	rec = doPostAdmin(e, "/admin/api/v1/wallets", map[string]interface{}{
+		"network": "ethereum",
+		"address": "0xTestEthAddress001",
+	}, token)
+	t.Logf("AddWallet: %s", rec.Body.String())
+	resp2 := assertOK(t, rec)
+	dataObj, _ := resp2["data"].(map[string]interface{})
+	walletID := dataObj["id"]
+	if walletID == nil {
+		t.Fatal("AddWallet missing id")
+	}
+	walletIDStr := fmt.Sprintf("%.0f", walletID.(float64))
+
+	// Get single wallet.
+	rec = doGetAdmin(e, "/admin/api/v1/wallets/"+walletIDStr, token)
+	t.Logf("GetWallet: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Update.
+	rec = doPatchAdmin(e, "/admin/api/v1/wallets/"+walletIDStr, map[string]interface{}{
+		"address": "0xTestEthAddress002",
+	}, token)
+	t.Logf("UpdateWallet: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Change status.
+	rec = doPostAdmin(e, "/admin/api/v1/wallets/"+walletIDStr+"/status", map[string]interface{}{
+		"status": 2, // disable
+	}, token)
+	t.Logf("ChangeWalletStatus: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Delete.
+	rec = doDeleteAdmin(e, "/admin/api/v1/wallets/"+walletIDStr, token)
+	t.Logf("DeleteWallet: %s", rec.Body.String())
+	assertOK(t, rec)
+}
+
+// TestAdminWallets_BatchImport verifies batch wallet import.
+func TestAdminWallets_BatchImport(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	rec := doPostAdmin(e, "/admin/api/v1/wallets/batch-import", map[string]interface{}{
+		"network":   "ethereum",
+		"addresses": []string{"0xBatchAddr001", "0xBatchAddr002"},
+	}, token)
+	t.Logf("BatchImportWallets: %s", rec.Body.String())
+	assertOK(t, rec)
+}
+
+// ─── Orders ──────────────────────────────────────────────────────────────────
+
+// TestAdminOrders_List verifies listing orders (empty initially).
+func TestAdminOrders_List(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	rec := doGetAdmin(e, "/admin/api/v1/orders", token)
+	t.Logf("ListOrders: %s", rec.Body.String())
+	assertOK(t, rec)
+}
+
+// TestAdminOrders_Export verifies the export endpoint is accessible.
+func TestAdminOrders_Export(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	rec := doGetAdmin(e, "/admin/api/v1/orders/export", token)
+	t.Logf("ExportOrders: status=%d", rec.Code)
+	// Should return 200 (even with empty result set).
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", rec.Code, rec.Body.String())
+	}
+}
+
+// TestAdminOrders_GetNotFound verifies a non-existent trade_id returns a
+// non-200 business code (not a 404 or 500 HTTP error).
+func TestAdminOrders_GetNotFound(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	rec := doGetAdmin(e, "/admin/api/v1/orders/nonexistent-trade-id", token)
+	t.Logf("GetOrder (not found): status=%d body=%s", rec.Code, rec.Body.String())
+	// Should not be a server error.
+	if rec.Code >= 500 {
+		t.Fatalf("unexpected server error: %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+// TestAdminOrders_CloseNotFound verifies closing a non-existent order returns
+// a graceful error (not 500).
+func TestAdminOrders_CloseNotFound(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	rec := doPostAdmin(e, "/admin/api/v1/orders/nonexistent-trade-id/close", nil, token)
+	t.Logf("CloseOrder (not found): status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code >= 500 {
+		t.Fatalf("unexpected server error: %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+// TestAdminOrders_MarkPaidNotFound verifies mark-paid on non-existent order.
+func TestAdminOrders_MarkPaidNotFound(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	rec := doPostAdmin(e, "/admin/api/v1/orders/nonexistent-trade-id/mark-paid", nil, token)
+	t.Logf("MarkOrderPaid (not found): status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code >= 500 {
+		t.Fatalf("unexpected server error: %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+// TestAdminOrders_ResendCallbackNotFound verifies resend-callback graceful error.
+func TestAdminOrders_ResendCallbackNotFound(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	rec := doPostAdmin(e, "/admin/api/v1/orders/nonexistent-trade-id/resend-callback", nil, token)
+	t.Logf("ResendCallback (not found): status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code >= 500 {
+		t.Fatalf("unexpected server error: %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+// ─── Dashboard ───────────────────────────────────────────────────────────────
+
+// TestAdminDashboard_AllRoutes verifies all dashboard endpoints return 200.
+func TestAdminDashboard_AllRoutes(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	routes := []string{
+		"/admin/api/v1/dashboard/overview",
+		"/admin/api/v1/dashboard/asset-trend",
+		"/admin/api/v1/dashboard/revenue-trend",
+		"/admin/api/v1/dashboard/order-stats",
+		"/admin/api/v1/dashboard/recent-orders",
+	}
+	for _, path := range routes {
+		rec := doGetAdmin(e, path, token)
+		t.Logf("GET %s → %d: %s", path, rec.Code, rec.Body.String())
+		assertOK(t, rec)
+	}
+}
+
+// ─── Settings ────────────────────────────────────────────────────────────────
+
+// TestAdminSettings_ListAndUpsert verifies listing and upserting settings.
+func TestAdminSettings_ListAndUpsert(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	// List settings.
+	rec := doGetAdmin(e, "/admin/api/v1/settings", token)
+	t.Logf("ListSettings: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Upsert a setting.
+	rec = doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
+		"items": []map[string]interface{}{
+			{"group": "rate", "key": "rate.forced_usdt_rate", "value": "7.5", "type": "string"},
+		},
+	}, token)
+	t.Logf("UpsertSettings: %s", rec.Body.String())
+	assertOK(t, rec)
+}
+
+// TestAdminSettings_DeleteNonExistent verifies deleting a non-existent setting.
+func TestAdminSettings_DeleteNonExistent(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+	rec := doDeleteAdmin(e, "/admin/api/v1/settings/nonexistent.key", token)
+	t.Logf("DeleteSetting (nonexistent): status=%d body=%s", rec.Code, rec.Body.String())
+	// Should not be a server error.
+	if rec.Code >= 500 {
+		t.Fatalf("unexpected server error: %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+// ─── Notification Channels ───────────────────────────────────────────────────
+
+// TestAdminNotificationChannels_CRUD verifies notification channel routes.
+func TestAdminNotificationChannels_CRUD(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	// List — empty initially.
+	rec := doGetAdmin(e, "/admin/api/v1/notification-channels", token)
+	t.Logf("ListNotificationChannels: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Create a webhook channel.
+	rec = doPostAdmin(e, "/admin/api/v1/notification-channels", map[string]interface{}{
+		"name":   "test-webhook",
+		"type":   "webhook",
+		"config": map[string]interface{}{"url": "http://localhost/webhook"},
+		"events": map[string]bool{"order.paid": true},
+	}, token)
+	t.Logf("CreateNotificationChannel: %s", rec.Body.String())
+	resp := assertOK(t, rec)
+	dataObj, _ := resp["data"].(map[string]interface{})
+	chanID := dataObj["id"]
+	if chanID == nil {
+		t.Fatal("CreateNotificationChannel missing id")
+	}
+	chanIDStr := fmt.Sprintf("%.0f", chanID.(float64))
+
+	// Update.
+	rec = doPatchAdmin(e, "/admin/api/v1/notification-channels/"+chanIDStr, map[string]interface{}{
+		"name": "renamed-webhook",
+	}, token)
+	t.Logf("UpdateNotificationChannel: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Change status.
+	rec = doPostAdmin(e, "/admin/api/v1/notification-channels/"+chanIDStr+"/status", map[string]interface{}{
+		"enabled": false,
+	}, token)
+	t.Logf("ChangeNotificationChannelStatus: %s", rec.Body.String())
+	assertOK(t, rec)
+
+	// Delete.
+	rec = doDeleteAdmin(e, "/admin/api/v1/notification-channels/"+chanIDStr, token)
+	t.Logf("DeleteNotificationChannel: %s", rec.Body.String())
+	assertOK(t, rec)
+}
+
+// TestAdminNotificationChannels_TelegramFrontendPayloadCompatibility verifies
+// the admin API accepts common frontend telegram payload variants:
+// - type in mixed case ("Telegram")
+// - config in camelCase keys (botToken/chatId)
+// - events as string array
+func TestAdminNotificationChannels_TelegramFrontendPayloadCompatibility(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	rec := doPostAdmin(e, "/admin/api/v1/notification-channels", map[string]interface{}{
+		"name": "frontend-telegram",
+		"type": "Telegram",
+		"config": map[string]interface{}{
+			"botToken": "123:ABC",
+			"chatId":   "-1001234567890",
+		},
+		"events": []string{"order.paid", "order.expired"},
+	}, token)
+	t.Logf("CreateFrontendStyleTelegramChannel: %s", rec.Body.String())
+	resp := assertOK(t, rec)
+
+	dataObj, ok := resp["data"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("missing data object: %s", rec.Body.String())
+	}
+
+	eventsRaw, _ := dataObj["events"].(string)
+	if eventsRaw == "" {
+		t.Fatalf("missing events json in response data: %s", rec.Body.String())
+	}
+	var events map[string]bool
+	if err := json.Unmarshal([]byte(eventsRaw), &events); err != nil {
+		t.Fatalf("unmarshal events: %v", err)
+	}
+	if !events["order.paid"] || !events["order.expired"] {
+		t.Fatalf("events not normalized as expected: %+v", events)
+	}
+}
+
+// ─── Orders list-with-sub ─────────────────────────────────────────────────────
+
+// TestAdminOrders_ListWithSubExcludesSubOrdersFromTopLevel verifies that
+// sub-orders do NOT appear at the top level of /orders/list-with-sub and are
+// instead nested inside their parent's sub_orders array.
+func TestAdminOrders_ListWithSubExcludesSubOrdersFromTopLevel(t *testing.T) {
+	e, token := setupAdminTestEnv(t)
+
+	// Seed Ethereum wallet and chain_token so SwitchNetwork can allocate
+	// a sub-order on that network. The chain record is already seeded by
+	// MdbTableInit; only the wallet address and token are needed here.
+	dao.Mdb.Create(&mdb.WalletAddress{
+		Network: mdb.NetworkEthereum,
+		Address: "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+		Status:  mdb.TokenStatusEnable,
+	})
+	if err := dao.Mdb.Where(mdb.ChainToken{Network: mdb.NetworkEthereum, Symbol: "USDT"}).
+		FirstOrCreate(&mdb.ChainToken{
+			Network: mdb.NetworkEthereum, Symbol: "USDT",
+			ContractAddress: "0xdAC17F958D2ee523a2206206994597C13D831ec7",
+			Decimals:        6, Enabled: true,
+		}).Error; err != nil {
+		t.Fatalf("seed ethereum USDT token: %v", err)
+	}
+
+	// Create a parent order via the gmpay API.
+	parentBody := signBody(map[string]interface{}{
+		"order_id":     "listsubtest-parent",
+		"amount":       5.0,
+		"currency":     "CNY",
+		"token":        "USDT",
+		"network":      "tron",
+		"notify_url":   "https://merchant.example/callback",
+		"redirect_url": "https://merchant.example/redirect",
+	})
+	rec := doPost(e, "/payments/gmpay/v1/order/create-transaction", parentBody)
+	t.Logf("CreateParent: %s", rec.Body.String())
+	if rec.Code != http.StatusOK {
+		t.Fatalf("create parent: got %d: %s", rec.Code, rec.Body.String())
+	}
+	var parentResp map[string]interface{}
+	json.Unmarshal(rec.Body.Bytes(), &parentResp)
+	parentTradeId := parentResp["data"].(map[string]interface{})["trade_id"].(string)
+
+	// Switch to Ethereum to create a sub-order (no signature required).
+	rec = doPost(e, "/pay/switch-network", map[string]interface{}{
+		"trade_id": parentTradeId,
+		"token":    "USDT",
+		"network":  "ethereum",
+	})
+	t.Logf("SwitchNetwork: %s", rec.Body.String())
+	if rec.Code != http.StatusOK {
+		t.Fatalf("switch network: got %d: %s", rec.Code, rec.Body.String())
+	}
+	var switchResp map[string]interface{}
+	json.Unmarshal(rec.Body.Bytes(), &switchResp)
+	subTradeId := switchResp["data"].(map[string]interface{})["trade_id"].(string)
+
+	// Fetch list-with-sub.
+	rec = doGetAdmin(e, "/admin/api/v1/orders/list-with-sub", token)
+	t.Logf("ListWithSub: %s", rec.Body.String())
+	resp := assertOK(t, rec)
+
+	dataObj, ok := resp["data"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("missing data object: %s", rec.Body.String())
+	}
+	listRaw, _ := dataObj["list"].([]interface{})
+
+	// Collect all trade_ids at the top level and in sub_orders.
+	topLevelIds := map[string]bool{}
+	subOrderIds := map[string]bool{}
+	for _, item := range listRaw {
+		entry := item.(map[string]interface{})
+		tradeId := entry["trade_id"].(string)
+		topLevelIds[tradeId] = true
+		if subs, ok := entry["sub_orders"].([]interface{}); ok {
+			for _, s := range subs {
+				sub := s.(map[string]interface{})
+				subOrderIds[sub["trade_id"].(string)] = true
+			}
+		}
+	}
+
+	// Sub-order must NOT appear at the top level.
+	if topLevelIds[subTradeId] {
+		t.Fatalf("sub-order trade_id=%s appears at top level — should be nested only", subTradeId)
+	}
+	// Parent must appear at the top level.
+	if !topLevelIds[parentTradeId] {
+		t.Fatalf("parent trade_id=%s missing from top level", parentTradeId)
+	}
+	// Sub-order must appear under the parent's sub_orders.
+	if !subOrderIds[subTradeId] {
+		t.Fatalf("sub-order trade_id=%s not found in any sub_orders array", subTradeId)
+	}
+}

src/route/router.go

@@ -2,19 +2,22 @@ package route
 
 import (
 	"bytes"
+	"crypto/subtle"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
 	"strconv"
 
-	"github.com/assimon/luuu/config"
+	"github.com/assimon/luuu/controller/admin"
 	"github.com/assimon/luuu/controller/comm"
 	"github.com/assimon/luuu/middleware"
+	"github.com/assimon/luuu/model/data"
 	"github.com/assimon/luuu/model/mdb"
 	"github.com/assimon/luuu/util/constant"
 	"github.com/assimon/luuu/util/sign"
 	"github.com/labstack/echo/v4"
+	echoMiddleware "github.com/labstack/echo/v4/middleware"
 )
 
 // RegisterRoute 路由注册
@@ -31,55 +34,20 @@ func RegisterRoute(e *echo.Echo) {
 	// payment routes
 	paymentRoute := e.Group("/payments")
 
-	// for epusdt
-	epusdtV1 := paymentRoute.Group("/epusdt/v1")
-	epusdtV1.POST("/order/create-transaction", func(ctx echo.Context) error {
-		// add default token and currency for old plugin
-
-		body := make(map[string]interface{})
-		if err := ctx.Bind(&body); err != nil {
-			return comm.Ctrl.FailJson(ctx, err)
-		}
-		if _, ok := body["token"]; !ok {
-			body["token"] = "usdt"
-		}
-		if _, ok := body["currency"]; !ok {
-			body["currency"] = "cny"
-		}
-		if _, ok := body["network"]; !ok {
-			body["network"] = "tron"
-		}
-		ctx.Set("request_body", body)
-
-		jsonBytes, err := json.Marshal(body)
-		if err != nil {
-			return comm.Ctrl.FailJson(ctx, err)
-		}
-		ctx.Request().Body = io.NopCloser(bytes.NewBuffer(jsonBytes))
-		ctx.Request().ContentLength = int64(len(jsonBytes))
-
-		return comm.Ctrl.CreateTransaction(ctx)
-	}, middleware.CheckApiSign())
-
 	// gmpay v1 routes
 	gmpayV1 := paymentRoute.Group("/gmpay/v1")
 	gmpayV1.POST("/order/create-transaction", comm.Ctrl.CreateTransaction, middleware.CheckApiSign())
 	gmpayV1.GET("/supported-assets", comm.Ctrl.GetSupportedAssets)
-	gmpayV1.GET("/supported-assets/records", comm.Ctrl.ListSupportedAssetRecords)
+	// gmpayV1.GET("/supported-assets/records", comm.Ctrl.ListSupportedAssetRecords)
-	gmpayV1.GET("/supported-assets/:id", comm.Ctrl.GetSupportedAsset)
+	// gmpayV1.GET("/supported-assets/:id", comm.Ctrl.GetSupportedAsset)
-	gmpayV1.POST("/supported-assets/add", comm.Ctrl.AddSupportedAsset, middleware.CheckApiToken())
-	gmpayV1.POST("/supported-assets/:id/update", comm.Ctrl.UpdateSupportedAsset, middleware.CheckApiToken())
-	gmpayV1.POST("/supported-assets/:id/delete", comm.Ctrl.DeleteSupportedAsset, middleware.CheckApiToken())
-
-	// wallet management routes
-	walletV1 := gmpayV1.Group("/wallet", middleware.CheckApiToken())
-	walletV1.POST("/add", comm.Ctrl.AddWallet)
-	walletV1.GET("/list", comm.Ctrl.ListWallets)
-	walletV1.GET("/:id", comm.Ctrl.GetWallet)
-	walletV1.POST("/:id/status", comm.Ctrl.ChangeWalletStatus)
-	walletV1.POST("/:id/delete", comm.Ctrl.DeleteWallet)
 
 	// epay v1 routes
+	//
+	// Signature uses the pid from the request as the api_keys lookup
+	// key; the matching row's secret_key plays the role of the legacy
+	// EPAY "key" value. Env-based (EPAY_PID/EPAY_KEY) fallback was
+	// removed — the default seeded api_key is always available, and
+	// having two sources of truth led to inbound/outbound sig mismatch.
 	epayV1 := paymentRoute.Group("/epay/v1")
 	epayV1.Match([]string{http.MethodPost, http.MethodGet}, "/order/create-transaction/submit.php", func(ctx echo.Context) error {
 		params := make(map[string]interface{})
@@ -107,11 +75,11 @@ func RegisterRoute(e *echo.Echo) {
 			if !ok {
 				return ""
 			}
-			s, ok := v.(string)
+			switch t := v.(type) {
-			if !ok {
+			case string:
-				return ""
+				return t
 			}
-			return s
+			return ""
 		}
 
 		signstr := getString(params, "sign")
@@ -122,17 +90,29 @@ func RegisterRoute(e *echo.Echo) {
 		delete(params, "sign")
 		delete(params, "sign_type")
 
-		// we need to add pid to params for signature verification
+		pidStr := getString(params, "pid")
-		params["pid"] = config.GetEpayPid()
+		if pidStr == "" {
+			return constant.SignatureErr
+		}
+		apiKeyRow, err := data.GetEnabledApiKey(pidStr)
+		if err != nil || apiKeyRow == nil || apiKeyRow.ID == 0 {
+			return constant.SignatureErr
+		}
 
-		checkSignature, err := sign.Get(params, config.GetApiAuthToken())
+		checkSignature, err := sign.Get(params, apiKeyRow.SecretKey)
 		if err != nil {
 			return constant.SignatureErr
 		}
-		if checkSignature != signstr {
+		if subtle.ConstantTimeCompare([]byte(checkSignature), []byte(signstr)) != 1 {
 			return constant.SignatureErr
 		}
 
+		if !middleware.IsIPWhitelisted(apiKeyRow.IpWhitelist, ctx.RealIP()) {
+			return constant.SignatureErr
+		}
+
+		_ = data.TouchApiKeyUsage(apiKeyRow.ID)
+
 		money := getString(params, "money")
 		name := getString(params, "name")
 		notifyURL := getString(params, "notify_url")
@@ -145,9 +125,9 @@ func RegisterRoute(e *echo.Echo) {
 		}
 
 		body := map[string]interface{}{
-			"token":        "usdt",
+			"token":        data.GetSettingString(mdb.SettingKeyEpayDefaultToken, "usdt"),
-			"currency":     "cny",
+			"currency":     data.GetSettingString(mdb.SettingKeyEpayDefaultCurrency, "cny"),
-			"network":      "tron",
+			"network":      data.GetSettingString(mdb.SettingKeyEpayDefaultNetwork, "tron"),
 			"amount":       amountFloat,
 			"notify_url":   notifyURL,
 			"order_id":     outTradeNo,
@@ -158,6 +138,8 @@ func RegisterRoute(e *echo.Echo) {
 		}
 
 		ctx.Set("request_body", body)
+		ctx.Set(middleware.ApiKeyIDKey, apiKeyRow.ID)
+		ctx.Set(middleware.ApiKeyRowKey, apiKeyRow)
 
 		jsonBytes, err := json.Marshal(body)
 		if err != nil {
@@ -170,6 +152,115 @@ func RegisterRoute(e *echo.Echo) {
 		ctx.Request().Header.Set("Content-Type", "application/json")
 
 		return comm.Ctrl.CreateTransactionAndRedirect(ctx)
-
 	})
+
+	registerAdminRoutes(e)
+}
+
+// registerAdminRoutes wires the management console API surface under
+// /admin/api/v1. Everything except /auth/login requires a valid JWT.
+func registerAdminRoutes(e *echo.Echo) {
+	// CORS for the management console. The admin SPA is commonly served
+	// from a different origin (local dev, CDN, etc.), so allow any origin
+	// but require explicit echoing — browsers refuse wildcard + credentials.
+	adminCORS := echoMiddleware.CORSWithConfig(echoMiddleware.CORSConfig{
+		AllowOriginFunc: func(origin string) (bool, error) { return true, nil },
+		AllowMethods: []string{
+			http.MethodGet,
+			http.MethodPost,
+			http.MethodPatch,
+			http.MethodPut,
+			http.MethodDelete,
+			http.MethodOptions,
+		},
+		AllowHeaders: []string{
+			echo.HeaderOrigin,
+			echo.HeaderContentType,
+			echo.HeaderAuthorization,
+			echo.HeaderAccept,
+			echo.HeaderXRequestedWith,
+		},
+		AllowCredentials: true,
+		MaxAge:           86400,
+	})
+
+	adminV1 := e.Group("/admin/api/v1", adminCORS)
+
+	// Public (no JWT)
+	adminV1.POST("/auth/login", admin.Ctrl.Login)
+
+	// Authenticated
+	authed := adminV1.Group("", middleware.CheckAdminJWT())
+	authed.POST("/auth/logout", admin.Ctrl.Logout)
+	authed.GET("/auth/me", admin.Ctrl.Me)
+	authed.POST("/auth/password", admin.Ctrl.ChangePassword)
+
+	// API key management
+	authed.GET("/api-keys", admin.Ctrl.ListApiKeys)
+	authed.POST("/api-keys", admin.Ctrl.CreateApiKey)
+	authed.PATCH("/api-keys/:id", admin.Ctrl.UpdateApiKey)
+	authed.POST("/api-keys/:id/status", admin.Ctrl.ChangeApiKeyStatus)
+	authed.POST("/api-keys/:id/rotate-secret", admin.Ctrl.RotateApiKeySecret)
+	authed.DELETE("/api-keys/:id", admin.Ctrl.DeleteApiKey)
+	authed.GET("/api-keys/:id/stats", admin.Ctrl.GetApiKeyStats)
+	authed.GET("/api-keys/:id/secret", admin.Ctrl.GetApiKeySecret)
+
+	// Notification channels
+	authed.GET("/notification-channels", admin.Ctrl.ListNotificationChannels)
+	authed.POST("/notification-channels", admin.Ctrl.CreateNotificationChannel)
+	authed.PATCH("/notification-channels/:id", admin.Ctrl.UpdateNotificationChannel)
+	authed.POST("/notification-channels/:id/status", admin.Ctrl.ChangeNotificationChannelStatus)
+	authed.DELETE("/notification-channels/:id", admin.Ctrl.DeleteNotificationChannel)
+
+	//	gmpayV1.GET("/supported-assets", comm.Ctrl.GetSupportedAssets)
+	authed.GET("/supported-assets", comm.Ctrl.GetSupportedAssets) // wrap for admin console, same handler as public endpoint
+
+	// Chains
+	authed.GET("/chains", admin.Ctrl.ListChains)
+	authed.PATCH("/chains/:network", admin.Ctrl.UpdateChain)
+
+	// Chain tokens (per-chain token catalog)
+	authed.GET("/chain-tokens", admin.Ctrl.ListChainTokens)
+	authed.POST("/chain-tokens", admin.Ctrl.CreateChainToken)
+	authed.PATCH("/chain-tokens/:id", admin.Ctrl.UpdateChainToken)
+	authed.POST("/chain-tokens/:id/status", admin.Ctrl.ChangeChainTokenStatus)
+	authed.DELETE("/chain-tokens/:id", admin.Ctrl.DeleteChainToken)
+
+	// RPC nodes
+	authed.GET("/rpc-nodes", admin.Ctrl.ListRpcNodes)
+	authed.POST("/rpc-nodes", admin.Ctrl.CreateRpcNode)
+	authed.PATCH("/rpc-nodes/:id", admin.Ctrl.UpdateRpcNode)
+	authed.DELETE("/rpc-nodes/:id", admin.Ctrl.DeleteRpcNode)
+	authed.POST("/rpc-nodes/:id/health-check", admin.Ctrl.HealthCheckRpcNode)
+
+	// Wallet (address) management
+	authed.GET("/wallets", admin.Ctrl.AdminListWallets)
+	authed.POST("/wallets", admin.Ctrl.AdminAddWallet)
+	authed.GET("/wallets/:id", admin.Ctrl.AdminGetWallet)
+	authed.PATCH("/wallets/:id", admin.Ctrl.AdminUpdateWallet)
+	authed.POST("/wallets/:id/status", admin.Ctrl.AdminChangeWalletStatus)
+	authed.DELETE("/wallets/:id", admin.Ctrl.AdminDeleteWallet)
+	authed.POST("/wallets/batch-import", admin.Ctrl.AdminBatchImportWallets)
+
+	// Orders
+	authed.GET("/orders", admin.Ctrl.ListOrders)
+	authed.GET("/orders/export", admin.Ctrl.ExportOrders)
+	authed.GET("/orders/list-with-sub", admin.Ctrl.ListOrdersWithSub)
+	authed.GET("/orders/:trade_id", admin.Ctrl.GetOrder)
+	authed.GET("/orders/:trade_id/with-sub", admin.Ctrl.GetOrderWithSub)
+	authed.POST("/orders/:trade_id/close", admin.Ctrl.CloseOrder)
+	authed.POST("/orders/:trade_id/mark-paid", admin.Ctrl.MarkOrderPaid)
+	authed.POST("/orders/:trade_id/resend-callback", admin.Ctrl.ResendCallback)
+
+	// Dashboard
+	authed.GET("/dashboard/overview", admin.Ctrl.Overview)
+	authed.GET("/dashboard/asset-trend", admin.Ctrl.AssetTrend)
+	authed.GET("/dashboard/revenue-trend", admin.Ctrl.RevenueTrend)
+	authed.GET("/dashboard/order-stats", admin.Ctrl.OrderStats)
+	authed.GET("/dashboard/recent-orders", admin.Ctrl.RecentOrders)
+
+	// Settings
+	authed.GET("/settings", admin.Ctrl.ListSettings)
+	authed.PUT("/settings", admin.Ctrl.UpsertSettings)
+	authed.DELETE("/settings/:key", admin.Ctrl.DeleteSetting)
 }

src/route/router_test.go

@@ -11,11 +11,13 @@ import (
 	"testing"
 
 	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/data"
 	"github.com/assimon/luuu/model/mdb"
 	"github.com/assimon/luuu/util/log"
 	"github.com/assimon/luuu/util/sign"
 	"github.com/labstack/echo/v4"
 	"github.com/spf13/viper"
+	"gorm.io/gorm/clause"
 )
 
 const testAPIToken = "test-secret-token"
@@ -28,8 +30,6 @@ func setupTestEnv(t *testing.T) *echo.Echo {
 	// minimal viper config
 	viper.Reset()
 	viper.Set("db_type", "sqlite")
-	viper.Set("api_auth_token", testAPIToken)
-	viper.Set("epay_pid", 1)
 	viper.Set("app_uri", "http://localhost:8080")
 	viper.Set("order_expiration_time", 10)
 	viper.Set("api_rate_url", "")
@@ -54,30 +54,62 @@ func setupTestEnv(t *testing.T) *echo.Echo {
 	}
 
 	// ensure tables exist (MdbTableInit uses sync.Once, so migrate directly)
-	dao.Mdb.AutoMigrate(&mdb.Orders{}, &mdb.WalletAddress{}, &mdb.SupportedAsset{})
+	dao.Mdb.AutoMigrate(
+		&mdb.Orders{},
+		&mdb.WalletAddress{},
+		&mdb.AdminUser{},
+		&mdb.ApiKey{},
+		&mdb.Setting{},
+		&mdb.NotificationChannel{},
+		&mdb.Chain{},
+		&mdb.ChainToken{},
+		&mdb.RpcNode{},
+	)
+
+	// reset the settings cache so stale entries from a prior test don't leak
+	_ = data.ReloadSettings()
 
 	// seed wallet addresses
 	dao.Mdb.Create(&mdb.WalletAddress{Network: mdb.NetworkTron, Address: "TTestTronAddress001", Status: mdb.TokenStatusEnable})
 	dao.Mdb.Create(&mdb.WalletAddress{Network: mdb.NetworkSolana, Address: "SolTestAddress001", Status: mdb.TokenStatusEnable})
-	// seed supported assets if empty
+	// seed chains so scanners know the test networks are "enabled".
-	var supportCnt int64
+	// Use ON CONFLICT DO NOTHING: MdbTableInit (called via DBInit) uses sync.Once
-	dao.Mdb.Model(&mdb.SupportedAsset{}).Count(&supportCnt)
+	// and may have already seeded these rows into this DB on the first test run.
-	if supportCnt == 0 {
+	dao.Mdb.Clauses(clause.OnConflict{DoNothing: true}).Create(&[]mdb.Chain{
-		dao.Mdb.Create(&[]mdb.SupportedAsset{
+		{Network: mdb.NetworkTron, DisplayName: "TRON", Enabled: true},
-			{Network: mdb.NetworkTron, Token: "TRX", Status: mdb.TokenStatusEnable},
+		{Network: mdb.NetworkSolana, DisplayName: "Solana", Enabled: true},
-			{Network: mdb.NetworkTron, Token: "USDT", Status: mdb.TokenStatusEnable},
+		{Network: mdb.NetworkEthereum, DisplayName: "Ethereum", Enabled: true},
-			{Network: mdb.NetworkSolana, Token: "SOL", Status: mdb.TokenStatusEnable},
+		{Network: mdb.NetworkBsc, DisplayName: "BSC", Enabled: true},
-			{Network: mdb.NetworkSolana, Token: "USDT", Status: mdb.TokenStatusEnable},
+		{Network: mdb.NetworkPolygon, DisplayName: "Polygon", Enabled: true},
-			{Network: mdb.NetworkSolana, Token: "USDC", Status: mdb.TokenStatusEnable},
+		{Network: mdb.NetworkPlasma, DisplayName: "Plasma", Enabled: true},
-			{Network: mdb.NetworkEthereum, Token: "USDT", Status: mdb.TokenStatusEnable},
+	})
-			{Network: mdb.NetworkEthereum, Token: "USDC", Status: mdb.TokenStatusEnable},
+
-			{Network: mdb.NetworkBsc, Token: "USDT", Status: mdb.TokenStatusEnable},
+	// seed chain_tokens — GetSupportedAssets now reads from this table.
-			{Network: mdb.NetworkBsc, Token: "USDC", Status: mdb.TokenStatusEnable},
+	// Same idempotency rationale as above.
-			{Network: mdb.NetworkPolygon, Token: "USDT", Status: mdb.TokenStatusEnable},
+	dao.Mdb.Clauses(clause.OnConflict{DoNothing: true}).Create(&[]mdb.ChainToken{
-			{Network: mdb.NetworkPolygon, Token: "USDC", Status: mdb.TokenStatusEnable},
+		{Network: mdb.NetworkTron, Symbol: "USDT", ContractAddress: "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t", Decimals: 6, Enabled: true},
-			{Network: mdb.NetworkPlasma, Token: "USDT", Status: mdb.TokenStatusEnable},
+		{Network: mdb.NetworkTron, Symbol: "TRX", ContractAddress: "", Decimals: 6, Enabled: true},
-		})
+		{Network: mdb.NetworkSolana, Symbol: "USDT", ContractAddress: "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB", Decimals: 6, Enabled: true},
-	}
+		{Network: mdb.NetworkSolana, Symbol: "USDC", ContractAddress: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", Decimals: 6, Enabled: true},
+		{Network: mdb.NetworkSolana, Symbol: "SOL", ContractAddress: "", Decimals: 9, Enabled: true},
+	})
+
+	// Seed one universal api_keys row. The test's testAPIToken doubles
+	// as both pid and secret_key so sign.Get(body, testAPIToken) calls
+	// stay valid.
+	dao.Mdb.Create(&mdb.ApiKey{
+		Name:      "test-universal",
+		Pid:       testAPIToken,
+		SecretKey: testAPIToken,
+		Status:    mdb.ApiKeyStatusEnable,
+	})
+	// Additional numeric-PID row for EPAY tests (EPAY pid must be numeric).
+	dao.Mdb.Create(&mdb.ApiKey{
+		Name:      "test-epay-pid-1",
+		Pid:       "1",
+		SecretKey: testAPIToken,
+		Status:    mdb.ApiKeyStatusEnable,
+	})
 
 	e := echo.New()
 	RegisterRoute(e)
@@ -85,6 +117,11 @@ func setupTestEnv(t *testing.T) *echo.Echo {
 }
 
 func signBody(body map[string]interface{}) map[string]interface{} {
+	// Signature middleware looks up api_keys by the "pid" field and
+	// uses that row's secret_key as the signing bizKey.
+	if _, ok := body["pid"]; !ok {
+		body["pid"] = testAPIToken
+	}
 	sig, _ := sign.Get(body, testAPIToken)
 	body["signature"] = sig
 	return body
@@ -121,42 +158,6 @@ func doFormPost(e *echo.Echo, path string, values url.Values) *httptest.Response
 	return rec
 }
 
-// TestCreateOrderEpusdtDefaultTron tests the epusdt compatibility route defaults to tron network.
-func TestCreateOrderEpusdtDefaultTron(t *testing.T) {
-	e := setupTestEnv(t)
-
-	body := signBody(map[string]interface{}{
-		"order_id":   "test-tron-001",
-		"amount":     1.00,
-		"notify_url": "http://localhost/notify",
-	})
-
-	rec := doPost(e, "/payments/epusdt/v1/order/create-transaction", body)
-	t.Logf("Status: %d, Body: %s", rec.Code, rec.Body.String())
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d", rec.Code)
-	}
-
-	var resp map[string]interface{}
-	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("unmarshal: %v", err)
-	}
-
-	data, ok := resp["data"].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected data in response, got: %v", resp)
-	}
-
-	if data["trade_id"] == nil || data["trade_id"] == "" {
-		t.Error("expected trade_id in response")
-	}
-	if data["receive_address"] != "TTestTronAddress001" {
-		t.Errorf("expected tron address, got: %v", data["receive_address"])
-	}
-	t.Logf("Order created: trade_id=%v address=%v amount=%v", data["trade_id"], data["receive_address"], data["actual_amount"])
-}
-
 // TestCreateOrderGmpayV1Solana tests the gmpay route with solana network.
 func TestCreateOrderGmpayV1Solana(t *testing.T) {
 	e := setupTestEnv(t)
@@ -223,24 +224,6 @@ func TestCreateOrderGmpayV1SolNative(t *testing.T) {
 	}
 }
 
-func doGet(e *echo.Echo, path string) *httptest.ResponseRecorder {
-	req := httptest.NewRequest(http.MethodGet, path, nil)
-	req.Header.Set("Authorization", testAPIToken)
-	rec := httptest.NewRecorder()
-	e.ServeHTTP(rec, req)
-	return rec
-}
-
-func doPostWithToken(e *echo.Echo, path string, body map[string]interface{}) *httptest.ResponseRecorder {
-	jsonBytes, _ := json.Marshal(body)
-	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(string(jsonBytes)))
-	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
-	req.Header.Set("Authorization", testAPIToken)
-	rec := httptest.NewRecorder()
-	e.ServeHTTP(rec, req)
-	return rec
-}
-
 func parseResp(t *testing.T, rec *httptest.ResponseRecorder) map[string]interface{} {
 	t.Helper()
 	var resp map[string]interface{}
@@ -250,6 +233,183 @@ func parseResp(t *testing.T, rec *httptest.ResponseRecorder) map[string]interfac
 	return resp
 }
 
+// signGmpayFormValues builds a signed url.Values for the GMPAY create-transaction endpoint.
+// The GMPAY middleware uses "signature" (not "sign") and "pid" (not numeric pid from EPAY).
+func signGmpayFormValues(values url.Values) url.Values {
+	if values.Get("pid") == "" {
+		values.Set("pid", testAPIToken)
+	}
+	params := make(map[string]interface{})
+	for k, vs := range values {
+		if k == "signature" || len(vs) == 0 {
+			continue
+		}
+		params[k] = vs[0]
+	}
+	sig, _ := sign.Get(params, testAPIToken)
+	values.Set("signature", sig)
+	return values
+}
+
+// TestCreateOrderGmpayV1FormData verifies that the GMPAY create-transaction endpoint
+// accepts application/x-www-form-urlencoded in addition to JSON.
+func TestCreateOrderGmpayV1FormData(t *testing.T) {
+	e := setupTestEnv(t)
+
+	values := signGmpayFormValues(url.Values{
+		"order_id":   {"test-form-001"},
+		"amount":     {"1.00"},
+		"token":      {"usdt"},
+		"currency":   {"cny"},
+		"network":    {"solana"},
+		"notify_url": {"http://localhost/notify"},
+	})
+
+	rec := doFormPost(e, "/payments/gmpay/v1/order/create-transaction", values)
+	t.Logf("Status: %d, Body: %s", rec.Code, rec.Body.String())
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", rec.Code, rec.Body.String())
+	}
+
+	var resp map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+
+	data, ok := resp["data"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected data in response, got: %v", resp)
+	}
+	if data["trade_id"] == nil || data["trade_id"] == "" {
+		t.Error("expected trade_id in response")
+	}
+	t.Logf("Form-data order created: trade_id=%v", data["trade_id"])
+}
+
+// getSupportedNetworks is a helper that calls GET /payments/gmpay/v1/supported-assets
+// and returns a map of network → []token for easy assertions.
+func getSupportedNetworks(t *testing.T, e *echo.Echo) map[string][]string {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, "/payments/gmpay/v1/supported-assets", nil)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("getSupportedNetworks: status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	resp := parseResp(t, rec)
+	rawData, _ := resp["data"].(map[string]interface{})
+	rawSupports, _ := rawData["supports"].([]interface{})
+	result := make(map[string][]string, len(rawSupports))
+	for _, item := range rawSupports {
+		row := item.(map[string]interface{})
+		network := row["network"].(string)
+		rawTokens, _ := row["tokens"].([]interface{})
+		tokens := make([]string, 0, len(rawTokens))
+		for _, tok := range rawTokens {
+			tokens = append(tokens, tok.(string))
+		}
+		result[network] = tokens
+	}
+	return result
+}
+
+// TestGetSupportedAssets_ChainTokenToggle verifies that:
+//   - disabling a chain_token removes that token (and possibly the whole network)
+//     from the /supported-assets response
+//   - re-enabling it brings it back
+func TestGetSupportedAssets_ChainTokenToggle(t *testing.T) {
+	e := setupTestEnv(t)
+
+	// Baseline: tron should appear with USDT and TRX.
+	before := getSupportedNetworks(t, e)
+	if _, ok := before["tron"]; !ok {
+		t.Fatal("expected tron in baseline supported-assets")
+	}
+
+	// Disable the tron USDT chain_token.
+	dao.Mdb.Model(&mdb.ChainToken{}).
+		Where("network = ? AND symbol = ?", "tron", "USDT").
+		Update("enabled", false)
+
+	after := getSupportedNetworks(t, e)
+	tronTokens := after["tron"]
+	for _, tok := range tronTokens {
+		if tok == "USDT" {
+			t.Fatal("USDT should be absent after disabling tron USDT chain_token")
+		}
+	}
+	t.Logf("After disabling tron USDT: tron tokens = %v", tronTokens)
+
+	// Disable the tron TRX chain_token as well — now tron has no tokens → network disappears.
+	dao.Mdb.Model(&mdb.ChainToken{}).
+		Where("network = ? AND symbol = ?", "tron", "TRX").
+		Update("enabled", false)
+
+	afterAllDisabled := getSupportedNetworks(t, e)
+	if _, ok := afterAllDisabled["tron"]; ok {
+		t.Fatal("tron should disappear from supported-assets when all its chain_tokens are disabled")
+	}
+	t.Logf("After disabling all tron tokens: networks = %v", afterAllDisabled)
+
+	// Re-enable tron USDT — tron reappears with only USDT.
+	dao.Mdb.Model(&mdb.ChainToken{}).
+		Where("network = ? AND symbol = ?", "tron", "USDT").
+		Update("enabled", true)
+
+	restored := getSupportedNetworks(t, e)
+	tronRestored, ok := restored["tron"]
+	if !ok {
+		t.Fatal("tron should reappear after re-enabling USDT chain_token")
+	}
+	found := false
+	for _, tok := range tronRestored {
+		if tok == "USDT" {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("expected USDT in restored tron tokens, got %v", tronRestored)
+	}
+	t.Logf("After re-enabling tron USDT: tron tokens = %v", tronRestored)
+}
+
+// TestGetSupportedAssets_WalletAddressToggle verifies that:
+//   - disabling ALL wallet addresses for a network removes that network from
+//     the /supported-assets response (even if chain + tokens are still enabled)
+//   - re-enabling any address brings the network back
+func TestGetSupportedAssets_WalletAddressToggle(t *testing.T) {
+	e := setupTestEnv(t)
+
+	// Baseline: solana should be present.
+	before := getSupportedNetworks(t, e)
+	if _, ok := before["solana"]; !ok {
+		t.Fatal("expected solana in baseline supported-assets")
+	}
+
+	// Disable the only solana wallet address.
+	dao.Mdb.Model(&mdb.WalletAddress{}).
+		Where("network = ?", mdb.NetworkSolana).
+		Update("status", mdb.TokenStatusDisable)
+
+	after := getSupportedNetworks(t, e)
+	if _, ok := after["solana"]; ok {
+		t.Fatal("solana should disappear from supported-assets when all its wallet addresses are disabled")
+	}
+	t.Logf("After disabling solana wallets: networks = %v", after)
+
+	// Re-enable the solana wallet.
+	dao.Mdb.Model(&mdb.WalletAddress{}).
+		Where("network = ?", mdb.NetworkSolana).
+		Update("status", mdb.TokenStatusEnable)
+
+	restored := getSupportedNetworks(t, e)
+	if _, ok := restored["solana"]; !ok {
+		t.Fatal("solana should reappear after re-enabling its wallet address")
+	}
+	t.Logf("After re-enabling solana wallets: solana tokens = %v", restored["solana"])
+}
+
 func TestGetSupportedAssetsPublic(t *testing.T) {
 	e := setupTestEnv(t)
 
@@ -291,239 +451,6 @@ func TestGetSupportedAssetsPublic(t *testing.T) {
 	}
 }
 
-func TestSupportedAssetCRUD(t *testing.T) {
-	e := setupTestEnv(t)
-
-	// public query list (no auth)
-	req := httptest.NewRequest(http.MethodGet, "/payments/gmpay/v1/supported-assets/records", nil)
-	rec := httptest.NewRecorder()
-	e.ServeHTTP(rec, req)
-	resp := parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("public list failed: %v", resp)
-	}
-
-	// create requires auth
-	rec = doPostWithToken(e, "/payments/gmpay/v1/supported-assets/add", map[string]interface{}{
-		"network": "arb",
-		"token":   "usdt",
-		"status":  1,
-	})
-	resp = parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("add supported asset failed: %v", resp)
-	}
-	created := resp["data"].(map[string]interface{})
-	assetID := fmt.Sprintf("%.0f", created["id"].(float64))
-
-	// get by id is public
-	req = httptest.NewRequest(http.MethodGet, "/payments/gmpay/v1/supported-assets/"+assetID, nil)
-	rec = httptest.NewRecorder()
-	e.ServeHTTP(rec, req)
-	resp = parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("public get by id failed: %v", resp)
-	}
-
-	// update requires auth
-	rec = doPostWithToken(e, "/payments/gmpay/v1/supported-assets/"+assetID+"/update", map[string]interface{}{
-		"network": "arbitrum",
-		"token":   "usdc",
-		"status":  1,
-	})
-	resp = parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("update supported asset failed: %v", resp)
-	}
-	updated := resp["data"].(map[string]interface{})
-	if updated["network"] != "arbitrum" || updated["token"] != "USDC" {
-		t.Fatalf("unexpected updated data: %v", updated)
-	}
-
-	// delete requires auth
-	rec = doPostWithToken(e, "/payments/gmpay/v1/supported-assets/"+assetID+"/delete", nil)
-	resp = parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("delete supported asset failed: %v", resp)
-	}
-
-	// recreate after delete should restore soft-deleted row, not unique-conflict
-	rec = doPostWithToken(e, "/payments/gmpay/v1/supported-assets/add", map[string]interface{}{
-		"network": "arbitrum",
-		"token":   "usdc",
-		"status":  1,
-	})
-	resp = parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("recreate after delete failed: %v", resp)
-	}
-}
-
-// TestWalletAddAndList tests adding wallets via API and listing them.
-func TestWalletAddAndList(t *testing.T) {
-	e := setupTestEnv(t)
-
-	// Add a solana wallet
-	rec := doPostWithToken(e, "/payments/gmpay/v1/wallet/add", map[string]interface{}{
-		"network": "solana",
-		"address": "NewSolWallet001",
-	})
-	t.Logf("Add: %s", rec.Body.String())
-	resp := parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("add wallet failed: %v", resp)
-	}
-
-	// Add a tron wallet
-	rec = doPostWithToken(e, "/payments/gmpay/v1/wallet/add", map[string]interface{}{
-		"network": "tron",
-		"address": "NewTronWallet001",
-	})
-	resp = parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("add tron wallet failed: %v", resp)
-	}
-
-	// List all wallets
-	rec = doGet(e, "/payments/gmpay/v1/wallet/list")
-	resp = parseResp(t, rec)
-	wallets := resp["data"].([]interface{})
-	// 2 seeded + 2 added = 4
-	if len(wallets) != 4 {
-		t.Fatalf("expected 4 wallets, got %d: %v", len(wallets), wallets)
-	}
-
-	// List by network
-	rec = doGet(e, "/payments/gmpay/v1/wallet/list?network=solana")
-	resp = parseResp(t, rec)
-	wallets = resp["data"].([]interface{})
-	if len(wallets) != 2 {
-		t.Fatalf("expected 2 solana wallets, got %d", len(wallets))
-	}
-
-	rec = doGet(e, "/payments/gmpay/v1/wallet/list?network=tron")
-	resp = parseResp(t, rec)
-	wallets = resp["data"].([]interface{})
-	if len(wallets) != 2 {
-		t.Fatalf("expected 2 tron wallets, got %d", len(wallets))
-	}
-}
-
-// TestWalletDuplicateRejected tests that adding the same network+address twice fails.
-func TestWalletDuplicateRejected(t *testing.T) {
-	e := setupTestEnv(t)
-
-	body := map[string]interface{}{"network": "solana", "address": "DupWallet001"}
-	rec := doPostWithToken(e, "/payments/gmpay/v1/wallet/add", body)
-	resp := parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("first add failed: %v", resp)
-	}
-
-	// Same network+address should fail
-	rec = doPostWithToken(e, "/payments/gmpay/v1/wallet/add", body)
-	resp = parseResp(t, rec)
-	if resp["status_code"].(float64) == 200 {
-		t.Fatal("expected duplicate to be rejected")
-	}
-	t.Logf("Duplicate rejected: %v", resp["message"])
-
-	// Same address, different network should succeed
-	rec = doPostWithToken(e, "/payments/gmpay/v1/wallet/add", map[string]interface{}{
-		"network": "tron",
-		"address": "DupWallet001",
-	})
-	resp = parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("same address on different network should succeed: %v", resp)
-	}
-}
-
-// TestWalletStatusAndDelete tests enable/disable/delete operations.
-func TestWalletStatusAndDelete(t *testing.T) {
-	e := setupTestEnv(t)
-
-	// Add a wallet
-	rec := doPostWithToken(e, "/payments/gmpay/v1/wallet/add", map[string]interface{}{
-		"network": "solana",
-		"address": "StatusTestWallet",
-	})
-	resp := parseResp(t, rec)
-	wallet := resp["data"].(map[string]interface{})
-	walletID := fmt.Sprintf("%.0f", wallet["id"].(float64))
-
-	// Get wallet
-	rec = doGet(e, "/payments/gmpay/v1/wallet/"+walletID)
-	resp = parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("get wallet failed: %v", resp)
-	}
-
-	// Disable wallet
-	rec = doPostWithToken(e, "/payments/gmpay/v1/wallet/"+walletID+"/status", map[string]interface{}{
-		"status": 2,
-	})
-	resp = parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("disable wallet failed: %v", resp)
-	}
-
-	// Verify disabled — should not appear in available list
-	rec = doGet(e, "/payments/gmpay/v1/wallet/list?network=solana")
-	resp = parseResp(t, rec)
-	wallets := resp["data"].([]interface{})
-	for _, w := range wallets {
-		wm := w.(map[string]interface{})
-		if wm["address"] == "StatusTestWallet" && wm["status"].(float64) != 2 {
-			t.Error("wallet should be disabled")
-		}
-	}
-
-	// Delete wallet
-	rec = doPostWithToken(e, "/payments/gmpay/v1/wallet/"+walletID+"/delete", nil)
-	resp = parseResp(t, rec)
-	if resp["status_code"].(float64) != 200 {
-		t.Fatalf("delete wallet failed: %v", resp)
-	}
-
-	// Verify deleted
-	rec = doGet(e, "/payments/gmpay/v1/wallet/"+walletID)
-	resp = parseResp(t, rec)
-	// Should return not found
-	if resp["status_code"].(float64) == 200 {
-		data := resp["data"].(map[string]interface{})
-		if data["id"].(float64) > 0 {
-			t.Error("wallet should be deleted")
-		}
-	}
-}
-
-// TestWalletAuthRequired tests that wallet APIs require auth token.
-func TestWalletAuthRequired(t *testing.T) {
-	e := setupTestEnv(t)
-
-	// No auth header — should not return success
-	req := httptest.NewRequest(http.MethodGet, "/payments/gmpay/v1/wallet/list", nil)
-	rec := httptest.NewRecorder()
-	e.ServeHTTP(rec, req)
-
-	// The response should indicate auth failure (not 200 success)
-	var resp map[string]interface{}
-	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
-		// echo may return plain text error
-		if rec.Code == http.StatusOK {
-			t.Error("expected auth failure without token")
-		}
-		t.Logf("Auth rejected (non-JSON): status=%d body=%s", rec.Code, rec.Body.String())
-		return
-	}
-	statusCode, _ := resp["status_code"].(float64)
-	if statusCode == 200 {
-		t.Error("expected auth failure without token")
-	}
-	t.Logf("Auth rejected: %v", resp)
-}
-
 // TestCreateOrderNetworkIsolation verifies tron and solana wallets don't mix.
 func TestCreateOrderNetworkIsolation(t *testing.T) {
 	e := setupTestEnv(t)
@@ -602,3 +529,159 @@ func TestEpaySubmitPhpPostFormCompatible(t *testing.T) {
 		t.Fatalf("expected checkout redirect, got %q", rec.Header().Get("Location"))
 	}
 }
+
+// TestCheckStatus_NotFound verifies that /pay/check-status/:trade_id returns a
+// graceful JSON error (not 500) when the trade_id doesn't exist.
+func TestCheckStatus_NotFound(t *testing.T) {
+	e := setupTestEnv(t)
+	req := httptest.NewRequest(http.MethodGet, "/pay/check-status/nonexistent-trade-id", nil)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	t.Logf("CheckStatus(not found): status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code >= 500 {
+		t.Fatalf("unexpected server error: %d %s", rec.Code, rec.Body.String())
+	}
+	if rec.Code == http.StatusNotFound && rec.Body.Len() == 0 {
+		t.Fatalf("route returned 404 with empty body — route may not be registered")
+	}
+}
+
+// TestCheckStatus_WithOrder verifies /pay/check-status/:trade_id returns 200
+// and a status field when the order exists.
+func TestCheckStatus_WithOrder(t *testing.T) {
+	e := setupTestEnv(t)
+
+	// Create an order first via the GMPAY route.
+	body := signBody(map[string]interface{}{
+		"order_id":   "check-status-001",
+		"amount":     1.00,
+		"token":      "usdt",
+		"currency":   "cny",
+		"network":    "tron",
+		"notify_url": "http://localhost/notify",
+	})
+	createRec := doPost(e, "/payments/gmpay/v1/order/create-transaction", body)
+	if createRec.Code != http.StatusOK {
+		t.Fatalf("create order failed: %d %s", createRec.Code, createRec.Body.String())
+	}
+	var createResp map[string]interface{}
+	json.Unmarshal(createRec.Body.Bytes(), &createResp)
+	tradeId, _ := createResp["data"].(map[string]interface{})["trade_id"].(string)
+	if tradeId == "" {
+		t.Fatal("no trade_id in create response")
+	}
+
+	// Now check status.
+	req := httptest.NewRequest(http.MethodGet, "/pay/check-status/"+tradeId, nil)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	t.Logf("CheckStatus: status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", rec.Code, rec.Body.String())
+	}
+	var resp map[string]interface{}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	if resp["data"] == nil {
+		t.Fatal("expected data in check-status response")
+	}
+}
+
+// TestCheckoutCounter_NotFound verifies that /pay/checkout-counter/:trade_id
+// with an unknown trade_id does not return an empty 404 (which would mean the
+// route is not registered). When the static HTML template is present the
+// controller renders it with a 404 status; when it is absent (test env) the
+// controller returns a 500 with a descriptive body — both outcomes are
+// acceptable because the route IS registered and functional.
+func TestCheckoutCounter_NotFound(t *testing.T) {
+	e := setupTestEnv(t)
+	req := httptest.NewRequest(http.MethodGet, "/pay/checkout-counter/nonexistent-trade-id", nil)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	t.Logf("CheckoutCounter(not found): status=%d content-type=%s body=%s",
+		rec.Code, rec.Header().Get("Content-Type"), rec.Body.String())
+	// A completely empty 404 means the route is not registered at all.
+	if rec.Code == http.StatusNotFound && rec.Body.Len() == 0 {
+		t.Fatalf("route not registered (404 with empty body)")
+	}
+	// A 500 whose body mentions a missing file is expected in test environments
+	// where the static directory is not present.
+	if rec.Code >= 500 && rec.Body.Len() == 0 {
+		t.Fatalf("unexpected server error with empty body: %d", rec.Code)
+	}
+}
+
+// TestSwitchNetwork_MissingFields verifies that /pay/switch-network validates
+// required fields and returns a graceful error when they are missing.
+func TestSwitchNetwork_MissingFields(t *testing.T) {
+	e := setupTestEnv(t)
+	rec := doPost(e, "/pay/switch-network", map[string]interface{}{
+		// trade_id, token, network are all missing
+	})
+	t.Logf("SwitchNetwork(missing fields): status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code >= 500 {
+		t.Fatalf("unexpected server error: %d %s", rec.Code, rec.Body.String())
+	}
+	// Must return a non-200 business code for validation failure.
+	var resp map[string]interface{}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	if code, _ := resp["code"].(float64); code == 200 {
+		t.Fatal("expected validation error for missing fields, got code=200")
+	}
+}
+
+// TestSwitchNetwork_OrderNotFound verifies that /pay/switch-network returns a
+// graceful error when the referenced trade_id doesn't exist.
+func TestSwitchNetwork_OrderNotFound(t *testing.T) {
+	e := setupTestEnv(t)
+	rec := doPost(e, "/pay/switch-network", map[string]interface{}{
+		"trade_id": "nonexistent-trade-id",
+		"token":    "USDT",
+		"network":  "tron",
+	})
+	t.Logf("SwitchNetwork(not found): status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code >= 500 {
+		t.Fatalf("unexpected server error: %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+// TestSwitchNetwork_WithOrder verifies /pay/switch-network can create a
+// sub-order when given a valid parent trade_id.
+func TestSwitchNetwork_WithOrder(t *testing.T) {
+	e := setupTestEnv(t)
+
+	// Create a parent order on solana.
+	createBody := signBody(map[string]interface{}{
+		"order_id":   "switch-net-parent-001",
+		"amount":     1.00,
+		"token":      "usdt",
+		"currency":   "cny",
+		"network":    "solana",
+		"notify_url": "http://localhost/notify",
+	})
+	createRec := doPost(e, "/payments/gmpay/v1/order/create-transaction", createBody)
+	if createRec.Code != http.StatusOK {
+		t.Fatalf("create parent order failed: %d %s", createRec.Code, createRec.Body.String())
+	}
+	var createResp map[string]interface{}
+	json.Unmarshal(createRec.Body.Bytes(), &createResp)
+	tradeId, _ := createResp["data"].(map[string]interface{})["trade_id"].(string)
+	if tradeId == "" {
+		t.Fatal("no trade_id in create response")
+	}
+
+	// Switch to tron.
+	rec := doPost(e, "/pay/switch-network", map[string]interface{}{
+		"trade_id": tradeId,
+		"token":    "USDT",
+		"network":  "tron",
+	})
+	t.Logf("SwitchNetwork(valid): status=%d body=%s", rec.Code, rec.Body.String())
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", rec.Code, rec.Body.String())
+	}
+	var resp map[string]interface{}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	if resp["data"] == nil {
+		t.Fatal("expected data in switch-network response")
+	}
+}

src/task/listen.go

@@ -7,20 +7,35 @@ import (
 
 func Start() {
 	log.Sugar.Info("[task] Starting task scheduler...")
+	// The ETH listener short-circuits internally when chain is disabled
+	// or no tokens are configured, so always launch the goroutine.
 	go StartEthereumWebSocketListener()
 	go StartBscWebSocketListener()
 	go StartPolygonWebSocketListener()
 	go StartPlasmaWebSocketListener()
-	go StartTronTrc20WebSocketListener()
 
 	c := cron.New()
-	// solana钱包监听
+	// TRC20 polling
-	_, err := c.AddJob("@every 5s", ListenSolJob{})
+	_, err := c.AddJob("@every 5s", ListenTrc20Job{})
+	if err != nil {
+		log.Sugar.Errorf("[task] Failed to add ListenTrc20Job: %v", err)
+		return
+	}
+	log.Sugar.Info("[task] ListenTrc20Job scheduled successfully (@every 5s)")
+	// Solana polling
+	_, err = c.AddJob("@every 5s", ListenSolJob{})
 	if err != nil {
 		log.Sugar.Errorf("[task] Failed to add ListenSolJob: %v", err)
 		return
 	}
 	log.Sugar.Info("[task] ListenSolJob scheduled successfully (@every 5s)")
+	// RPC node health checks
+	_, err = c.AddJob("@every 30s", RpcHealthJob{})
+	if err != nil {
+		log.Sugar.Errorf("[task] Failed to add RpcHealthJob: %v", err)
+		return
+	}
+	log.Sugar.Info("[task] RpcHealthJob scheduled successfully (@every 30s)")
 	c.Start()
 	log.Sugar.Info("[task] Task scheduler started")
 }

src/task/listen_bsc.go

@@ -18,11 +18,7 @@ import (
 	"github.com/ethereum/go-ethereum/ethclient"
 )
 
-var (
+const bscDefaultWsURL = "wss://bsc.drpc.org"
-	// USDT / USDC 合约地址（BSC 主网）
-	bscUsdtContract = common.HexToAddress("0x55d398326f99059fF775485246999027B3197955")
-	bscUsdcContract = common.HexToAddress("0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d")
-)
 
 type bscRecipientSnapshot struct {
 	addrs map[string]struct{}
@@ -30,7 +26,24 @@ type bscRecipientSnapshot struct {
 
 var bscWatchedRecipients atomic.Pointer[bscRecipientSnapshot]
 
+// StartBscWebSocketListener drives the BSC listener. Checks chain
+// enable status and reloads contract addresses from chain_tokens every
+// 10s so admin-side toggles take effect without a restart.
 func StartBscWebSocketListener() {
+	for {
+		if data.IsChainEnabled(mdb.NetworkBsc) {
+			if contracts := loadChainTokenContracts(mdb.NetworkBsc, "[BSC-WS]"); len(contracts) > 0 {
+				runBscListener(contracts)
+			}
+		}
+		time.Sleep(10 * time.Second)
+	}
+}
+
+func runBscListener(contracts []common.Address) {
+	ctx, cancel := chainEnabledWatchdog(mdb.NetworkBsc, "[BSC-WS]", chainTokenFingerprint(mdb.NetworkBsc))
+	defer cancel()
+
 	wallets, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkBsc)
 	if err != nil {
 		log.Sugar.Errorf("[BSC-WS] Failed to get wallet addresses: %v", err)
@@ -40,25 +53,30 @@ func StartBscWebSocketListener() {
 	go func() {
 		ticker := time.NewTicker(5 * time.Second)
 		defer ticker.Stop()
-		for range ticker.C {
+		for {
-			w, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkBsc)
+			select {
-			if err != nil {
+			case <-ctx.Done():
-				log.Sugar.Warnf("[BSC-WS] refresh wallet addresses: %v", err)
+				return
-				continue
+			case <-ticker.C:
+				w, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkBsc)
+				if err != nil {
+					log.Sugar.Warnf("[BSC-WS] refresh wallet addresses: %v", err)
+					continue
+				}
+				storeBscRecipientsFromWallets(w)
 			}
-			storeBscRecipientsFromWallets(w)
 		}
 	}()
-	wsURL := "wss://bsc.drpc.org"
+
+	wsURL := resolveChainWsURL(mdb.NetworkBsc, bscDefaultWsURL)
+	log.Sugar.Infof("[BSC-WS] connecting to %s watching %d contract(s)", wsURL, len(contracts))
+
 	query := ethereum.FilterQuery{
-		Addresses: []common.Address{
+		Addresses: contracts,
-			bscUsdtContract,
+		Topics:    [][]common.Hash{},
-			bscUsdcContract,
-		},
-		Topics: [][]common.Hash{},
 	}
 
-	runWsLogListener("[BSC-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
+	runEvmWsLogListener(ctx, "[BSC-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
 		if len(vLog.Topics) < 3 {
 			return
 		}

src/task/listen_chain_common.go

@@ -0,0 +1,101 @@
+package task
+
+import (
+	"context"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/assimon/luuu/util/log"
+
+	"github.com/ethereum/go-ethereum/common"
+)
+
+// chainEnabledWatchdog returns a cancellable context whose cancel() is
+// invoked when either:
+//  1. IsChainEnabled(network) returns false — admin disabled the chain
+//  2. The enabled-token fingerprint changes — admin added/removed/
+//     toggled a chain_tokens row for this network
+//
+// Both cases need the listener to exit so the outer loop can reconnect
+// with the fresh token set (EVM WebSocket subscriptions are fixed at
+// connect time; to pick up a new contract we must re-subscribe).
+//
+// initialFingerprint is the fingerprint computed BEFORE connecting; the
+// watchdog compares every 10s tick against this baseline. Caller must
+// defer the returned cancel func to release the goroutine.
+func chainEnabledWatchdog(network, logPrefix, initialFingerprint string) (context.Context, context.CancelFunc) {
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		ticker := time.NewTicker(10 * time.Second)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				if !data.IsChainEnabled(network) {
+					log.Sugar.Infof("%s chain disabled, stopping listener", logPrefix)
+					cancel()
+					return
+				}
+				if fp := chainTokenFingerprint(network); fp != initialFingerprint {
+					log.Sugar.Infof("%s chain_tokens changed (was %q → now %q), reconnecting", logPrefix, initialFingerprint, fp)
+					cancel()
+					return
+				}
+			}
+		}
+	}()
+	return ctx, cancel
+}
+
+// chainTokenFingerprint returns a stable string representing the
+// enabled-token set for a network. Used by chainEnabledWatchdog to
+// detect admin changes between polls.
+func chainTokenFingerprint(network string) string {
+	tokens, err := data.ListEnabledChainTokensByNetwork(network)
+	if err != nil {
+		return ""
+	}
+	parts := make([]string, 0, len(tokens))
+	for _, t := range tokens {
+		parts = append(parts, strings.ToLower(strings.TrimSpace(t.ContractAddress))+"|"+strings.ToUpper(strings.TrimSpace(t.Symbol)))
+	}
+	sort.Strings(parts)
+	return strings.Join(parts, ",")
+}
+
+// loadChainTokenContracts reads enabled tokens for a network and returns
+// their contract addresses as ethereum-go common.Address values. Rows
+// with blank contract_address (e.g. Solana native SOL marker) are
+// skipped. Callers use the length to decide whether to connect or idle.
+func loadChainTokenContracts(network, logPrefix string) []common.Address {
+	tokens, err := data.ListEnabledChainTokensByNetwork(network)
+	if err != nil {
+		log.Sugar.Errorf("%s load chain_tokens err=%v", logPrefix, err)
+		return nil
+	}
+	addrs := make([]common.Address, 0, len(tokens))
+	for _, t := range tokens {
+		c := strings.TrimSpace(t.ContractAddress)
+		if c == "" {
+			continue
+		}
+		addrs = append(addrs, common.HexToAddress(c))
+	}
+	return addrs
+}
+
+// resolveChainWsURL picks a healthy WS endpoint from rpc_nodes for the
+// given network, falling back to the provided default (usually the
+// public node URL) when no row is configured.
+func resolveChainWsURL(network, fallback string) string {
+	node, err := data.SelectRpcNode(network, mdb.RpcNodeTypeWs)
+	if err == nil && node != nil && node.ID > 0 {
+		return node.Url
+	}
+	return fallback
+}

src/task/listen_eth.go

@@ -7,6 +7,7 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/assimon/luuu/config"
 	"github.com/assimon/luuu/model/data"
 	"github.com/assimon/luuu/model/mdb"
 	"github.com/assimon/luuu/model/service"
@@ -18,15 +19,24 @@ import (
 	"github.com/ethereum/go-ethereum/ethclient"
 )
 
-var (
+// Transfer 事件签名 — ERC-20 signature, same on every EVM chain.
+var transferEventHash = common.HexToHash("0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef")
 
-	// USDT / USDC 合约地址（ETH 主网）
+const ethereumDefaultWsURL = "wss://ethereum.publicnode.com"
-	usdtContract = common.HexToAddress("0xdAC17F958D2ee523a2206206994597C13D831ec7")
-	usdcContract = common.HexToAddress("0xA0b86991c6218b36c1d19d4a2e9eb0ce3606eb48")
 
-	// Transfer 事件签名
+// resolveEthereumWsURL picks a healthy WS endpoint. Falls back to the
-	transferEventHash = common.HexToHash("0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef")
+// legacy .env value (if set) before the shared default — keeps existing
-)
+// deployments working until the admin adds an rpc_nodes row.
+func resolveEthereumWsURL() string {
+	node, err := data.SelectRpcNode(mdb.NetworkEthereum, mdb.RpcNodeTypeWs)
+	if err == nil && node != nil && node.ID > 0 {
+		return node.Url
+	}
+	if u := config.GetEthereumWsUrl(); u != "" {
+		return u
+	}
+	return ethereumDefaultWsURL
+}
 
 type ethRecipientSnapshot struct {
 	addrs map[string]struct{}
@@ -35,47 +45,68 @@ type ethRecipientSnapshot struct {
 var ethWatchedRecipients atomic.Pointer[ethRecipientSnapshot]
 
 func StartEthereumWebSocketListener() {
+	// Wait until the chain is enabled AND at least one token contract
+	// is configured. Polls every 10s so admin-side toggles kick in
+	// without a restart. Once conditions are met we proceed to connect;
+	// if the websocket later drops we exit the loop and rely on the
+	// process-level restart to reconnect (same as before this refactor).
+	for {
+		if data.IsChainEnabled(mdb.NetworkEthereum) {
+			if contracts := loadChainTokenContracts(mdb.NetworkEthereum, "[ETH-WS]"); len(contracts) > 0 {
+				runEthereumListener(contracts)
+			}
+		}
+		time.Sleep(10 * time.Second)
+	}
+}
+
+func runEthereumListener(contracts []common.Address) {
+	ctx, cancel := chainEnabledWatchdog(mdb.NetworkEthereum, "[ETH-WS]", chainTokenFingerprint(mdb.NetworkEthereum))
+	defer cancel()
+
 	wallets, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkEthereum)
 	if err != nil {
-		log.Sugar.Errorf("Failed to get wallet addresses: %v", err)
+		log.Sugar.Errorf("[ETH-WS] Failed to get wallet addresses: %v", err)
 		return
 	}
 	StoreEthRecipientsFromWallets(wallets)
 	go func() {
 		ticker := time.NewTicker(5 * time.Second)
 		defer ticker.Stop()
-		for range ticker.C {
+		for {
-			w, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkEthereum)
+			select {
-			if err != nil {
+			case <-ctx.Done():
-				log.Sugar.Warnf("[ETH-WS] refresh wallet addresses: %v", err)
+				return
-				continue
+			case <-ticker.C:
+				w, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkEthereum)
+				if err != nil {
+					log.Sugar.Warnf("[ETH-WS] refresh wallet addresses: %v", err)
+					continue
+				}
+				StoreEthRecipientsFromWallets(w)
 			}
-			StoreEthRecipientsFromWallets(w)
 		}
 	}()
-	wsURL := "wss://ethereum.publicnode.com"
+
+	wsURL := resolveEthereumWsURL()
+	log.Sugar.Infof("[ETH-WS] connecting to %s watching %d contract(s)", wsURL, len(contracts))
+
 	query := ethereum.FilterQuery{
-		Addresses: []common.Address{
+		Addresses: contracts,
-			usdtContract,
+		Topics:    [][]common.Hash{},
-			usdcContract,
-		},
-		Topics: [][]common.Hash{},
 	}
 
-	runWsLogListener("[ETH-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
+	runEvmWsLogListener(ctx, "[ETH-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
 		if len(vLog.Topics) < 3 {
 			return
 		}
-
 		event := vLog.Topics[0].String()
 		if event != transferEventHash.String() {
 			return
 		}
 
 		amount := new(big.Int).SetBytes(vLog.Data)
-
 		toAddr := common.HexToAddress(vLog.Topics[2].Hex())
-
 		if !isWatchedEthRecipient(toAddr) {
 			return
 		}
@@ -115,18 +146,3 @@ func isWatchedEthRecipient(to common.Address) bool {
 	return ok
 }
 
-func formatAmount(amount *big.Int, decimals int) string {
-	f := new(big.Float).SetInt(amount)
-	divisor := new(big.Float).SetFloat64(float64Pow(10, decimals))
-	result := new(big.Float).Quo(f, divisor)
-
-	return result.Text('f', 6)
-}
-
-func float64Pow(a, b int) float64 {
-	result := 1.0
-	for i := 0; i < b; i++ {
-		result *= float64(a)
-	}
-	return result
-}

src/task/listen_evm_ws.go

@@ -11,7 +11,12 @@ import (
 	"github.com/ethereum/go-ethereum/ethclient"
 )
 
-func runWsLogListener(logPrefix, wsURL string, query ethereum.FilterQuery, handleLog func(*ethclient.Client, types.Log)) {
+// runEvmWsLogListener connects to wsURL, subscribes to Transfer logs,
+// and dispatches each log to handleLog. It retries on transient errors
+// with exponential backoff. The ctx lets the caller trigger a clean
+// exit — e.g. when admin disables the chain, the caller cancels the
+// context and the function returns instead of reconnecting forever.
+func runEvmWsLogListener(ctx context.Context, logPrefix, wsURL string, query ethereum.FilterQuery, handleLog func(*ethclient.Client, types.Log)) {
 	const (
 		minBackoff = 2 * time.Second
 		maxBackoff = 60 * time.Second
@@ -20,34 +25,47 @@ func runWsLogListener(logPrefix, wsURL string, query ethereum.FilterQuery, handl
 	failWait := minBackoff
 
 	for {
+		if ctx.Err() != nil {
+			return
+		}
+
 		client, err := ethclient.Dial(wsURL)
 		if err != nil {
 			log.Sugar.Warnf("%s dial: %v, retry in %s", logPrefix, err, failWait)
-			time.Sleep(failWait)
+			if !sleepOrDone(ctx, failWait) {
+				return
+			}
 			failWait = nextBackoff(failWait, maxBackoff)
 			continue
 		}
 
 		logsCh := make(chan types.Log)
-		sub, err := client.SubscribeFilterLogs(context.Background(), query, logsCh)
+		sub, err := client.SubscribeFilterLogs(ctx, query, logsCh)
 		if err != nil {
 			client.Close()
 			log.Sugar.Warnf("%s subscribe: %v, retry in %s", logPrefix, err, failWait)
-			time.Sleep(failWait)
+			if !sleepOrDone(ctx, failWait) {
+				return
+			}
 			failWait = nextBackoff(failWait, maxBackoff)
 			continue
 		}
 		failWait = minBackoff
 
-		log.Sugar.Infof("%s connected, subscribed to USDT/USDC Transfer logs", logPrefix)
+		log.Sugar.Infof("%s connected, subscribed to Transfer logs", logPrefix)
 
-		recvLoop(client, sub, logsCh, logPrefix, handleLog)
+		recvLoop(ctx, client, sub, logsCh, logPrefix, handleLog)
 
-		time.Sleep(rejoinWait)
+		if ctx.Err() != nil {
+			return
+		}
+		if !sleepOrDone(ctx, rejoinWait) {
+			return
+		}
 	}
 }
 
-func recvLoop(client *ethclient.Client, sub ethereum.Subscription, logsCh <-chan types.Log, logPrefix string, handleLog func(*ethclient.Client, types.Log)) {
+func recvLoop(ctx context.Context, client *ethclient.Client, sub ethereum.Subscription, logsCh <-chan types.Log, logPrefix string, handleLog func(*ethclient.Client, types.Log)) {
 	defer func() {
 		sub.Unsubscribe()
 		client.Close()
@@ -55,6 +73,9 @@ func recvLoop(client *ethclient.Client, sub ethereum.Subscription, logsCh <-chan
 
 	for {
 		select {
+		case <-ctx.Done():
+			log.Sugar.Infof("%s context cancelled, stopping", logPrefix)
+			return
 		case err := <-sub.Err():
 			if err != nil {
 				log.Sugar.Warnf("%s subscription error: %v, reconnecting", logPrefix, err)
@@ -72,6 +93,20 @@ func recvLoop(client *ethclient.Client, sub ethereum.Subscription, logsCh <-chan
 	}
 }
 
+// sleepOrDone waits for d or for ctx cancellation, whichever comes
+// first. Returns true if the sleep completed normally, false if ctx
+// was cancelled (caller should exit).
+func sleepOrDone(ctx context.Context, d time.Duration) bool {
+	t := time.NewTimer(d)
+	defer t.Stop()
+	select {
+	case <-ctx.Done():
+		return false
+	case <-t.C:
+		return true
+	}
+}
+
 func nextBackoff(cur, max time.Duration) time.Duration {
 	n := cur * 2
 	if n > max {

src/task/listen_plasma.go

@@ -18,9 +18,7 @@ import (
 	"github.com/ethereum/go-ethereum/ethclient"
 )
 
-var (
+const plasmaDefaultWsURL = "wss://rpc.plasma.to"
-	plasmaUsdt0Contract = common.HexToAddress("0xB8CE59FC3717ada4C02eaDF9682A9e934F625ebb")
-)
 
 type plasmaRecipientSnapshot struct {
 	addrs map[string]struct{}
@@ -28,7 +26,23 @@ type plasmaRecipientSnapshot struct {
 
 var plasmaWatchedRecipients atomic.Pointer[plasmaRecipientSnapshot]
 
+// StartPlasmaWebSocketListener drives the Plasma listener with dynamic
+// chain/token config reload every 10s.
 func StartPlasmaWebSocketListener() {
+	for {
+		if data.IsChainEnabled(mdb.NetworkPlasma) {
+			if contracts := loadChainTokenContracts(mdb.NetworkPlasma, "[PLASMA-WS]"); len(contracts) > 0 {
+				runPlasmaListener(contracts)
+			}
+		}
+		time.Sleep(10 * time.Second)
+	}
+}
+
+func runPlasmaListener(contracts []common.Address) {
+	ctx, cancel := chainEnabledWatchdog(mdb.NetworkPlasma, "[PLASMA-WS]", chainTokenFingerprint(mdb.NetworkPlasma))
+	defer cancel()
+
 	wallets, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkPlasma)
 	if err != nil {
 		log.Sugar.Errorf("[PLASMA-WS] Failed to get wallet addresses: %v", err)
@@ -38,23 +52,30 @@ func StartPlasmaWebSocketListener() {
 	go func() {
 		ticker := time.NewTicker(5 * time.Second)
 		defer ticker.Stop()
-		for range ticker.C {
+		for {
-			w, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkPlasma)
+			select {
-			if err != nil {
+			case <-ctx.Done():
-				log.Sugar.Warnf("[PLASMA-WS] refresh wallet addresses: %v", err)
+				return
-				continue
+			case <-ticker.C:
+				w, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkPlasma)
+				if err != nil {
+					log.Sugar.Warnf("[PLASMA-WS] refresh wallet addresses: %v", err)
+					continue
+				}
+				storePlasmaRecipientsFromWallets(w)
 			}
-			storePlasmaRecipientsFromWallets(w)
 		}
 	}()
-	// 文档提供 https://rpc.plasma.to；常见实现同主机 wss
+
-	wsURL := "wss://rpc.plasma.to"
+	wsURL := resolveChainWsURL(mdb.NetworkPlasma, plasmaDefaultWsURL)
+	log.Sugar.Infof("[PLASMA-WS] connecting to %s watching %d contract(s)", wsURL, len(contracts))
+
 	query := ethereum.FilterQuery{
-		Addresses: []common.Address{plasmaUsdt0Contract},
+		Addresses: contracts,
 		Topics:    [][]common.Hash{},
 	}
 
-	runWsLogListener("[PLASMA-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
+	runEvmWsLogListener(ctx, "[PLASMA-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
 		if len(vLog.Topics) < 3 {
 			return
 		}

src/task/listen_polygon.go

@@ -18,12 +18,7 @@ import (
 	"github.com/ethereum/go-ethereum/ethclient"
 )
 
-var (
+const polygonDefaultWsURL = "wss://polygon-bor-rpc.publicnode.com"
-	// Polygon PoS 主网 USDT / USDC（原生）/ USDC.e（桥接）
-	polygonUsdtContract  = common.HexToAddress("0xc2132D05D31c914a87C6611C10748AEb04B58e8F")
-	polygonUsdcContract  = common.HexToAddress("0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359")
-	polygonUsdcEContract = common.HexToAddress("0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174")
-)
 
 type polygonRecipientSnapshot struct {
 	addrs map[string]struct{}
@@ -31,7 +26,23 @@ type polygonRecipientSnapshot struct {
 
 var polygonWatchedRecipients atomic.Pointer[polygonRecipientSnapshot]
 
+// StartPolygonWebSocketListener drives the Polygon listener with
+// dynamic chain/token config reload every 10s.
 func StartPolygonWebSocketListener() {
+	for {
+		if data.IsChainEnabled(mdb.NetworkPolygon) {
+			if contracts := loadChainTokenContracts(mdb.NetworkPolygon, "[POLYGON-WS]"); len(contracts) > 0 {
+				runPolygonListener(contracts)
+			}
+		}
+		time.Sleep(10 * time.Second)
+	}
+}
+
+func runPolygonListener(contracts []common.Address) {
+	ctx, cancel := chainEnabledWatchdog(mdb.NetworkPolygon, "[POLYGON-WS]", chainTokenFingerprint(mdb.NetworkPolygon))
+	defer cancel()
+
 	wallets, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkPolygon)
 	if err != nil {
 		log.Sugar.Errorf("[POLYGON-WS] Failed to get wallet addresses: %v", err)
@@ -41,26 +52,30 @@ func StartPolygonWebSocketListener() {
 	go func() {
 		ticker := time.NewTicker(5 * time.Second)
 		defer ticker.Stop()
-		for range ticker.C {
+		for {
-			w, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkPolygon)
+			select {
-			if err != nil {
+			case <-ctx.Done():
-				log.Sugar.Warnf("[POLYGON-WS] refresh wallet addresses: %v", err)
+				return
-				continue
+			case <-ticker.C:
+				w, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkPolygon)
+				if err != nil {
+					log.Sugar.Warnf("[POLYGON-WS] refresh wallet addresses: %v", err)
+					continue
+				}
+				storePolygonRecipientsFromWallets(w)
 			}
-			storePolygonRecipientsFromWallets(w)
 		}
 	}()
-	wsURL := "wss://polygon-bor-rpc.publicnode.com"
+
+	wsURL := resolveChainWsURL(mdb.NetworkPolygon, polygonDefaultWsURL)
+	log.Sugar.Infof("[POLYGON-WS] connecting to %s watching %d contract(s)", wsURL, len(contracts))
+
 	query := ethereum.FilterQuery{
-		Addresses: []common.Address{
+		Addresses: contracts,
-			polygonUsdtContract,
+		Topics:    [][]common.Hash{},
-			polygonUsdcContract,
-			polygonUsdcEContract,
-		},
-		Topics: [][]common.Hash{},
 	}
 
-	runWsLogListener("[POLYGON-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
+	runEvmWsLogListener(ctx, "[POLYGON-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
 		if len(vLog.Topics) < 3 {
 			return
 		}

src/task/listen_sol_job.go

@@ -17,6 +17,10 @@ func (r ListenSolJob) Run() {
 	gListenSolJobLock.Lock()
 	defer gListenSolJobLock.Unlock()
 	log.Sugar.Debug("[ListenSolJob] Job triggered")
+	if !data.IsChainEnabled(mdb.NetworkSolana) {
+		log.Sugar.Debug("[ListenSolJob] chain disabled, skipping")
+		return
+	}
 	walletAddress, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkSolana)
 	if err != nil {
 		log.Sugar.Errorf("[ListenSolJob] Failed to get wallet addresses: %v", err)

src/task/listen_trc20_job.go

@@ -1,116 +1,43 @@
 package task
 
 import (
-	"context"
+	"sync"
-	"math/big"
-	"strings"
-	"sync/atomic"
-	"time"
 
-	tron "github.com/assimon/luuu/crypto"
 	"github.com/assimon/luuu/model/data"
 	"github.com/assimon/luuu/model/mdb"
 	"github.com/assimon/luuu/model/service"
 	"github.com/assimon/luuu/util/log"
-	"github.com/ethereum/go-ethereum"
-	"github.com/ethereum/go-ethereum/common"
-	"github.com/ethereum/go-ethereum/core/types"
-	"github.com/ethereum/go-ethereum/ethclient"
 )
 
-const tronUsdtContractBase58 = "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t"
+type ListenTrc20Job struct{}
 
-// TronGrid 的 JSON-RPC 使用 20-byte hex 地址（去掉 Tron 主网 0x41 前缀）。
+var gListenTrc20JobLock sync.Mutex
-var tronUsdtTrc20Contract = common.HexToAddress("0xa614f803b6fd780986a42c78ec9c7f77e6ded13c")
 
-type tronRecipientSnapshot struct {
+func (r ListenTrc20Job) Run() {
-	addrs map[string]struct{}
+	gListenTrc20JobLock.Lock()
-}
+	defer gListenTrc20JobLock.Unlock()
-
+	log.Sugar.Debug("[ListenTrc20Job] Job triggered")
-var tronWatchedRecipients atomic.Pointer[tronRecipientSnapshot]
+	if !data.IsChainEnabled(mdb.NetworkTron) {
-
+		log.Sugar.Debug("[ListenTrc20Job] chain disabled, skipping")
-func StartTronTrc20WebSocketListener() {
-	log.Sugar.Infof("[TRON-WS] listening contract base58=%s hex=%s", tronUsdtContractBase58, tronUsdtTrc20Contract.Hex())
-
-	wallets, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkTron)
-	if err != nil {
-		log.Sugar.Errorf("[TRON-WS] Failed to get wallet addresses: %v", err)
 		return
 	}
-	storeTronRecipientsFromWallets(wallets)
+	walletAddress, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkTron)
-	go func() {
+	if err != nil {
-		ticker := time.NewTicker(5 * time.Second)
+		log.Sugar.Errorf("[ListenTrc20Job] Failed to get wallet addresses: %v", err)
-		defer ticker.Stop()
+		return
-		for range ticker.C {
-			w, err := data.GetAvailableWalletAddressByNetwork(mdb.NetworkTron)
-			if err != nil {
-				log.Sugar.Warnf("[TRON-WS] refresh wallet addresses: %v", err)
-				continue
-			}
-			storeTronRecipientsFromWallets(w)
-		}
-	}()
-
-	wsURL := "wss://api.trongrid.io/jsonrpc"
-	query := ethereum.FilterQuery{
-		Addresses: []common.Address{tronUsdtTrc20Contract},
-		Topics:    [][]common.Hash{},
 	}
-	runWsLogListener("[TRON-WS]", wsURL, query, func(client *ethclient.Client, vLog types.Log) {
+	if len(walletAddress) <= 0 {
-		if len(vLog.Topics) < 3 {
+		log.Sugar.Debug("[ListenTrc20Job] No available wallet addresses")
-			return
+		return
-		}
-		if vLog.Topics[0].String() != transferEventHash.String() {
-			return
-		}
-
-		toAddr := tronHexToBase58(common.HexToAddress(vLog.Topics[2].Hex()))
-		//if !isWatchedTronRecipient(toAddr) {
-		//	return
-		//}
-
-		amount := new(big.Int).SetBytes(vLog.Data)
-		if amount.Sign() <= 0 {
-			return
-		}
-
-		log.Sugar.Infof("[TRON-WS] Detected TRC20 transfer to %s amount=%s tx=%s", toAddr, amount.String(), vLog.TxHash.Hex())
-		var blockTsMs int64
-		header, err := client.HeaderByNumber(context.Background(), big.NewInt(int64(vLog.BlockNumber)))
-		if err != nil {
-			log.Sugar.Warnf("[TRON-WS] HeaderByNumber block=%d: %v, using local time", vLog.BlockNumber, err)
-			blockTsMs = time.Now().UnixMilli()
-		} else {
-			blockTsMs = int64(header.Time) * 1000
-		}
-
-		service.TryProcessTronTRC20Transfer(toAddr, amount, vLog.TxHash.Hex(), blockTsMs)
-	})
-}
-
-func storeTronRecipientsFromWallets(wallets []mdb.WalletAddress) int {
-	m := make(map[string]struct{})
-	for _, w := range wallets {
-		addr := strings.TrimSpace(w.Address)
-		if addr == "" {
-			continue
-		}
-		m[addr] = struct{}{}
 	}
-	tronWatchedRecipients.Store(&tronRecipientSnapshot{addrs: m})
+	log.Sugar.Infof("[ListenTrc20Job] Found %d wallet addresses to monitor", len(walletAddress))
-	return len(m)
+	var wg sync.WaitGroup
-}
+	for _, address := range walletAddress {
+		log.Sugar.Infof("[ListenTrc20Job] Listening to address: %s", address.Address)
 
-func isWatchedTronRecipient(to string) bool {
+		wg.Add(1)
-	snap := tronWatchedRecipients.Load()
+		go service.Trc20CallBack(address.Address, &wg)
-	if snap == nil || len(snap.addrs) == 0 {
-		return false
 	}
-	_, ok := snap.addrs[strings.TrimSpace(to)]
+	wg.Wait()
-	return ok
+	log.Sugar.Debug("[ListenTrc20Job] Job completed")
-}
-
-func tronHexToBase58(addr common.Address) string {
-	raw := append([]byte{tron.PrefixMainnet}, addr.Bytes()...)
-	return tron.EncodeCheck(raw)
 }

src/task/rpc_health_job.go

@@ -0,0 +1,97 @@
+package task
+
+import (
+	"net"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/assimon/luuu/util/log"
+)
+
+const rpcProbeTimeout = 5 * time.Second
+
+// RpcHealthJob periodically probes every enabled rpc_nodes row and
+// writes status/last_latency_ms. Results drive SelectRpcNode weighted
+// picking at runtime.
+type RpcHealthJob struct{}
+
+var gRpcHealthJobLock sync.Mutex
+
+func (r RpcHealthJob) Run() {
+	gRpcHealthJobLock.Lock()
+	defer gRpcHealthJobLock.Unlock()
+
+	nodes, err := data.ListRpcNodes("")
+	if err != nil {
+		log.Sugar.Errorf("[rpc-health] list nodes err=%v", err)
+		return
+	}
+	var wg sync.WaitGroup
+	for i := range nodes {
+		if !nodes[i].Enabled {
+			continue
+		}
+		wg.Add(1)
+		go func(n mdb.RpcNode) {
+			defer wg.Done()
+			status, latency := ProbeNode(n.Url)
+			if err := data.UpdateRpcNodeHealth(n.ID, status, latency); err != nil {
+				log.Sugar.Warnf("[rpc-health] update node %d err=%v", n.ID, err)
+			}
+		}(nodes[i])
+	}
+	wg.Wait()
+}
+
+// ProbeNode does a TCP dial to the RPC URL and returns (status, latencyMs).
+// Exported so the admin controller can reuse it without duplicating logic.
+func ProbeNode(rawURL string) (string, int) {
+	addr, err := ParseAddress(rawURL)
+	if err != nil {
+		return mdb.RpcNodeStatusDown, -1
+	}
+	dur, err := MeasureTCPDial(addr, rpcProbeTimeout)
+	if err != nil {
+		return mdb.RpcNodeStatusDown, -1
+	}
+	return mdb.RpcNodeStatusOk, int(dur.Milliseconds())
+}
+
+func ParseAddress(raw string) (string, error) {
+	if !strings.Contains(raw, "://") {
+		raw = "tcp://" + raw
+	}
+
+	u, err := url.Parse(raw)
+	if err != nil {
+		return "", err
+	}
+
+	host := u.Hostname()
+	port := u.Port()
+	if port == "" {
+		switch u.Scheme {
+		case "https", "wss":
+			port = "443"
+		default:
+			port = "80"
+		}
+	}
+
+	return host + ":" + port, nil
+}
+
+func MeasureTCPDial(addr string, timeout time.Duration) (time.Duration, error) {
+	start := time.Now()
+	conn, err := net.DialTimeout("tcp", addr, timeout)
+	if err != nil {
+		return 0, err
+	}
+	defer conn.Close()
+
+	return time.Since(start), nil
+}

src/task/rpc_health_job_test.go

@@ -0,0 +1,194 @@
+package task
+
+import (
+	"net"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/assimon/luuu/model/mdb"
+)
+
+// --------------- ParseAddress ---------------
+
+func TestParseAddress_HttpWithPort(t *testing.T) {
+	got, err := ParseAddress("http://api.trongrid.io:8090")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "api.trongrid.io:8090" {
+		t.Fatalf("want api.trongrid.io:8090, got %s", got)
+	}
+}
+
+func TestParseAddress_HttpDefaultPort(t *testing.T) {
+	got, err := ParseAddress("http://api.trongrid.io")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "api.trongrid.io:80" {
+		t.Fatalf("want api.trongrid.io:80, got %s", got)
+	}
+}
+
+func TestParseAddress_HttpsDefaultPort(t *testing.T) {
+	got, err := ParseAddress("https://api.trongrid.io")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "api.trongrid.io:443" {
+		t.Fatalf("want api.trongrid.io:443, got %s", got)
+	}
+}
+
+func TestParseAddress_WssDefaultPort(t *testing.T) {
+	got, err := ParseAddress("wss://bsc-ws-node.nariox.org")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "bsc-ws-node.nariox.org:443" {
+		t.Fatalf("want bsc-ws-node.nariox.org:443, got %s", got)
+	}
+}
+
+func TestParseAddress_WsDefaultPort(t *testing.T) {
+	got, err := ParseAddress("ws://localhost")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "localhost:80" {
+		t.Fatalf("want localhost:80, got %s", got)
+	}
+}
+
+func TestParseAddress_WsWithPort(t *testing.T) {
+	got, err := ParseAddress("ws://localhost:9650")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "localhost:9650" {
+		t.Fatalf("want localhost:9650, got %s", got)
+	}
+}
+
+func TestParseAddress_BareHostPort(t *testing.T) {
+	got, err := ParseAddress("10.0.0.1:8545")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "10.0.0.1:8545" {
+		t.Fatalf("want 10.0.0.1:8545, got %s", got)
+	}
+}
+
+func TestParseAddress_BareHostNoPort(t *testing.T) {
+	got, err := ParseAddress("example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "example.com:80" {
+		t.Fatalf("want example.com:80, got %s", got)
+	}
+}
+
+func TestParseAddress_WithPath(t *testing.T) {
+	got, err := ParseAddress("https://mainnet.infura.io/v3/KEY123")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "mainnet.infura.io:443" {
+		t.Fatalf("want mainnet.infura.io:443, got %s", got)
+	}
+}
+
+// --------------- MeasureTCPDial ---------------
+
+func TestMeasureTCPDial_Success(t *testing.T) {
+	// start a local TCP listener
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+
+	dur, err := MeasureTCPDial(ln.Addr().String(), 2*time.Second)
+	if err != nil {
+		t.Fatalf("dial should succeed: %v", err)
+	}
+	if dur <= 0 {
+		t.Fatalf("duration should be positive, got %v", dur)
+	}
+}
+
+func TestMeasureTCPDial_Refused(t *testing.T) {
+	// pick a port that is almost certainly not listening
+	_, err := MeasureTCPDial("127.0.0.1:1", 500*time.Millisecond)
+	if err == nil {
+		t.Fatal("dial to closed port should fail")
+	}
+}
+
+func TestMeasureTCPDial_RespectsTimeout(t *testing.T) {
+	// Start a listener but never accept — the dial handshake will hang
+	// until the timeout fires.
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+
+	// Set backlog to 0 by not calling Accept and filling the queue.
+	// Connect once to fill the backlog, then the next dial should stall.
+	conn, err := net.Dial("tcp", ln.Addr().String())
+	if err != nil {
+		t.Skip("could not saturate backlog, skipping")
+	}
+	defer conn.Close()
+
+	// Use a very short timeout to verify it doesn't hang forever.
+	_, dialErr := MeasureTCPDial(ln.Addr().String(), 100*time.Millisecond)
+	// This may succeed (kernel allows queued connections) or timeout — both
+	// are acceptable. We just verify it returns within a sane window.
+	_ = dialErr
+}
+
+// --------------- ProbeNode ---------------
+
+func TestProbeNode_Reachable(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+
+	port := ln.Addr().(*net.TCPAddr).Port
+	url := "http://127.0.0.1:" + strconv.Itoa(port)
+
+	status, latency := ProbeNode(url)
+	if status != mdb.RpcNodeStatusOk {
+		t.Fatalf("want ok, got %s", status)
+	}
+	if latency < 0 {
+		t.Fatalf("latency should be >= 0, got %d", latency)
+	}
+}
+
+func TestProbeNode_Unreachable(t *testing.T) {
+	status, latency := ProbeNode("http://127.0.0.1:1")
+	if status != mdb.RpcNodeStatusDown {
+		t.Fatalf("want down, got %s", status)
+	}
+	if latency != -1 {
+		t.Fatalf("want -1, got %d", latency)
+	}
+}
+
+func TestProbeNode_InvalidURL(t *testing.T) {
+	status, latency := ProbeNode("://bad")
+	if status != mdb.RpcNodeStatusDown {
+		t.Fatalf("want down, got %s", status)
+	}
+	if latency != -1 {
+		t.Fatalf("want -1, got %d", latency)
+	}
+}

src/telegram/handle.go

@@ -122,7 +122,9 @@ func WalletList(c tb.Context) error {
 			InlineKeyboard: rows,
 		})
 	})
-	btnList = append(btnList, []tb.InlineButton{addBtn})
+	refreshBtn := tb.InlineButton{Text: "刷新列表", Unique: "WalletRefresh"}
+	bots.Handle(&refreshBtn, WalletList)
+	btnList = append(btnList, []tb.InlineButton{addBtn, refreshBtn})
 
 	return c.EditOrSend("请选择钱包继续操作", &tb.ReplyMarkup{
 		InlineKeyboard: btnList,
@@ -257,21 +259,15 @@ func getPendingWalletAddressState(userID int64) (pendingWalletAddressState, bool
 }
 
 func getEnabledSupportedNetworks() ([]string, error) {
-	assets, err := data.ListEnabledSupportedAssets()
+	chains, err := data.ListEnabledChains()
 	if err != nil {
 		return nil, err
 	}
-	set := make(map[string]struct{})
+	networks := make([]string, 0, len(chains))
-	for _, a := range assets {
+	for _, ch := range chains {
-		n := strings.ToLower(strings.TrimSpace(a.Network))
+		if n := strings.ToLower(strings.TrimSpace(ch.Network)); n != "" {
-		if n == "" {
+			networks = append(networks, n)
-			continue
 		}
-		set[n] = struct{}{}
-	}
-	networks := make([]string, 0, len(set))
-	for n := range set {
-		networks = append(networks, n)
 	}
 	sort.Strings(networks)
 	return networks, nil

src/telegram/telegram.go

@@ -1,66 +1,120 @@
 package telegram
 
 import (
-	"github.com/assimon/luuu/config"
+	"fmt"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/assimon/luuu/model/data"
 	"github.com/assimon/luuu/util/log"
 	tb "gopkg.in/telebot.v3"
 	"gopkg.in/telebot.v3/middleware"
-	"time"
 )
 
-var bots *tb.Bot
+// bots is the single bot instance backing slash-command handlers
+// (/start, WalletList, add-wallet dialog). Config is read from the
+// settings table (system.telegram_bot_token + system.telegram_chat_id).
+// Decoupled from notification_channels — that table drives push
+// notifications only (via notify/dispatcher.go).
+var (
+	bots        *tb.Bot
+	adminChatID int64
+	reloadMu    sync.Mutex
+)
 
-// BotStart 机器人启动
+// BotStart connects the command bot. If no telegram channel is
+// configured yet it logs and returns; the service otherwise runs fine
+// and notifications still fan out as soon as a channel is added (those
+// use their own per-request bot; see notify/telegram_sender.go).
 func BotStart() {
-	var err error
+	if err := reloadBot("bootstrap"); err != nil {
-	botSetting := tb.Settings{
+		log.Sugar.Errorf("[telegram] bot start failed: %v", err)
-		Token:       config.TgBotToken,
-		Poller:      &tb.LongPoller{Timeout: 50 * time.Second},
-		Synchronous: true,
 	}
-	if config.TgProxy != "" {
-		botSetting.URL = config.TgProxy
-	}
-	bots, err = tb.NewBot(botSetting)
-	if err != nil {
-		log.Sugar.Error(err.Error())
-		return
-	}
-	err = bots.SetCommands(Cmds)
-	if err != nil {
-		log.Sugar.Error(err.Error())
-		return
-	}
-	RegisterHandle()
-	bots.Start()
 }
 
-// RegisterHandle 注册处理器
+// ReloadBotAsync refreshes the command bot from notification_channels.
-func RegisterHandle() {
+// It is used by admin API handlers after telegram channel create/update/
-	adminOnly := bots.Group()
+// status/delete so operators don't need to restart the service.
-	adminOnly.Use(middleware.Whitelist(config.TgManage))
+func ReloadBotAsync(reason string) {
-	adminOnly.Handle(START_CMD, WalletList)
-	adminOnly.Handle(tb.OnText, OnTextMessageHandle)
-}
-
-// SendToBot 主动发送消息机器人消息
-func SendToBot(msg string) {
 	go func() {
-		if bots == nil {
+		if err := reloadBot(reason); err != nil {
-			log.Sugar.Error("[Telegram] bots实例为nil，无法发送消息")
+			log.Sugar.Errorf("[telegram] reload failed, reason=%s err=%v", reason, err)
-			return
-		}
-		user := tb.User{
-			ID: config.TgManage,
-		}
-		log.Sugar.Infof("[Telegram] 正在发送消息给用户ID=%d", config.TgManage)
-		_, err := bots.Send(&user, msg, &tb.SendOptions{
-			ParseMode: tb.ModeHTML,
-		})
-		if err != nil {
-			log.Sugar.Errorf("[Telegram] 发送消息失败: userID=%d, err=%v", config.TgManage, err)
-		} else {
-			log.Sugar.Infof("[Telegram] 发送消息成功: userID=%d", config.TgManage)
 		}
 	}()
 }
+
+// loadCommandBotConfig reads the command-bot config from the settings
+// table (system.telegram_bot_token + system.telegram_chat_id).
+// Returns (nil, "", nil) when the keys are absent so the caller can
+// log and return gracefully — bot stays disabled until settings are set.
+func loadCommandBotConfig() (*botConfig, string, error) {
+	botToken := strings.TrimSpace(data.GetSettingString("system.telegram_bot_token", ""))
+	chatIDStr := strings.TrimSpace(data.GetSettingString("system.telegram_chat_id", ""))
+	if botToken == "" || chatIDStr == "" {
+		return nil, "", nil
+	}
+	chatID, err := strconv.ParseInt(chatIDStr, 10, 64)
+	if err != nil {
+		return nil, "", fmt.Errorf("invalid telegram chat_id in settings: %w", err)
+	}
+	return &botConfig{BotToken: botToken, ChatID: chatID}, "settings", nil
+}
+
+// botConfig holds the minimal fields needed to start the command bot.
+type botConfig struct {
+	BotToken string
+	ChatID   int64
+}
+
+func reloadBot(reason string) error {
+	reloadMu.Lock()
+	defer reloadMu.Unlock()
+
+	if bots != nil {
+		bots.Stop()
+		bots = nil
+	}
+
+	cfg, source, err := loadCommandBotConfig()
+	if err != nil {
+		return err
+	}
+	if cfg == nil {
+		log.Sugar.Infof("[telegram] no enabled telegram channel configured; command bot disabled (reason=%s)", reason)
+		return nil
+	}
+	adminChatID = cfg.ChatID
+
+	botSetting := tb.Settings{
+		Token:       cfg.BotToken,
+		Poller:      &tb.LongPoller{Timeout: 50 * time.Second},
+		Synchronous: true,
+	}
+	newBot, err := tb.NewBot(botSetting)
+	if err != nil {
+		return fmt.Errorf("new bot: %w", err)
+	}
+	if err = newBot.SetCommands(Cmds); err != nil {
+		return fmt.Errorf("set commands: %w", err)
+	}
+	bots = newBot
+	RegisterHandle()
+	go bots.Start()
+
+	log.Sugar.Infof("[telegram] command bot started, reason=%s, source=%s", reason, source)
+	return nil
+}
+
+// RegisterHandle wires slash-command and text-message routes. The
+// admin whitelist uses the chat_id from the same channel row.
+func RegisterHandle() {
+	if bots == nil {
+		return
+	}
+	adminOnly := bots.Group()
+	adminOnly.Use(middleware.Whitelist(adminChatID))
+	adminOnly.Handle(START_CMD, WalletList)
+	adminOnly.Handle(tb.OnText, OnTextMessageHandle)
+}

src/telegram/telegram_test.go

@@ -0,0 +1,135 @@
+package telegram
+
+import (
+	"testing"
+
+	"github.com/assimon/luuu/config"
+	"github.com/assimon/luuu/internal/testutil"
+	"github.com/assimon/luuu/model/dao"
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+)
+
+func withTelegramEnv(token, proxy string, manage int64, fn func()) {
+	origToken := config.TgBotToken
+	origProxy := config.TgProxy
+	origManage := config.TgManage
+	defer func() {
+		config.TgBotToken = origToken
+		config.TgProxy = origProxy
+		config.TgManage = origManage
+	}()
+
+	config.TgBotToken = token
+	config.TgProxy = proxy
+	config.TgManage = manage
+	fn()
+}
+
+func TestLoadCommandBotConfig_DoesNotUseEnvFallbackWhenNoChannel(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	// Env config is present but settings table is empty —
+	// the bot must NOT fall back to config.TgBotToken.
+	withTelegramEnv("env-token", "http://127.0.0.1:7890", 123456789, func() {
+		cfg, source, err := loadCommandBotConfig()
+		if err != nil {
+			t.Fatalf("loadCommandBotConfig err: %v", err)
+		}
+		if cfg != nil {
+			t.Fatalf("expected nil config when settings table has no telegram keys, got %+v", cfg)
+		}
+		if source != "" {
+			t.Fatalf("source = %q, want empty", source)
+		}
+	})
+}
+
+func TestLoadCommandBotConfig_PrefersEnabledTelegramChannel(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	// Seed settings table with telegram credentials.
+	dao.Mdb.Create(&mdb.Setting{Group: "system", Key: "system.telegram_bot_token", Value: "db-token", Type: "string"})
+	dao.Mdb.Create(&mdb.Setting{Group: "system", Key: "system.telegram_chat_id", Value: "987654321", Type: "string"})
+	_ = data.ReloadSettings()
+
+	withTelegramEnv("env-token", "", 123456789, func() {
+		cfg, source, err := loadCommandBotConfig()
+		if err != nil {
+			t.Fatalf("loadCommandBotConfig err: %v", err)
+		}
+		if cfg == nil {
+			t.Fatal("expected non-nil config")
+		}
+		if source != "settings" {
+			t.Fatalf("source = %q, want %q", source, "settings")
+		}
+		if cfg.BotToken != "db-token" {
+			t.Fatalf("bot token = %q, want %q", cfg.BotToken, "db-token")
+		}
+		if cfg.ChatID != 987654321 {
+			t.Fatalf("chat id = %d, want %d", cfg.ChatID, int64(987654321))
+		}
+	})
+}
+
+func TestLoadCommandBotConfig_ReturnsNilWhenNoChannelAndNoEnv(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	// Fresh DB — ensure the cache doesn't carry over values from a previous test.
+	_ = data.ReloadSettings()
+
+	withTelegramEnv("", "", 0, func() {
+		cfg, source, err := loadCommandBotConfig()
+		if err != nil {
+			t.Fatalf("loadCommandBotConfig err: %v", err)
+		}
+		if cfg != nil {
+			t.Fatalf("expected nil config, got %+v", cfg)
+		}
+		if source != "" {
+			t.Fatalf("source = %q, want empty", source)
+		}
+	})
+}
+
+func TestLoadCommandBotConfig_SkipsEmptyConfigChannel(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	// Only chat_id present, no bot_token → should return nil.
+	dao.Mdb.Create(&mdb.Setting{Group: "system", Key: "system.telegram_chat_id", Value: "987654321", Type: "string"})
+	_ = data.ReloadSettings()
+
+	cfg, source, err := loadCommandBotConfig()
+	if err != nil {
+		t.Fatalf("loadCommandBotConfig err: %v", err)
+	}
+	if cfg != nil {
+		t.Fatalf("expected nil config when bot_token is absent, got %+v", cfg)
+	}
+	if source != "" {
+		t.Fatalf("source = %q, want empty", source)
+	}
+}
+
+func TestLoadCommandBotConfig_SkipsInvalidAndUsesNextValid(t *testing.T) {
+	cleanup := testutil.SetupTestDatabases(t)
+	defer cleanup()
+
+	// bot_token present but chat_id is not a valid int → should return error.
+	dao.Mdb.Create(&mdb.Setting{Group: "system", Key: "system.telegram_bot_token", Value: "db-token", Type: "string"})
+	dao.Mdb.Create(&mdb.Setting{Group: "system", Key: "system.telegram_chat_id", Value: "not-a-number", Type: "string"})
+	_ = data.ReloadSettings()
+
+	cfg, _, err := loadCommandBotConfig()
+	if err == nil {
+		t.Fatal("expected error for invalid chat_id, got nil")
+	}
+	if cfg != nil {
+		t.Fatalf("expected nil config on parse error, got %+v", cfg)
+	}
+}

src/util/constant/errno.go

@@ -16,8 +16,8 @@ var Errno = map[int]string{
 	10011: "exceeded maximum sub-order limit",
 	10012: "cannot switch network on a sub-order",
 	10013: "order is not awaiting payment",
-	10014: "supported asset already exists",
+	10014: "chain is not enabled",
-	10015: "supported asset not found",
+	10016: "supported asset not found",
 }
 
 var (
@@ -36,8 +36,8 @@ var (
 	SubOrderLimitExceeded      = Err(10011)
 	CannotSwitchSubOrder       = Err(10012)
 	OrderNotWaitPay            = Err(10013)
-	SupportedAssetAlreadyExists = Err(10014)
+	ChainNotEnabled            = Err(10014)
-	SupportedAssetNotFound      = Err(10015)
+	SupportedAssetNotFound     = Err(10016)
 )
 
 type RspError struct {
@@ -60,3 +60,19 @@ func Err(code int) (err error) {
 func (re *RspError) Render() (code int, msg string) {
 	return re.Code, re.Msg
 }
+
+// HttpStatus maps a RspError code to the HTTP status the handler
+// should use on the wire. Small codes (< 1000) are treated as real
+// HTTP status codes (e.g. 400 system error, 401 signature failure) so
+// clients see the right status. Business codes (>= 1000) are all
+// client-side problems that map to HTTP 400; the specific code still
+// lives in the body's `status_code` field for the frontend to branch on.
+func (re *RspError) HttpStatus() int {
+	if re == nil {
+		return 500
+	}
+	if re.Code >= 400 && re.Code < 600 {
+		return re.Code
+	}
+	return 400
+}

src/util/http/response.go

@@ -58,16 +58,21 @@ func (r *Resp) SucJsonPage(e echo.Context, data interface{}, pagination page.Pag
 	return r.SucJson(e, pageDate, message...)
 }
 
-// FailJson 失败json
+// FailJson 失败json —  Propagates semantic HTTP status codes to the
+// wire. RspError.Code in the 4xx/5xx range is used directly; business
+// codes (>=1000) map to HTTP 400 with the specific code still visible
+// in the body's status_code field.
 func (r *Resp) FailJson(e echo.Context, err error) error {
 	rr := new(Response)
-	switch err.(type) {
+	httpStatus := http.StatusBadRequest
+	switch t := err.(type) {
 	case *constant.RspError:
-		rr.StatusCode, rr.Message = err.(*constant.RspError).Render()
+		rr.StatusCode, rr.Message = t.Render()
+		httpStatus = t.HttpStatus()
 	default:
-		rr.StatusCode = 400
+		rr.StatusCode = http.StatusBadRequest
 		rr.Message = err.Error()
 	}
 	rr.RequestID = e.Request().Header.Get(echo.HeaderXRequestID)
-	return r.Json(e, http.StatusOK, &rr)
+	return r.Json(e, httpStatus, &rr)
 }

src/util/http/spa.go

@@ -0,0 +1,30 @@
+package http
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// ResolveSPAFilePath normalizes a wildcard SPA path and maps it under wwwRoot.
+// It strips any leading slash and blocks path traversal outside wwwRoot.
+// The second return value indicates whether the caller should try os.Stat
+// against the returned path (true) or directly fall back to index.html (false).
+func ResolveSPAFilePath(wwwRoot, wildcard string) (string, bool) {
+	indexPath := filepath.Join(wwwRoot, "index.html")
+
+	cleaned := strings.TrimPrefix(filepath.Clean(wildcard), "/")
+	if cleaned == "" || cleaned == "." {
+		return indexPath, false
+	}
+
+	requestedPath := filepath.Join(wwwRoot, cleaned)
+	base := filepath.Clean(wwwRoot)
+	resolved := filepath.Clean(requestedPath)
+
+	if resolved != base && !strings.HasPrefix(resolved, base+string(os.PathSeparator)) {
+		return indexPath, false
+	}
+
+	return requestedPath, true
+}

src/util/http/spa_test.go

@@ -0,0 +1,68 @@
+package http
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+func TestResolveSPAFilePath(t *testing.T) {
+	root := filepath.Join("tmp", "www")
+	indexPath := filepath.Join(root, "index.html")
+
+	tests := []struct {
+		name        string
+		wildcard    string
+		wantPath    string
+		wantTryStat bool
+	}{
+		{
+			name:        "relative asset path",
+			wildcard:    "assets/app.js",
+			wantPath:    filepath.Join(root, "assets", "app.js"),
+			wantTryStat: true,
+		},
+		{
+			name:        "absolute style asset path",
+			wildcard:    "/assets/app.js",
+			wantPath:    filepath.Join(root, "assets", "app.js"),
+			wantTryStat: true,
+		},
+		{
+			name:        "empty wildcard",
+			wildcard:    "",
+			wantPath:    indexPath,
+			wantTryStat: false,
+		},
+		{
+			name:        "dot wildcard",
+			wildcard:    ".",
+			wantPath:    indexPath,
+			wantTryStat: false,
+		},
+		{
+			name:        "directory traversal fallback",
+			wildcard:    "../../etc/passwd",
+			wantPath:    indexPath,
+			wantTryStat: false,
+		},
+		{
+			name:        "absolute directory traversal fallback",
+			wildcard:    "/../../etc/passwd",
+			wantPath:    filepath.Join(root, "etc", "passwd"),
+			wantTryStat: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotPath, gotTryStat := ResolveSPAFilePath(root, tt.wildcard)
+
+			if gotTryStat != tt.wantTryStat {
+				t.Fatalf("tryStat = %v, want %v", gotTryStat, tt.wantTryStat)
+			}
+			if gotPath != tt.wantPath {
+				t.Fatalf("path = %q, want %q", gotPath, tt.wantPath)
+			}
+		})
+	}
+}

src/util/jwt/jwt.go

@@ -0,0 +1,78 @@
+package jwt
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"time"
+
+	"github.com/assimon/luuu/model/data"
+	"github.com/assimon/luuu/model/mdb"
+	"github.com/golang-jwt/jwt/v4"
+)
+
+// DefaultExpiration is the token lifetime for admin sessions.
+const DefaultExpiration = 24 * time.Hour
+
+// AdminClaims is the JWT payload for admin sessions.
+type AdminClaims struct {
+	AdminUserID uint64 `json:"uid"`
+	Username    string `json:"usr"`
+	jwt.RegisteredClaims
+}
+
+// EnsureSecret reads system.jwt_secret from settings; if absent,
+// generates a new 32-byte random hex string and persists it. Called once
+// at startup so subsequent sign/verify can assume the secret exists.
+func EnsureSecret() (string, error) {
+	secret := data.GetSettingString(mdb.SettingKeyJwtSecret, "")
+	if secret != "" {
+		return secret, nil
+	}
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	secret = hex.EncodeToString(buf)
+	if err := data.SetSetting(mdb.SettingGroupSystem, mdb.SettingKeyJwtSecret, secret, mdb.SettingTypeString); err != nil {
+		return "", err
+	}
+	return secret, nil
+}
+
+// Sign returns a signed JWT for the given admin user.
+func Sign(userID uint64, username string) (string, error) {
+	secret, err := EnsureSecret()
+	if err != nil {
+		return "", err
+	}
+	claims := AdminClaims{
+		AdminUserID: userID,
+		Username:    username,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(DefaultExpiration)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString([]byte(secret))
+}
+
+// Parse validates a token string and returns its claims.
+func Parse(tokenStr string) (*AdminClaims, error) {
+	secret, err := EnsureSecret()
+	if err != nil {
+		return nil, err
+	}
+	claims := &AdminClaims{}
+	_, err = jwt.ParseWithClaims(tokenStr, claims, func(t *jwt.Token) (interface{}, error) {
+		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, errors.New("unexpected signing method")
+		}
+		return []byte(secret), nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return claims, nil
+}

src/www/assets/401-IieFK_aS.js

@@ -0,0 +1 @@
+import{t as e}from"./unauthorized-error-CxmfHb-a.js";var t=e;export{t as component};

src/www/assets/403-BfPOIf6t.js

@@ -0,0 +1 @@
+import{t as e}from"./forbidden-BEz-zjy_.js";var t=e;export{t as component};