Merge branch 'kub-stage' into production

Deploy payment idempotency fixes and per-user payment locks to production.

src/CMSMicroservice.WebApi/Services/DiscountOrderService.cs

@@ -1,5 +1,7 @@
 using CMSMicroservice.Protobuf.Protos.DiscountOrder;
 using CMSMicroservice.WebApi.Common.Services;
+using CMSMicroservice.Application.Common;
+using CMSMicroservice.Application.Common.Exceptions;
 using CMSMicroservice.Application.Common.Interfaces;
 using CMSMicroservice.Application.DiscountShopCQ.Commands.PlaceOrder;
 using CMSMicroservice.Application.DiscountShopCQ.Commands.CompleteOrderPayment;
@@ -26,6 +28,7 @@ public class DiscountOrderService : DiscountOrderContract.DiscountOrderContractB
     private readonly IApplicationDbContext _context;
     private readonly IPaymentGatewayService _paymentGateway;
     private readonly ILogger<DiscountOrderService> _logger;
+    private readonly IUserPaymentLock _paymentLock;
 
     public DiscountOrderService(
         IDispatchRequestToCQRS dispatchRequestToCQRS,
@@ -33,7 +36,8 @@ public class DiscountOrderService : DiscountOrderContract.DiscountOrderContractB
         ICurrentUserService currentUserService,
         IApplicationDbContext context,
         IPaymentGatewayService paymentGateway,
-        ILogger<DiscountOrderService> logger)
+        ILogger<DiscountOrderService> logger,
+        IUserPaymentLock paymentLock)
     {
         _dispatchRequestToCQRS = dispatchRequestToCQRS;
         _sender = sender;
@@ -41,6 +45,7 @@ public class DiscountOrderService : DiscountOrderContract.DiscountOrderContractB
         _context = context;
         _paymentGateway = paymentGateway;
         _logger = logger;
+        _paymentLock = paymentLock;
     }
 
     private long GetCurrentUserId()
@@ -58,20 +63,32 @@ public class DiscountOrderService : DiscountOrderContract.DiscountOrderContractB
             UserAddressId = request.UserAddressId,
             DiscountBalanceToUse = request.DiscountBalanceToUse
         };
-        var result = await _sender.Send(command);
-        
-        var response = new PlaceOrderResponse
+
+        try
         {
-            Success = result.Success,
-            Message = result.Message ?? string.Empty,
-            OrderId = result.OrderId ?? 0,
-            GatewayAmount = result.GatewayAmountRequired,
-        };
+            var result = await _sender.Send(command);
         
-        if (!string.IsNullOrEmpty(result.PaymentUrl))
-            response.PaymentUrl = result.PaymentUrl;
+            var response = new PlaceOrderResponse
+            {
+                Success = result.Success,
+                Message = result.Message ?? string.Empty,
+                OrderId = result.OrderId ?? 0,
+                GatewayAmount = result.GatewayAmountRequired,
+            };
         
-        return response;
+            if (!string.IsNullOrEmpty(result.PaymentUrl))
+                response.PaymentUrl = result.PaymentUrl;
+        
+            return response;
+        }
+        catch (PaymentInProgressException ex)
+        {
+            return new PlaceOrderResponse
+            {
+                Success = false,
+                Message = ex.Message
+            };
+        }
     }
 
     public override async Task<CompleteOrderPaymentResponse> CompleteOrderPayment(CompleteOrderPaymentRequest request, ServerCallContext context)
@@ -193,6 +210,48 @@ public class DiscountOrderService : DiscountOrderContract.DiscountOrderContractB
 
     public override async Task<CustomerVerifyDiscountOrderPaymentResponse> CustomerVerifyDiscountOrderPayment(
         CustomerVerifyDiscountOrderPaymentRequest request, ServerCallContext context)
+    {
+        var orderOwner = await _context.DiscountOrders
+            .Where(o => o.Id == request.OrderId)
+            .Select(o => (long?)o.UserId)
+            .FirstOrDefaultAsync(context.CancellationToken);
+
+        if (orderOwner is null or 0)
+        {
+            return new CustomerVerifyDiscountOrderPaymentResponse
+            {
+                Success = false,
+                Message = "سفارش یافت نشد",
+                OrderId = request.OrderId
+            };
+        }
+
+        var verifyKey = !string.IsNullOrEmpty(request.Authority)
+            ? request.Authority
+            : request.OrderId.ToString();
+
+        try
+        {
+            return await _paymentLock.ExecuteAsync(
+                PaymentLockScopes.Verify(orderOwner.Value, verifyKey),
+                PaymentLockStrategy.WaitForRelease,
+                ct => CustomerVerifyDiscountOrderPaymentCore(request, ct),
+                context.CancellationToken);
+        }
+        catch (PaymentInProgressException ex)
+        {
+            return new CustomerVerifyDiscountOrderPaymentResponse
+            {
+                Success = false,
+                Message = ex.Message,
+                OrderId = request.OrderId
+            };
+        }
+    }
+
+    private async Task<CustomerVerifyDiscountOrderPaymentResponse> CustomerVerifyDiscountOrderPaymentCore(
+        CustomerVerifyDiscountOrderPaymentRequest request,
+        CancellationToken cancellationToken)
     {
         _logger.LogInformation(
             "CustomerVerifyDiscountOrderPayment called: OrderId={OrderId}, Authority={Authority}, Status={Status}",
@@ -203,7 +262,7 @@ public class DiscountOrderService : DiscountOrderContract.DiscountOrderContractB
             // پیدا کردن سفارش و تراکنش
             var order = await _context.DiscountOrders
                 .Include(o => o.OrderDetails)
-                .FirstOrDefaultAsync(o => o.Id == request.OrderId, context.CancellationToken);
+                .FirstOrDefaultAsync(o => o.Id == request.OrderId, cancellationToken);
 
             if (order == null)
             {
@@ -218,7 +277,7 @@ public class DiscountOrderService : DiscountOrderContract.DiscountOrderContractB
 
             var transaction = order.TransactionId.HasValue
                 ? await _context.Transactions.FirstOrDefaultAsync(
-                    t => t.Id == order.TransactionId.Value, context.CancellationToken)
+                    t => t.Id == order.TransactionId.Value, cancellationToken)
                 : null;
 
             // تأیید پرداخت از درگاه
@@ -233,14 +292,14 @@ public class DiscountOrderService : DiscountOrderContract.DiscountOrderContractB
                     request.Authority,
                     request.Status,
                     order.GatewayAmountPaid,
-                    context.CancellationToken);
+                    cancellationToken);
 
                 paymentSuccess = verifyResult.IsSuccess;
                 refId = verifyResult.TrackingCode ?? verifyResult.RefId;
 
                 // آپدیت PaymentTransaction با نتیجه verify
                 var paymentTx = await _context.PaymentTransactions
-                    .FirstOrDefaultAsync(pt => pt.Authority == request.Authority, context.CancellationToken);
+                    .FirstOrDefaultAsync(pt => pt.Authority == request.Authority, cancellationToken);
                 if (paymentTx != null)
                 {
                     paymentTx.PaymentStatus = verifyResult.IsSuccess;
@@ -249,7 +308,7 @@ public class DiscountOrderService : DiscountOrderContract.DiscountOrderContractB
                     paymentTx.CardPan = verifyResult.CardPan;
                     paymentTx.CardHash = verifyResult.CardHash;
                     paymentTx.RefId = verifyResult.TrackingCode;
-                    await _context.SaveChangesAsync(context.CancellationToken);
+                    await _context.SaveChangesAsync(cancellationToken);
                 }
 
                 _logger.LogInformation(
@@ -268,7 +327,7 @@ public class DiscountOrderService : DiscountOrderContract.DiscountOrderContractB
                 TransactionId = transaction?.Id ?? 0,
                 PaymentSuccess = paymentSuccess,
                 RefId = refId
-            }, context.CancellationToken);
+            }, cancellationToken);
 
             return new CustomerVerifyDiscountOrderPaymentResponse
             {

src/CMSMicroservice.WebApi/Services/PackageService.cs

@@ -10,11 +10,14 @@ using CMSMicroservice.Application.PackageCQ.Queries.GetCustomerPackages;
 using CMSMicroservice.Application.PackageCQ.Queries.GetCustomerPackageDetails;
 using CMSMicroservice.Application.PackageCQ.Queries.GetCustomerPurchaseHistory;
 using CMSMicroservice.Application.Common.Interfaces;
+using CMSMicroservice.Application.Common;
+using CMSMicroservice.Application.Common.Exceptions;
 using CMSMicroservice.Domain.Entities.Payment;
 using AppModels = CMSMicroservice.Application.Common.Models;
 using Grpc.Core;
 using Google.Protobuf.WellKnownTypes;
 using System.Collections.Generic;
+using System.Data;
 using System.Linq;
 using CMSMicroservice.Protobuf.Protos;
 using Microsoft.EntityFrameworkCore;
@@ -31,6 +34,7 @@ public class PackageService : PackageContract.PackageContractBase
     private readonly ICurrentUserService _currentUserService;
     private readonly IPaymentGatewayService _paymentGateway;
     private readonly IConfiguration _configuration;
+    private readonly IUserPaymentLock _paymentLock;
 
     public PackageService(
         IDispatchRequestToCQRS dispatchRequestToCQRS, 
@@ -38,7 +42,8 @@ public class PackageService : PackageContract.PackageContractBase
         IApplicationDbContext context,
         ICurrentUserService currentUserService,
         IPaymentGatewayService paymentGateway,
-        IConfiguration configuration)
+        IConfiguration configuration,
+        IUserPaymentLock paymentLock)
     {
         _dispatchRequestToCQRS = dispatchRequestToCQRS;
         _sender = sender;
@@ -46,6 +51,7 @@ public class PackageService : PackageContract.PackageContractBase
         _currentUserService = currentUserService;
         _paymentGateway = paymentGateway;
         _configuration = configuration;
+        _paymentLock = paymentLock;
     }
     public override async Task<CreateNewPackageResponse> CreateNewPackage(CreateNewPackageRequest request, ServerCallContext context)
     {
@@ -137,12 +143,31 @@ public class PackageService : PackageContract.PackageContractBase
     public override async Task<CustomerPurchasePackageResponse> CustomerPurchasePackage(CustomerPurchasePackageRequest request, ServerCallContext context)
     {
         var userId = GetCurrentUserId();
-        
+
+        try
+        {
+            return await _paymentLock.ExecuteAsync(
+                PaymentLockScopes.Initiate(userId),
+                PaymentLockStrategy.FailFast,
+                ct => CustomerPurchasePackageCore(request, userId, ct),
+                context.CancellationToken);
+        }
+        catch (PaymentInProgressException ex)
+        {
+            throw new RpcException(new Status(StatusCode.FailedPrecondition, ex.Message));
+        }
+    }
+
+    private async Task<CustomerPurchasePackageResponse> CustomerPurchasePackageCore(
+        CustomerPurchasePackageRequest request,
+        long userId,
+        CancellationToken cancellationToken)
+    {
         // Lookup package
         var package = await _context.Packages
             .AsNoTracking()
             .Where(p => p.Id == request.PackageId && !p.IsDeleted)
-            .FirstOrDefaultAsync(context.CancellationToken);
+            .FirstOrDefaultAsync(cancellationToken);
         
         if (package == null)
             throw new RpcException(new Status(StatusCode.NotFound, "پکیج مورد نظر یافت نشد"));
@@ -156,7 +181,7 @@ public class PackageService : PackageContract.PackageContractBase
             Type = Domain.Enums.TransactionType.Buy
         };
         _context.Transactions.Add(transaction);
-        await _context.SaveChangesAsync(context.CancellationToken);
+        await _context.SaveChangesAsync(cancellationToken);
         
         // Create purchase record
         var purchaseMethod = request.PurchaseMethod == PurchaseMethodEnum.PurchaseMethodGateway 
@@ -173,14 +198,14 @@ public class PackageService : PackageContract.PackageContractBase
             TransactionId = transaction.Id
         };
         _context.UserPackagePurchases.Add(purchase);
-        await _context.SaveChangesAsync(context.CancellationToken);
+        await _context.SaveChangesAsync(cancellationToken);
         
         // Initiate payment with gateway
         var user = await _context.Users
             .AsNoTracking()
             .Where(u => u.Id == userId)
             .Select(u => new { u.Mobile })
-            .FirstOrDefaultAsync(context.CancellationToken);
+            .FirstOrDefaultAsync(cancellationToken);
         
         // Callback URL از config — نه از ورودی کاربر (امنیت)
         var frontOfficeBaseUrl = _configuration["FrontOfficeBaseUrl"] ?? "https://localhost:5268";
@@ -193,12 +218,12 @@ public class PackageService : PackageContract.PackageContractBase
             Mobile = user?.Mobile ?? string.Empty,
             Description = $"خرید پکیج {package.Title}",
             CallbackUrl = callbackUrl
-        }, context.CancellationToken);
+        }, cancellationToken);
         
         if (!paymentResult.IsSuccess)
         {
             transaction.PaymentStatus = Domain.Enums.PaymentStatus.Reject;
-            await _context.SaveChangesAsync(context.CancellationToken);
+            await _context.SaveChangesAsync(cancellationToken);
             
             return new CustomerPurchasePackageResponse
             {
@@ -228,7 +253,7 @@ public class PackageService : PackageContract.PackageContractBase
             OrderId = purchase.Id.ToString()
         };
         _context.PaymentTransactions.Add(paymentTx);
-        await _context.SaveChangesAsync(context.CancellationToken);
+        await _context.SaveChangesAsync(cancellationToken);
         
         return new CustomerPurchasePackageResponse
         {
@@ -242,66 +267,167 @@ public class PackageService : PackageContract.PackageContractBase
     
     public override async Task<CustomerVerifyPackagePurchaseResponse> CustomerVerifyPackagePurchase(CustomerVerifyPackagePurchaseRequest request, ServerCallContext context)
     {
-        // Find purchase record
+        var ct = context.CancellationToken;
+
+        var purchaseUserId = await _context.UserPackagePurchases
+            .Where(p => p.Id == request.OrderId && !p.IsDeleted)
+            .Select(p => (long?)p.UserId)
+            .FirstOrDefaultAsync(ct);
+
+        if (purchaseUserId is null or 0)
+            throw new RpcException(new Status(StatusCode.NotFound, "سفارش یافت نشد"));
+
+        var verifyKey = !string.IsNullOrEmpty(request.Authority)
+            ? request.Authority
+            : request.OrderId.ToString();
+
+        try
+        {
+            return await _paymentLock.ExecuteAsync(
+                PaymentLockScopes.Verify(purchaseUserId.Value, verifyKey),
+                PaymentLockStrategy.WaitForRelease,
+                lockCt => CustomerVerifyPackagePurchaseCore(request, lockCt),
+                ct);
+        }
+        catch (PaymentInProgressException ex)
+        {
+            throw new RpcException(new Status(StatusCode.FailedPrecondition, ex.Message));
+        }
+    }
+
+    private async Task<CustomerVerifyPackagePurchaseResponse> CustomerVerifyPackagePurchaseCore(
+        CustomerVerifyPackagePurchaseRequest request,
+        CancellationToken ct)
+    {
         var purchase = await _context.UserPackagePurchases
             .Include(p => p.Package)
             .Where(p => p.Id == request.OrderId && !p.IsDeleted)
-            .FirstOrDefaultAsync(context.CancellationToken);
-        
+            .FirstOrDefaultAsync(ct);
+
         if (purchase == null)
             throw new RpcException(new Status(StatusCode.NotFound, "سفارش یافت نشد"));
-        
-        // Find the associated transaction
+
         var transaction = purchase.TransactionId.HasValue
             ? await _context.Transactions
                 .Where(t => t.Id == purchase.TransactionId.Value)
-                .FirstOrDefaultAsync(context.CancellationToken)
+                .FirstOrDefaultAsync(ct)
             : null;
-        
-        // If status from gateway callback is not OK
+
+        var paymentTx = !string.IsNullOrEmpty(request.Authority)
+            ? await _context.PaymentTransactions
+                .FirstOrDefaultAsync(pt => pt.Authority == request.Authority, ct)
+            : null;
+
+        // Idempotency: already verified — never credit wallet again
+        if (IsPackagePaymentAlreadyCompleted(transaction, paymentTx))
+        {
+            return BuildVerifyPackagePurchaseResponse(
+                purchase, transaction, paymentTx, alreadyPaid: true);
+        }
+
         if (request.Status != "OK")
         {
-            if (transaction != null)
+            if (transaction != null && transaction.PaymentStatus != Domain.Enums.PaymentStatus.Success)
             {
                 transaction.PaymentStatus = Domain.Enums.PaymentStatus.Reject;
-                await _context.SaveChangesAsync(context.CancellationToken);
+                await _context.SaveChangesAsync(ct);
             }
-            
+
             return new CustomerVerifyPackagePurchaseResponse
             {
                 Success = false,
                 Message = "پرداخت توسط کاربر لغو شد"
             };
         }
-        
-        // واکشی PaymentTransaction برای گرفتن مبلغ (تومان) جهت verify
-        var paymentTx = await _context.PaymentTransactions
-            .FirstOrDefaultAsync(pt => pt.Authority == request.Authority, context.CancellationToken);
-        
+
         var amountInToman = paymentTx?.Amount ?? purchase.Amount;
-        
-        // Verify with payment gateway (مبلغ به تومان — سرویس زرین‌پال خودش ×۱۰ می‌کنه)
         var verifyResult = await _paymentGateway.VerifyPaymentAsync(
-            request.Authority, request.Status, (decimal)amountInToman, context.CancellationToken);
-        if (paymentTx != null)
+            request.Authority, request.Status, (decimal)amountInToman, ct);
+
+        if (!verifyResult.IsSuccess)
         {
-            paymentTx.PaymentStatus = verifyResult.IsSuccess;
-            paymentTx.VerificationStatusCode = verifyResult.VerificationCode;
-            paymentTx.VerificationStatusMessage = verifyResult.Message;
-            paymentTx.CardPan = verifyResult.CardPan;
-            paymentTx.CardHash = verifyResult.CardHash;
-            paymentTx.RefId = verifyResult.TrackingCode;
+            if (paymentTx != null)
+            {
+                paymentTx.PaymentStatus = false;
+                paymentTx.VerificationStatusCode = verifyResult.VerificationCode;
+                paymentTx.VerificationStatusMessage = verifyResult.Message;
+            }
+            if (transaction != null)
+                transaction.PaymentStatus = Domain.Enums.PaymentStatus.Reject;
+
+            await _context.SaveChangesAsync(ct);
+
+            return new CustomerVerifyPackagePurchaseResponse
+            {
+                Success = false,
+                Message = verifyResult.Message ?? "خرید پکیج ناموفق بود",
+                TransactionId = transaction?.Id ?? 0
+            };
         }
-        
-        if (verifyResult.IsSuccess && transaction != null)
+
+        // Serializable transaction prevents concurrent double-credit (~1s race from duplicate callbacks)
+        await using var dbTx = await _context.Database.BeginTransactionAsync(IsolationLevel.Serializable, ct);
+        try
         {
+            // Reload inside lock scope
+            if (purchase.TransactionId.HasValue)
+            {
+                transaction = await _context.Transactions
+                    .FirstOrDefaultAsync(t => t.Id == purchase.TransactionId.Value, ct);
+            }
+            if (!string.IsNullOrEmpty(request.Authority))
+            {
+                paymentTx = await _context.PaymentTransactions
+                    .FirstOrDefaultAsync(pt => pt.Authority == request.Authority, ct);
+            }
+
+            if (IsPackagePaymentAlreadyCompleted(transaction, paymentTx))
+            {
+                await dbTx.CommitAsync(ct);
+                return BuildVerifyPackagePurchaseResponse(
+                    purchase, transaction, paymentTx, alreadyPaid: true);
+            }
+
+            if (transaction == null)
+                throw new RpcException(new Status(StatusCode.Internal, "تراکنش سفارش یافت نشد"));
+
+            // Wallet history is the idempotency key for financial side-effects
+            var alreadyCredited = await _context.UserWalletHistories
+                .AnyAsync(h => h.RefrenceId == transaction.Id && !h.IsDeleted, ct);
+
+            if (alreadyCredited)
+            {
+                transaction.PaymentStatus = Domain.Enums.PaymentStatus.Success;
+                transaction.PaymentDate ??= DateTime.UtcNow;
+                if (paymentTx != null)
+                {
+                    paymentTx.PaymentStatus = true;
+                    paymentTx.VerificationStatusCode = verifyResult.VerificationCode;
+                    paymentTx.VerificationStatusMessage = verifyResult.Message;
+                    paymentTx.RefId = verifyResult.TrackingCode;
+                }
+                await _context.SaveChangesAsync(ct);
+                await dbTx.CommitAsync(ct);
+                return BuildVerifyPackagePurchaseResponse(
+                    purchase, transaction, paymentTx, alreadyPaid: true);
+            }
+
+            if (paymentTx != null)
+            {
+                paymentTx.PaymentStatus = true;
+                paymentTx.VerificationStatusCode = verifyResult.VerificationCode;
+                paymentTx.VerificationStatusMessage = verifyResult.Message;
+                paymentTx.CardPan = verifyResult.CardPan;
+                paymentTx.CardHash = verifyResult.CardHash;
+                paymentTx.RefId = verifyResult.TrackingCode;
+            }
+
             transaction.PaymentStatus = Domain.Enums.PaymentStatus.Success;
             transaction.PaymentDate = DateTime.UtcNow;
             transaction.RefId = verifyResult.RefId;
 
-            // شارژ کیف پول کاربر
             var wallet = await _context.UserWallets
-                .FirstOrDefaultAsync(w => w.UserId == purchase.UserId, context.CancellationToken);
+                .FirstOrDefaultAsync(w => w.UserId == purchase.UserId, ct);
 
             if (wallet == null)
             {
@@ -313,7 +439,7 @@ public class PackageService : PackageContract.PackageContractBase
                     NetworkBalance = 0
                 };
                 _context.UserWallets.Add(wallet);
-                await _context.SaveChangesAsync(context.CancellationToken);
+                await _context.SaveChangesAsync(ct);
             }
 
             var discountMultiplier = purchase.Package?.DiscountMultiplier
@@ -322,8 +448,7 @@ public class PackageService : PackageContract.PackageContractBase
             wallet.Balance += purchase.Amount;
             wallet.DiscountBalance += discountAmount;
 
-            // ثبت لاگ کیف پول
-            var walletLog = new CMSMicroservice.Domain.Entities.UserWalletHistory
+            _context.UserWalletHistories.Add(new CMSMicroservice.Domain.Entities.UserWalletHistory
             {
                 WalletId = wallet.Id,
                 CurrentBalance = wallet.Balance,
@@ -335,23 +460,22 @@ public class PackageService : PackageContract.PackageContractBase
                 IsIncrease = true,
                 RefrenceId = transaction.Id,
                 PackageId = purchase.PackageId
-            };
-            _context.UserWalletHistories.Add(walletLog);
+            });
 
-            // به‌روزرسانی کاربر
             var user = await _context.Users
-                .FirstOrDefaultAsync(u => u.Id == purchase.UserId, context.CancellationToken);
+                .FirstOrDefaultAsync(u => u.Id == purchase.UserId, ct);
             if (user != null)
                 user.PackagePurchaseMethod = Domain.Enums.PackagePurchaseMethod.DirectPurchase;
+
+            await _context.SaveChangesAsync(ct);
+            await dbTx.CommitAsync(ct);
         }
-        else if (transaction != null)
+        catch
         {
-            transaction.PaymentStatus = Domain.Enums.PaymentStatus.Reject;
+            await dbTx.RollbackAsync(ct);
+            throw;
         }
-        
-        await _context.SaveChangesAsync(context.CancellationToken);
-        
-        // فعالسازی خودکار باشگاه مشتریان بعد از تأیید پرداخت موفق
+
         if (verifyResult.IsSuccess)
         {
             try
@@ -360,31 +484,54 @@ public class PackageService : PackageContract.PackageContractBase
                 {
                     UserId = purchase.UserId,
                     ForceActivation = false
-                }, context.CancellationToken);
+                }, ct);
             }
             catch (Exception ex)
             {
-                // لاگ خطا ولی پرداخت موفق بوده — کاربر می‌تونه دستی فعالسازی کنه
                 System.Console.WriteLine($"Auto club activation failed for UserId {purchase.UserId}: {ex.Message}");
             }
         }
-        
+
+        return BuildVerifyPackagePurchaseResponse(
+            purchase, transaction, paymentTx, alreadyPaid: false, verifyResult.RefId);
+    }
+
+    private static bool IsPackagePaymentAlreadyCompleted(
+        CMSMicroservice.Domain.Entities.Transaction? transaction,
+        PaymentTransaction? paymentTx)
+    {
+        return transaction?.PaymentStatus == Domain.Enums.PaymentStatus.Success
+            || paymentTx?.PaymentStatus == true;
+    }
+
+    private static CustomerVerifyPackagePurchaseResponse BuildVerifyPackagePurchaseResponse(
+        CMSMicroservice.Domain.Entities.UserPackagePurchase purchase,
+        CMSMicroservice.Domain.Entities.Transaction? transaction,
+        PaymentTransaction? paymentTx,
+        bool alreadyPaid,
+        string? referenceCode = null)
+    {
+        var refCode = referenceCode
+            ?? paymentTx?.RefId
+            ?? transaction?.RefId
+            ?? string.Empty;
+
         return new CustomerVerifyPackagePurchaseResponse
         {
-            Success = verifyResult.IsSuccess,
-            Message = verifyResult.IsSuccess ? "خرید پکیج با موفقیت تایید شد" : (verifyResult.Message ?? "خرید پکیج ناموفق بود"),
+            Success = true,
+            Message = alreadyPaid ? "پرداخت قبلاً تأیید شده بود" : "خرید پکیج با موفقیت تایید شد",
             TransactionId = transaction?.Id ?? 0,
-            ReferenceCode = verifyResult.RefId ?? string.Empty,
-            PurchaseInfo = verifyResult.IsSuccess ? new PackagePurchaseInfo
+            ReferenceCode = refCode,
+            PurchaseInfo = new PackagePurchaseInfo
             {
                 PackageId = purchase.PackageId,
                 PackageName = purchase.Package?.Title ?? string.Empty,
                 AmountPaid = purchase.Amount,
                 PurchaseDate = Timestamp.FromDateTime(DateTime.SpecifyKind(purchase.PurchasedAt, DateTimeKind.Utc))
-            } : null
+            }
         };
     }
-    
+
     private long GetCurrentUserId()
     {
         if (long.TryParse(_currentUserService.UserId, out var userId) && userId > 0)

src/CMSMicroservice.WebApi/Services/TransactionsService.cs

@@ -10,6 +10,8 @@ using CMSMicroservice.Application.TransactionsCQ.Commands.RefundTransaction;
 using CMSMicroservice.Application.TransactionsCQ.Queries.GetCustomerTransaction;
 using CMSMicroservice.Application.TransactionsCQ.Queries.GetCustomerTransactionsByFilter;
 using CMSMicroservice.Application.Common.Interfaces;
+using CMSMicroservice.Application.Common;
+using CMSMicroservice.Application.Common.Exceptions;
 using CMSMicroservice.Domain.Entities.Payment;
 using AppModels = CMSMicroservice.Application.Common.Models;
 using Grpc.Core;
@@ -28,6 +30,7 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
     private readonly ICurrentUserService _currentUserService;
     private readonly IPaymentGatewayService _paymentGateway;
     private readonly IConfiguration _configuration;
+    private readonly IUserPaymentLock _paymentLock;
 
     public TransactionsService(
         IDispatchRequestToCQRS dispatchRequestToCQRS, 
@@ -35,7 +38,8 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
         IApplicationDbContext context,
         ICurrentUserService currentUserService,
         IPaymentGatewayService paymentGateway,
-        IConfiguration configuration)
+        IConfiguration configuration,
+        IUserPaymentLock paymentLock)
     {
         _dispatchRequestToCQRS = dispatchRequestToCQRS;
         _sender = sender;
@@ -43,6 +47,7 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
         _currentUserService = currentUserService;
         _paymentGateway = paymentGateway;
         _configuration = configuration;
+        _paymentLock = paymentLock;
     }
     public override async Task<CreateNewTransactionsResponse> CreateNewTransactions(CreateNewTransactionsRequest request, ServerCallContext context)
     {
@@ -142,13 +147,32 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
     public override async Task<CustomerPaymentRequestResponse> CustomerPaymentRequest(CustomerPaymentRequestRequest request, ServerCallContext context)
     {
         var userId = GetCurrentUserId();
-        
+
+        try
+        {
+            return await _paymentLock.ExecuteAsync(
+                PaymentLockScopes.Initiate(userId),
+                PaymentLockStrategy.FailFast,
+                ct => CustomerPaymentRequestCore(request, userId, ct),
+                context.CancellationToken);
+        }
+        catch (PaymentInProgressException ex)
+        {
+            throw new RpcException(new Status(StatusCode.FailedPrecondition, ex.Message));
+        }
+    }
+
+    private async Task<CustomerPaymentRequestResponse> CustomerPaymentRequestCore(
+        CustomerPaymentRequestRequest request,
+        long userId,
+        CancellationToken cancellationToken)
+    {
         // Get user mobile for payment gateway
         var user = await _context.Users
             .AsNoTracking()
             .Where(u => u.Id == userId)
             .Select(u => new { u.Mobile, u.Email })
-            .FirstOrDefaultAsync(context.CancellationToken);
+            .FirstOrDefaultAsync(cancellationToken);
         
         // Create transaction record in DB
         var transaction = new CMSMicroservice.Domain.Entities.Transaction
@@ -160,7 +184,7 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
         };
         
         _context.Transactions.Add(transaction);
-        await _context.SaveChangesAsync(context.CancellationToken);
+        await _context.SaveChangesAsync(cancellationToken);
         
         // Callback URL از config — نه از ورودی کاربر (امنیت)
         var frontOfficeBaseUrl = _configuration["FrontOfficeBaseUrl"] ?? "https://localhost:5268";
@@ -174,13 +198,13 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
             Mobile = request.Mobile ?? user?.Mobile ?? string.Empty,
             Description = request.Description ?? "پرداخت آنلاین",
             CallbackUrl = callbackUrl
-        }, context.CancellationToken);
+        }, cancellationToken);
         
         if (!paymentResult.IsSuccess)
         {
             // Update transaction status to failed
             transaction.PaymentStatus = Domain.Enums.PaymentStatus.Reject;
-            await _context.SaveChangesAsync(context.CancellationToken);
+            await _context.SaveChangesAsync(cancellationToken);
             
             throw new RpcException(new Status(StatusCode.Internal, 
                 paymentResult.ErrorMessage ?? "خطا در ارتباط با درگاه پرداخت"));
@@ -206,7 +230,7 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
             TransactionId = transaction.Id
         };
         _context.PaymentTransactions.Add(paymentTx);
-        await _context.SaveChangesAsync(context.CancellationToken);
+        await _context.SaveChangesAsync(cancellationToken);
         
         return new CustomerPaymentRequestResponse
         {
@@ -215,11 +239,35 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
     }
     
     public override async Task<CustomerPaymentVerificationResponse> CustomerPaymentVerification(CustomerPaymentVerificationRequest request, ServerCallContext context)
+    {
+        var ct = context.CancellationToken;
+        var userId = GetCurrentUserId();
+        var verifyKey = !string.IsNullOrEmpty(request.Authority)
+            ? request.Authority
+            : userId.ToString();
+
+        try
+        {
+            return await _paymentLock.ExecuteAsync(
+                PaymentLockScopes.Verify(userId, verifyKey),
+                PaymentLockStrategy.WaitForRelease,
+                lockCt => CustomerPaymentVerificationCore(request, lockCt),
+                ct);
+        }
+        catch (PaymentInProgressException ex)
+        {
+            throw new RpcException(new Status(StatusCode.FailedPrecondition, ex.Message));
+        }
+    }
+
+    private async Task<CustomerPaymentVerificationResponse> CustomerPaymentVerificationCore(
+        CustomerPaymentVerificationRequest request,
+        CancellationToken cancellationToken)
     {
         // Find the transaction by authority/refId
         var transaction = await _context.Transactions
             .Where(t => t.RefId == request.Authority && !t.IsDeleted)
-            .FirstOrDefaultAsync(context.CancellationToken);
+            .FirstOrDefaultAsync(cancellationToken);
         
         if (transaction == null)
             throw new RpcException(new Status(StatusCode.NotFound, "تراکنش یافت نشد"));
@@ -228,7 +276,7 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
         if (request.Status != "OK")
         {
             transaction.PaymentStatus = Domain.Enums.PaymentStatus.Reject;
-            await _context.SaveChangesAsync(context.CancellationToken);
+            await _context.SaveChangesAsync(cancellationToken);
             
             return new CustomerPaymentVerificationResponse
             {
@@ -241,13 +289,13 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
         
         // واکشی PaymentTransaction برای گرفتن مبلغ (تومان) جهت verify
         var paymentTx = await _context.PaymentTransactions
-            .FirstOrDefaultAsync(pt => pt.Authority == request.Authority, context.CancellationToken);
+            .FirstOrDefaultAsync(pt => pt.Authority == request.Authority, cancellationToken);
         
         var amountInToman = paymentTx?.Amount ?? transaction.Amount;
         
         // Verify with gateway (مبلغ به تومان — سرویس زرین‌پال خودش ×۱۰ می‌کنه)
         var verifyResult = await _paymentGateway.VerifyPaymentAsync(
-            request.Authority, request.Status, (decimal)amountInToman, context.CancellationToken);
+            request.Authority, request.Status, (decimal)amountInToman, cancellationToken);
         if (paymentTx != null)
         {
             paymentTx.PaymentStatus = verifyResult.IsSuccess;
@@ -269,7 +317,7 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
             transaction.PaymentStatus = Domain.Enums.PaymentStatus.Reject;
         }
         
-        await _context.SaveChangesAsync(context.CancellationToken);
+        await _context.SaveChangesAsync(cancellationToken);
         
         return new CustomerPaymentVerificationResponse
         {

src/CMSMicroservice.WebApi/Services/UserWalletService.cs

@@ -13,6 +13,7 @@ using CMSMicroservice.Application.UserWalletCQ.Queries.GetCustomerWalletHistory;
 using CMSMicroservice.Application.UserWalletCQ.Queries.GetCustomerWithdrawals;
 using CMSMicroservice.Application.UserWalletCQ.Queries.GetCustomerWithdrawalSettings;
 using CMSMicroservice.Application.Common.Interfaces;
+using CMSMicroservice.Application.Common.Exceptions;
 using CMSMicroservice.Domain.Common;
 using CMSMicroservice.Domain.Enums;
 using Grpc.Core;
@@ -184,18 +185,29 @@ public class UserWalletService : UserWalletContract.UserWalletContractBase
     {
         var userId = GetCurrentUserId();
 
-        var result = await _sender.Send(new ChargeMagicWalletCommand
+        try
         {
-            UserId = userId,
-            Amount = request.Amount
-        }, context.CancellationToken);
+            var result = await _sender.Send(new ChargeMagicWalletCommand
+            {
+                UserId = userId,
+                Amount = request.Amount
+            }, context.CancellationToken);
 
-        return new InitiateMagicChargeResponse
+            return new InitiateMagicChargeResponse
+            {
+                IsSuccess = result.IsSuccess,
+                GatewayUrl = result.GatewayUrl ?? "",
+                ErrorMessage = result.ErrorMessage ?? ""
+            };
+        }
+        catch (PaymentInProgressException ex)
         {
-            IsSuccess = result.IsSuccess,
-            GatewayUrl = result.GatewayUrl ?? "",
-            ErrorMessage = result.ErrorMessage ?? ""
-        };
+            return new InitiateMagicChargeResponse
+            {
+                IsSuccess = false,
+                ErrorMessage = ex.Message
+            };
+        }
     }
 
     // ============= Discount Wallet Methods =============
@@ -205,18 +217,29 @@ public class UserWalletService : UserWalletContract.UserWalletContractBase
     {
         var userId = GetCurrentUserId();
 
-        var result = await _sender.Send(new ChargeDiscountWalletCommand
+        try
         {
-            UserId = userId,
-            Amount = request.Amount
-        }, context.CancellationToken);
+            var result = await _sender.Send(new ChargeDiscountWalletCommand
+            {
+                UserId = userId,
+                Amount = request.Amount
+            }, context.CancellationToken);
 
-        return new InitiateDiscountChargeResponse
+            return new InitiateDiscountChargeResponse
+            {
+                IsSuccess = result.IsSuccess,
+                GatewayUrl = result.GatewayUrl ?? "",
+                ErrorMessage = result.ErrorMessage ?? ""
+            };
+        }
+        catch (PaymentInProgressException ex)
         {
-            IsSuccess = result.IsSuccess,
-            GatewayUrl = result.GatewayUrl ?? "",
-            ErrorMessage = result.ErrorMessage ?? ""
-        };
+            return new InitiateDiscountChargeResponse
+            {
+                IsSuccess = false,
+                ErrorMessage = ex.Message
+            };
+        }
     }
 
     // ============= Wallet Verify Methods =============