优化

finance/src/test/java/com/baiyue/finance/WalletCommandEventServiceTest.java

@@ -40,6 +40,18 @@ class WalletCommandEventServiceTest {
         when(transactions.getTransaction(any())).thenAnswer(invocation -> mock(TransactionStatus.class));
     }
 
+    @Test
+    void rejectsTamperedEnvelopeBeforeOpeningWalletTransaction() {
+        EventEnvelope valid = envelope("FREEZE", 1L, BigDecimal.TEN);
+        EventEnvelope tampered = new EventEnvelope(valid.eventId(), valid.eventType(), valid.eventVersion(),
+            valid.occurredAt(), valid.sourceRegion(), valid.targetRegion(), valid.tenantId(), valid.aggregateType(),
+            valid.aggregateId(), valid.aggregateVersion(), valid.handoverVersion(), valid.traceId(),
+            valid.correlationId(), valid.causationId(), valid.payload(), "sha256:" + "0".repeat(64));
+        assertThatThrownBy(() -> service.consume(tampered)).isInstanceOf(FinanceEventException.class)
+            .hasMessageContaining("摘要与实际载荷不一致");
+        verifyNoInteractions(jdbc, wallet);
+    }
+
     @Test
     void freezesWalletAndPublishesCompletedEvent() {
         EventEnvelope envelope = envelope("FREEZE", 31L, new BigDecimal("88.50"));