fix: 补提交校验、停用检查、入群过滤与按完成时刻清理

internal/app/message/submit.go

@@ -46,6 +46,9 @@ func (a *App) Submit(ctx context.Context, senderID string, conn port.ConnInfo, r
 	keep := protocol.EffectiveOfflineKeep(req)
 	ttl := protocol.EffectiveOfflineTTL(req)
 	receipt := protocol.EffectiveReceipt(req)
+	if keep && ttl <= 0 {
+		return SubmitResult{}, errCode(protocol.CodeBadRequest, "ttl_seconds must be > 0")
+	}
 	if keep && a.lim.MaxTTLSeconds > 0 && ttl > a.lim.MaxTTLSeconds {
 		return SubmitResult{}, errCode(protocol.CodeBadRequest, "ttl_seconds exceeds max_ttl_seconds")
 	}
@@ -66,6 +69,9 @@ func (a *App) Submit(ctx context.Context, senderID string, conn port.ConnInfo, r
 		}
 		return SubmitResult{}, err
 	}
+	if sender.Enabled == 0 {
+		return SubmitResult{}, errCode(protocol.CodeUnauthorized, "sender disabled")
+	}
 
 	sendAt, err := a.computeSendAt(req, sender.DefaultDelayMs, nowMs)
 	if err != nil {
@@ -155,6 +161,17 @@ func (a *App) Submit(ctx context.Context, senderID string, conn port.ConnInfo, r
 			return e
 		}
 
+		snd, se := loadEndpointTx(tx, senderID)
+		if se != nil {
+			if errors.Is(se, sql.ErrNoRows) {
+				return errCode(protocol.CodeInvalidTarget, "sender not found")
+			}
+			return se
+		}
+		if snd.Enabled == 0 {
+			return errCode(protocol.CodeUnauthorized, "sender disabled")
+		}
+
 		// 写事务内再确认目标与授权（防并发停用/退群）。
 		switch req.To.Kind {
 		case protocol.TargetEndpoint:
@@ -197,10 +214,6 @@ func (a *App) Submit(ctx context.Context, senderID string, conn port.ConnInfo, r
 				}
 			}
 			// 发送方设了对话密码且发给别人的单聊：给对方写回复授权。
-			snd, se := loadEndpointTx(tx, senderID)
-			if se != nil {
-				return se
-			}
 			if senderID != req.To.ID && snd.TalkHash != nil && *snd.TalkHash != "" {
 				if ge := upsertGrantTx(tx, req.To.ID, senderID, snd.TalkVersion, GrantKindReply, nowMs); ge != nil {
 					return ge
@@ -295,6 +308,12 @@ func (a *App) computeSendAt(req *protocol.Send, defaultDelayMs, nowMs int64) (in
 		if *req.DelayMs < 0 {
 			return 0, errCode(protocol.CodeBadRequest, "delay_ms negative")
 		}
+		if a.lim.MaxScheduleSeconds > 0 {
+			maxDelay := a.lim.MaxScheduleSeconds * 1000
+			if *req.DelayMs > maxDelay {
+				return 0, errCode(protocol.CodeBadRequest, "send time exceeds max_schedule_seconds")
+			}
+		}
 		sendAt = nowMs + *req.DelayMs
 	default:
 		if defaultDelayMs < 0 {