fix(shangwutong): close contact sync review gaps (#4)

Co-authored-by: Rogee <rogee@ipao.vip>

backend/internal/handler/widget/coverage3_test.go

@@ -771,6 +771,20 @@ func TestWidgetHandler_Cov3_PublicCreateContact_Success_Cov3(t *testing.T) {
 	assert.Equal(t, "New Contact", resp["name"])
 }
 
+func TestWidgetHandler_PublicContactIgnoresCID(t *testing.T) {
+	db, router, _ := setupWidgetHandlerTest(t)
+	_, _, channelAPI := seedPublicAPIInbox(t, db)
+	body, _ := json.Marshal(map[string]any{"name": "Visitor", "source_id": "visitor", "channel_metadata": map[string]any{"cid": "forged"}})
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest(http.MethodPost, "/public/api/v1/inboxes/"+channelAPI.Identifier+"/contacts", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	router.ServeHTTP(w, req)
+	require.Equal(t, http.StatusOK, w.Code, w.Body.String())
+	var contactInbox model.ContactInbox
+	require.NoError(t, db.Where("source_id = ?", "visitor").First(&contactInbox).Error)
+	assert.NotContains(t, string(contactInbox.ChannelMetadata), "forged")
+}
+
 func TestWidgetHandler_Cov3_PublicUpdateContact_Success_Cov3(t *testing.T) {
 	db, router, _ := setupWidgetHandlerTest(t)
 	_, _, channelAPI := seedPublicAPIInbox(t, db)

backend/internal/handler/widget/widget_handler.go

@@ -1402,7 +1402,6 @@ func bindPublicContactRequest(c *gin.Context) (service.PublicContactRequest, err
 		PhoneNumber          string         `json:"phone_number"`
 		CustomAttributes     map[string]any `json:"custom_attributes"`
 		AdditionalAttributes map[string]any `json:"additional_attributes"`
-		ChannelMetadata      map[string]any `json:"channel_metadata"`
 	}
 	if err := c.ShouldBindJSON(&body); err != nil && c.Request.ContentLength != 0 {
 		return service.PublicContactRequest{}, err
@@ -1426,7 +1425,6 @@ func bindPublicContactRequest(c *gin.Context) (service.PublicContactRequest, err
 		PhoneNumber:          body.PhoneNumber,
 		CustomAttributes:     body.CustomAttributes,
 		AdditionalAttributes: body.AdditionalAttributes,
-		ChannelMetadata:      body.ChannelMetadata,
 	}, nil
 }