sundynix/sundynix-agentix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(billing): 微信支付钉死「微信支付公钥」验签体系 —— 商户 2025-09 开户没有平台证书

Browse Source 
用户拿旧项目代码对出来的真问题:我此前用 WithWechatPayAutoAuthCipher(平台证书
模式,APIv3 密钥自动下载平台证书验签),但 2024 起新注册商户只发「微信支付公钥」
(PUB_KEY_ID_ 开头)、没有平台证书——在该商户号上初始化/回调验签都会挂。

- 改 WithWechatPayPublicKeyAuthCipher(商户私钥+公钥ID+公钥文件);回调验签用
  NewSHA256WithRSAPubkeyVerifier;平台证书模式不留双模式赘肉(YAGNI)。
- Config 增 public_key_path/public_key_id(必填,公钥文件同样只存路径);
  admin 卡片补两字段;env 兜底加 WECHAT_PUBLIC_KEY(_ID)。
- 顺手修 live 撞出的真 bug:sundynix_setting.value 是 varchar(255),
  支付配置 JSON(含加密密钥)一条就超(SQLSTATE 22001)→ 改 text。
live:列类型已迁 text;缺公钥两项报「配置不全,缺: public_key_path,
public_key_id」;GET 回显含新字段。go 6 包测试+tsc+41 vitest 全绿。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Blizzard
2026-07-17 11:12:26 +08:00
parent d1e1e0fc4a
commit 5d7eca5de3
6 changed files with 43 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sundynix-admin/src/api.ts
+4
View File
@@ -231,6 +231,8 @@ export interface WechatPayConfig {
mchid: string;
cert_serial: string;
private_key_path: string;
public_key_path: string; // 微信支付公钥（2024 起新商户体系；本商户 2025-09 开户）
public_key_id: string; // PUB_KEY_ID_ 开头
appid: string;
notify_url: string;
has_apiv3_key: boolean;
@@ -248,6 +250,8 @@ export async function saveWechatPay(body: {
mchid: string;
cert_serial: string;
private_key_path: string;
public_key_path: string;
public_key_id: string;
apiv3_key: string;
appid: string;
notify_url: string;
sundynix-admin/src/components/TopupChannels.tsx
+5 -1
View File
@@ -29,7 +29,7 @@ export function TopupChannels() {
// APIv3 密钥只写不回显（密文入库，与模型 API Key 同一把密钥加密）；
// 商户证书私钥文件放服务器磁盘，这里只填路径。
function WechatConfigBlock() {
const empty: WechatPayConfig = { mchid: "", cert_serial: "", private_key_path: "", appid: "", notify_url: "", has_apiv3_key: false };
const empty: WechatPayConfig = { mchid: "", cert_serial: "", private_key_path: "", public_key_path: "", public_key_id: "", appid: "", notify_url: "", has_apiv3_key: false };
const [cfg, setCfg] = useState<WechatPayConfig>(empty);
const [apiv3, setApiv3] = useState(""); // 留空=沿用已存
const [enabled, setEnabled] = useState(false);
@@ -56,6 +56,8 @@ function WechatConfigBlock() {
mchid: cfg.mchid,
cert_serial: cfg.cert_serial,
private_key_path: cfg.private_key_path,
public_key_path: cfg.public_key_path,
public_key_id: cfg.public_key_id,
apiv3_key: apiv3, // 空串=后端沿用旧密钥
appid: cfg.appid,
notify_url: cfg.notify_url,
@@ -102,6 +104,8 @@ function WechatConfigBlock() {
{field("API 证书序列号", "cert_serial", "5157F09E…")}
{field("appid（公众号/小程序）", "appid", "wx88888888")}
{field("商户私钥文件路径（服务器磁盘）", "private_key_path", "/etc/sundynix/wechat/apiclient_key.pem", "md:col-span-2")}
{field("公钥 ID（PUB_KEY_ID_ 开头）", "public_key_id", "PUB_KEY_ID_01…")}
{field("微信支付公钥文件路径（服务器磁盘）", "public_key_path", "/etc/sundynix/wechat/pub_key.pem", "md:col-span-2")}
<label className="text-xs text-gray-500">
APIv3 密钥{cfg.has_apiv3_key && <span className="ml-1 text-emerald-600">已保存</span>}
<input
sundynix-gateway/internal/handler/payment_admin.go
+6
View File
@@ -50,6 +50,8 @@ func (h *Handler) AdminGetWechatPay(c *gin.Context) {
"mchid": cfg.MchID,
"cert_serial": cfg.CertSerial,
"private_key_path": cfg.PrivateKeyPath,
"public_key_path": cfg.PublicKeyPath,
"public_key_id": cfg.PublicKeyID,
"appid": cfg.AppID,
"notify_url": cfg.NotifyURL,
"has_apiv3_key": cfg.APIv3Key != "", // 密钥只报有无，明文永不回显
@@ -69,6 +71,8 @@ func (h *Handler) AdminSaveWechatPay(c *gin.Context) {
APIv3Key string `json:"apiv3_key"`
AppID string `json:"appid"`
NotifyURL string `json:"notify_url"`
PublicKeyPath string `json:"public_key_path"`
PublicKeyID string `json:"public_key_id"`
}
if err := c.ShouldBindJSON(&b); err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
@@ -86,6 +90,8 @@ func (h *Handler) AdminSaveWechatPay(c *gin.Context) {
APIv3Key: apiv3,
AppID: strings.TrimSpace(b.AppID),
NotifyURL: strings.TrimSpace(b.NotifyURL),
PublicKeyPath: strings.TrimSpace(b.PublicKeyPath),
PublicKeyID: strings.TrimSpace(b.PublicKeyID),
}
stored := cfg
if stored.APIv3Key != "" {
sundynix-gateway/internal/payment/manager.go
+11 -2
View File
@@ -20,20 +20,27 @@ type Config struct {
APIv3Key string `json:"apiv3_key"`
AppID string `json:"appid"`
NotifyURL string `json:"notify_url"`
// 微信支付公钥验签体系（2024 起新注册商户只有这个；本项目商户 2025-09 开户，钉死此模式，
// 老商户的平台证书模式不做）。
PublicKeyPath string `json:"public_key_path"` // 微信支付公钥文件路径（服务器磁盘）
PublicKeyID string `json:"public_key_id"` // 公钥 ID（PUB_KEY_ID_ 开头）
}
// Empty 完全未配置（一个字段都没填）。
func (c Config) Empty() bool {
return c.MchID == "" && c.CertSerial == "" && c.PrivateKeyPath == "" &&
c.APIv3Key == "" && c.AppID == "" && c.NotifyURL == ""
c.APIv3Key == "" && c.AppID == "" && c.NotifyURL == "" &&
c.PublicKeyPath == "" && c.PublicKeyID == ""
}
// missing 返回缺失字段名（配置不全时给 admin 一句能看懂的原因）。
// missing 返回缺失字段名（配置不全时给 admin 一句能看懂的原因）。八项全必填：
// APIv3 密钥用于回调资源解密，公钥两项用于验签。
func (c Config) missing() []string {
var out []string
for _, f := range []struct{ k, v string }{
{"mchid", c.MchID}, {"cert_serial", c.CertSerial}, {"private_key_path", c.PrivateKeyPath},
{"apiv3_key", c.APIv3Key}, {"appid", c.AppID}, {"notify_url", c.NotifyURL},
{"public_key_path", c.PublicKeyPath}, {"public_key_id", c.PublicKeyID},
} {
if strings.TrimSpace(f.v) == "" {
out = append(out, f.k)
@@ -51,6 +58,8 @@ func ConfigFromEnv() Config {
APIv3Key: os.Getenv("WECHAT_APIV3_KEY"),
AppID: os.Getenv("WECHAT_APPID"),
NotifyURL: os.Getenv("WECHAT_NOTIFY_URL"),
PublicKeyPath: os.Getenv("WECHAT_PUBLIC_KEY"),
PublicKeyID: os.Getenv("WECHAT_PUBLIC_KEY_ID"),
}
}
sundynix-gateway/internal/payment/wechat.go
+16 -6
View File
@@ -5,13 +5,13 @@ package payment
import (
"context"
"crypto/rsa"
"errors"
"fmt"
"net/http"
"github.com/wechatpay-apiv3/wechatpay-go/core"
"github.com/wechatpay-apiv3/wechatpay-go/core/auth/verifiers"
"github.com/wechatpay-apiv3/wechatpay-go/core/downloader"
"github.com/wechatpay-apiv3/wechatpay-go/core/notify"
"github.com/wechatpay-apiv3/wechatpay-go/core/option"
"github.com/wechatpay-apiv3/wechatpay-go/services/payments"
@@ -29,21 +29,31 @@ type Wechat struct {
apiv3Key string
client *core.Client
svc native.NativeApiService
pubKey *rsa.PublicKey // 微信支付公钥（验签回调用；构造时必填）
pubKeyID string
}
// New 按完整配置装配微信渠道（私钥从磁盘路径加载；调用方保证字段齐全）。
// New 按完整配置装配微信渠道（商户私钥/微信支付公钥都从磁盘路径加载；调用方保证字段齐全）。
// 验签体系钉死「微信支付公钥」模式（WithWechatPayPublicKeyAuthCipher）：本项目商户
// 2025-09 开户，只有公钥体系；老商户的平台证书模式（AutoAuthCipher）不支持。
func New(ctx context.Context, c Config) (*Wechat, error) {
priv, err := utils.LoadPrivateKeyWithPath(c.PrivateKeyPath)
if err != nil {
return nil, fmt.Errorf("商户私钥加载失败(%s): %w", c.PrivateKeyPath, err)
}
client, err := core.NewClient(ctx, option.WithWechatPayAutoAuthCipher(c.MchID, c.CertSerial, priv, c.APIv3Key))
pub, err := utils.LoadPublicKeyWithPath(c.PublicKeyPath)
if err != nil {
return nil, fmt.Errorf("微信支付公钥加载失败(%s): %w", c.PublicKeyPath, err)
}
client, err := core.NewClient(ctx,
option.WithWechatPayPublicKeyAuthCipher(c.MchID, c.CertSerial, priv, c.PublicKeyID, pub))
if err != nil {
return nil, fmt.Errorf("客户端初始化失败: %w", err)
}
return &Wechat{
mchID: c.MchID, appID: c.AppID, notifyURL: c.NotifyURL, apiv3Key: c.APIv3Key,
client: client, svc: native.NativeApiService{Client: client},
pubKey: pub, pubKeyID: c.PublicKeyID,
}, nil
}
@@ -111,11 +121,11 @@ func (w *Wechat) QueryOrder(ctx context.Context, orderID string) (QueryResult, e
return fromTransaction(t), nil
}
// VerifyCallback 验签 + 解密支付回调（APIv3：平台证书验签、AES-GCM 解密资源）。
// VerifyCallback 验签 + 解密支付回调（微信支付公钥验签 + APIv3 密钥 AES-GCM 解密资源）。
// 验签失败一律拒绝——回调路由是公开的，签名是唯一的门。
func (w *Wechat) VerifyCallback(req *http.Request) (QueryResult, error) {
certVisitor := downloader.MgrInstance().GetCertificateVisitor(w.mchID)
h, err := notify.NewRSANotifyHandler(w.apiv3Key, verifiers.NewSHA256WithRSAVerifier(certVisitor))
h, err := notify.NewRSANotifyHandler(w.apiv3Key,
verifiers.NewSHA256WithRSAPubkeyVerifier(w.pubKeyID, *w.pubKey))
if err != nil {
return QueryResult{}, fmt.Errorf("回调处理器初始化失败: %w", err)
}
sundynix-gateway/internal/store/setting.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
type Setting struct {
BaseModel
Key string `gorm:"size:64;uniqueIndex"`
Value string `gorm:"size:255"`
Value string `gorm:"type:text"` // 曾是 varchar(255)：支付配置 JSON(含加密密钥)一条就超,live 撞过 22001
}
func (Setting) TableName() string { return "sundynix_setting" }