微信SDK接通

server/dukang-api/src/integrations/integrations.constants.ts

@@ -1,3 +1,4 @@
 export const SMS_PROVIDER = 'SMS_PROVIDER';
 export const PAY_PROVIDER = 'PAY_PROVIDER';
 export const DELIVERY_PROVIDER = 'DELIVERY_PROVIDER';
+export const WECHAT_PROVIDER = 'WECHAT_PROVIDER';

server/dukang-api/src/integrations/integrations.module.ts

@@ -1,21 +1,50 @@
 import { Module } from '@nestjs/common';
 import { BullModule } from '@nestjs/bullmq';
+import { loadAppConfig } from '@dukang/shared-types';
 import { SmsMockProvider } from './sms/sms.mock.provider';
 import { PayMockProvider } from './pay/pay.mock.provider';
+import { PayWechatProvider } from './pay/pay.wechat.provider';
 import { DeliveryMockProvider } from './delivery/delivery.mock.provider';
-import { SMS_PROVIDER, PAY_PROVIDER, DELIVERY_PROVIDER } from './integrations.constants';
+import { WechatApiProvider } from './wechat/wechat.api.provider';
+import { WechatDisabledProvider } from './wechat/wechat.disabled.provider';
+import {
+  SMS_PROVIDER,
+  PAY_PROVIDER,
+  DELIVERY_PROVIDER,
+  WECHAT_PROVIDER,
+} from './integrations.constants';
 import { DELIVERY_QUEUE } from '../jobs/jobs.constants';
+import type { IWechatProvider } from './wechat/wechat.interface';
+import type { IPayProvider } from './pay/pay.interface';
 
 @Module({
   imports: [BullModule.registerQueue({ name: DELIVERY_QUEUE })],
   providers: [
     { provide: SMS_PROVIDER, useClass: SmsMockProvider },
-    { provide: PAY_PROVIDER, useClass: PayMockProvider },
+    WechatApiProvider,
+    WechatDisabledProvider,
+    {
+      provide: WECHAT_PROVIDER,
+      useFactory: (api: WechatApiProvider, disabled: WechatDisabledProvider): IWechatProvider => {
+        const cfg = loadAppConfig();
+        return cfg.wechatAuthEnabled && cfg.wxAppId ? api : disabled;
+      },
+      inject: [WechatApiProvider, WechatDisabledProvider],
+    },
+    PayMockProvider,
+    PayWechatProvider,
+    {
+      provide: PAY_PROVIDER,
+      useFactory: (mock: PayMockProvider, wechat: PayWechatProvider): IPayProvider => {
+        const cfg = loadAppConfig();
+        return cfg.mockPay ? mock : wechat;
+      },
+      inject: [PayMockProvider, PayWechatProvider],
+    },
     { provide: DELIVERY_PROVIDER, useClass: DeliveryMockProvider },
     SmsMockProvider,
-    PayMockProvider,
     DeliveryMockProvider,
   ],
-  exports: [SMS_PROVIDER, PAY_PROVIDER, DELIVERY_PROVIDER],
+  exports: [SMS_PROVIDER, PAY_PROVIDER, DELIVERY_PROVIDER, WECHAT_PROVIDER],
 })
 export class IntegrationsModule {}

server/dukang-api/src/integrations/pay/pay.interface.ts

@@ -1,3 +1,9 @@
+import type { WechatJsapiPrepayParams } from '@dukang/shared-types';
+
+export type PayOrderResult =
+  | { mode: 'mock'; externalNo: string }
+  | { mode: 'jsapi'; prepay: WechatJsapiPrepayParams };
+
 export interface IPayProvider {
-  payOrder(orderId: bigint): Promise<{ externalNo: string }>;
+  payOrder(orderId: bigint, openId?: string): Promise<PayOrderResult>;
 }

server/dukang-api/src/integrations/pay/pay.mock.provider.ts

@@ -1,15 +1,15 @@
 import { Injectable } from '@nestjs/common';
 import { loadAppConfig } from '@dukang/shared-types';
-import { IPayProvider } from './pay.interface';
+import type { IPayProvider, PayOrderResult } from './pay.interface';
 
 @Injectable()
 export class PayMockProvider implements IPayProvider {
   private readonly config = loadAppConfig();
 
-  async payOrder(_orderId: bigint): Promise<{ externalNo: string }> {
+  async payOrder(_orderId: bigint, _openId?: string): Promise<PayOrderResult> {
     if (!this.config.mockPay) {
-      throw new Error('Real WeChat pay not implemented in preV1');
+      throw new Error('Real WeChat pay requires PayWechatProvider');
     }
-    return { externalNo: `MOCK-${Date.now()}` };
+    return { mode: 'mock', externalNo: `MOCK-${Date.now()}` };
   }
 }

server/dukang-api/src/integrations/pay/pay.wechat.provider.ts

@@ -0,0 +1,41 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { loadAppConfig } from '@dukang/shared-types';
+import { PrismaService } from '../../common/prisma/prisma.module';
+import { WECHAT_PROVIDER } from '../integrations.constants';
+import type { IWechatProvider } from '../wechat/wechat.interface';
+import type { IPayProvider, PayOrderResult } from './pay.interface';
+
+@Injectable()
+export class PayWechatProvider implements IPayProvider {
+  private readonly config = loadAppConfig();
+
+  constructor(
+    private readonly prisma: PrismaService,
+    @Inject(WECHAT_PROVIDER) private readonly wechat: IWechatProvider,
+  ) {}
+
+  async payOrder(orderId: bigint, openId?: string): Promise<PayOrderResult> {
+    if (this.config.mockPay) {
+      return { mode: 'mock', externalNo: `MOCK-${Date.now()}` };
+    }
+    if (!openId) {
+      throw new Error('微信支付需要用户 openId，请先完成微信授权登录');
+    }
+    if (!this.wechat.isEnabled()) {
+      throw new Error('微信能力未启用，请配置 WECHAT_AUTH_ENABLED 与 WX_APP_ID/SECRET');
+    }
+
+    const order = await this.prisma.order.findUnique({ where: { id: orderId } });
+    if (!order) throw new Error('订单不存在');
+
+    const amountFen = Math.round(Number(order.payAmount) * 100);
+    const prepay = await this.wechat.createJsapiPrepay({
+      orderNo: order.orderNo,
+      description: `杜康好客订单 ${order.orderNo}`,
+      amountFen,
+      openId,
+      notifyUrl: process.env.WX_PAY_NOTIFY_URL ?? '',
+    });
+    return { mode: 'jsapi', prepay };
+  }
+}

server/dukang-api/src/integrations/wechat/wechat.api.provider.ts

@@ -0,0 +1,259 @@
+import { createDecipheriv, createHash, createSign, randomBytes, randomUUID } from 'crypto';
+import { Injectable, InternalServerErrorException, Logger } from '@nestjs/common';
+import { loadAppConfig } from '@dukang/shared-types';
+import { RedisService } from '../../common/redis/redis.service';
+import type { IWechatProvider, WechatCodeSession, WechatOAuthSession } from './wechat.interface';
+
+type TokenCache = { accessToken: string; expiresAt: number };
+type TicketCache = { ticket: string; expiresAt: number };
+
+const ACCESS_TOKEN_KEY = 'wechat:access_token';
+const JSAPI_TICKET_KEY = 'wechat:jsapi_ticket';
+
+@Injectable()
+export class WechatApiProvider implements IWechatProvider {
+  private readonly logger = new Logger(WechatApiProvider.name);
+  private readonly config = loadAppConfig();
+  private readonly appId = process.env.WX_APP_ID ?? '';
+  private readonly appSecret = process.env.WX_APP_SECRET ?? '';
+  private readonly mchId = process.env.WX_MCH_ID ?? '';
+  private readonly mchSerialNo = process.env.WX_MCH_SERIAL_NO ?? '';
+  private readonly mchPrivateKey = (process.env.WX_MCH_PRIVATE_KEY ?? '').replace(/\\n/g, '\n');
+  private readonly apiV3Key = process.env.WX_API_V3_KEY ?? '';
+  private readonly notifyUrl = process.env.WX_PAY_NOTIFY_URL ?? '';
+
+  constructor(private readonly redis: RedisService) {}
+
+  isEnabled() {
+    return this.config.wechatAuthEnabled && !!this.appId && !!this.appSecret;
+  }
+
+  buildOAuthUrl(redirectUri: string, state: string, scope = 'snsapi_userinfo') {
+    const qs = new URLSearchParams({
+      appid: this.appId,
+      redirect_uri: redirectUri,
+      response_type: 'code',
+      scope,
+      state,
+    });
+    return `https://open.weixin.qq.com/connect/oauth2/authorize?${qs.toString()}#wechat_redirect`;
+  }
+
+  async code2Session(code: string): Promise<WechatCodeSession> {
+    const url = new URL('https://api.weixin.qq.com/sns/jscode2session');
+    url.searchParams.set('appid', this.appId);
+    url.searchParams.set('secret', this.appSecret);
+    url.searchParams.set('js_code', code);
+    url.searchParams.set('grant_type', 'authorization_code');
+    const data = await this.fetchJson<{
+      openid?: string;
+      unionid?: string;
+      session_key?: string;
+      errcode?: number;
+      errmsg?: string;
+    }>(url.toString());
+    if (!data.openid) {
+      throw new InternalServerErrorException(data.errmsg || '微信 code2session 失败');
+    }
+    return {
+      openId: data.openid,
+      unionId: data.unionid,
+      sessionKey: data.session_key,
+    };
+  }
+
+  async oauth2AccessToken(code: string): Promise<WechatOAuthSession> {
+    const url = new URL('https://api.weixin.qq.com/sns/oauth2/access_token');
+    url.searchParams.set('appid', this.appId);
+    url.searchParams.set('secret', this.appSecret);
+    url.searchParams.set('code', code);
+    url.searchParams.set('grant_type', 'authorization_code');
+    const data = await this.fetchJson<{
+      openid?: string;
+      unionid?: string;
+      access_token?: string;
+      refresh_token?: string;
+      errcode?: number;
+      errmsg?: string;
+    }>(url.toString());
+    if (!data.openid) {
+      throw new InternalServerErrorException(data.errmsg || '微信 OAuth 失败');
+    }
+    return {
+      openId: data.openid,
+      unionId: data.unionid,
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
+    };
+  }
+
+  async createJssdkConfig(url: string) {
+    const ticket = await this.getJsapiTicket();
+    const nonceStr = randomBytes(8).toString('hex');
+    const timestamp = Math.floor(Date.now() / 1000);
+    const raw = `jsapi_ticket=${ticket}&noncestr=${nonceStr}&timestamp=${timestamp}&url=${url}`;
+    const signature = createHash('sha1').update(raw).digest('hex');
+    return {
+      appId: this.appId,
+      timestamp,
+      nonceStr,
+      signature,
+      jsApiList: ['getLocation', 'scanQRCode', 'chooseWXPay'],
+    };
+  }
+
+  async getPhoneNumberByCode(code: string, platform: 'mini' | 'h5'): Promise<string> {
+    if (platform === 'h5') {
+      throw new InternalServerErrorException('H5 请使用短信绑定手机号');
+    }
+    const accessToken = await this.getAccessToken();
+    const url = `https://api.weixin.qq.com/wxa/business/getuserphonenumber?access_token=${accessToken}`;
+    const data = await this.fetchJson<{
+      errcode?: number;
+      errmsg?: string;
+      phone_info?: { phoneNumber?: string; purePhoneNumber?: string };
+    }>(url, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ code }),
+    });
+    const phone = data.phone_info?.purePhoneNumber || data.phone_info?.phoneNumber;
+    if (!phone) {
+      throw new InternalServerErrorException(data.errmsg || '获取手机号失败');
+    }
+    return phone;
+  }
+
+  async createJsapiPrepay(params: {
+    orderNo: string;
+    description: string;
+    amountFen: number;
+    openId: string;
+    notifyUrl: string;
+  }) {
+    if (!this.mchId || !this.mchPrivateKey || !this.apiV3Key) {
+      throw new InternalServerErrorException('微信支付商户配置不完整');
+    }
+    const notifyUrl = params.notifyUrl || this.notifyUrl;
+    const body = {
+      appid: this.appId,
+      mchid: this.mchId,
+      description: params.description,
+      out_trade_no: params.orderNo,
+      notify_url: notifyUrl,
+      amount: { total: params.amountFen, currency: 'CNY' },
+      payer: { openid: params.openId },
+    };
+    const path = '/v3/pay/transactions/jsapi';
+    const payload = JSON.stringify(body);
+    const auth = this.signPayRequest('POST', path, payload);
+    const res = await this.fetchJson<{ prepay_id?: string }>(`https://api.mch.weixin.qq.com${path}`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        Authorization: auth,
+      },
+      body: payload,
+    });
+    if (!res.prepay_id) {
+      throw new InternalServerErrorException('微信预支付下单失败');
+    }
+    const timeStamp = String(Math.floor(Date.now() / 1000));
+    const nonceStr = randomUUID().replace(/-/g, '');
+    const packageStr = `prepay_id=${res.prepay_id}`;
+    const message = `${this.appId}\n${timeStamp}\n${nonceStr}\n${packageStr}\n`;
+    const sign = createSign('RSA-SHA256');
+    sign.update(message);
+    sign.end();
+    const paySign = sign.sign(this.mchPrivateKey, 'base64');
+    return {
+      appId: this.appId,
+      timeStamp,
+      nonceStr,
+      package: packageStr,
+      signType: 'RSA' as const,
+      paySign,
+    };
+  }
+
+  private async getAccessToken(): Promise<string> {
+    const cached = await this.redis.getJson<TokenCache>(ACCESS_TOKEN_KEY);
+    if (cached && cached.expiresAt > Date.now()) return cached.accessToken;
+
+    const url = new URL('https://api.weixin.qq.com/cgi-bin/token');
+    url.searchParams.set('grant_type', 'client_credential');
+    url.searchParams.set('appid', this.appId);
+    url.searchParams.set('secret', this.appSecret);
+    const data = await this.fetchJson<{ access_token?: string; expires_in?: number; errcode?: number; errmsg?: string }>(
+      url.toString(),
+    );
+    if (!data.access_token) {
+      throw new InternalServerErrorException(data.errmsg || '获取 access_token 失败');
+    }
+    const ttl = Math.max((data.expires_in ?? 7200) - 300, 60);
+    await this.redis.setJson(
+      ACCESS_TOKEN_KEY,
+      { accessToken: data.access_token, expiresAt: Date.now() + ttl * 1000 },
+      ttl,
+    );
+    return data.access_token;
+  }
+
+  private async getJsapiTicket(): Promise<string> {
+    const cached = await this.redis.getJson<TicketCache>(JSAPI_TICKET_KEY);
+    if (cached && cached.expiresAt > Date.now()) return cached.ticket;
+
+    const accessToken = await this.getAccessToken();
+    const url = new URL('https://api.weixin.qq.com/cgi-bin/ticket/getticket');
+    url.searchParams.set('access_token', accessToken);
+    url.searchParams.set('type', 'jsapi');
+    const data = await this.fetchJson<{ ticket?: string; expires_in?: number; errcode?: number; errmsg?: string }>(
+      url.toString(),
+    );
+    if (!data.ticket) {
+      throw new InternalServerErrorException(data.errmsg || '获取 jsapi_ticket 失败');
+    }
+    const ttl = Math.max((data.expires_in ?? 7200) - 300, 60);
+    await this.redis.setJson(
+      JSAPI_TICKET_KEY,
+      { ticket: data.ticket, expiresAt: Date.now() + ttl * 1000 },
+      ttl,
+    );
+    return data.ticket;
+  }
+
+  private signPayRequest(method: string, path: string, body: string) {
+    const timestamp = Math.floor(Date.now() / 1000);
+    const nonce = randomUUID();
+    const message = `${method}\n${path}\n${timestamp}\n${nonce}\n${body}\n`;
+    const sign = createSign('RSA-SHA256');
+    sign.update(message);
+    sign.end();
+    const signature = sign.sign(this.mchPrivateKey, 'base64');
+    return `WECHATPAY2-SHA256-RSA2048 mchid="${this.mchId}",nonce_str="${nonce}",signature="${signature}",timestamp="${timestamp}",serial_no="${this.mchSerialNo}"`;
+  }
+
+  private async fetchJson<T>(url: string, init?: RequestInit): Promise<T> {
+    const res = await fetch(url, init);
+    const text = await res.text();
+    try {
+      return JSON.parse(text) as T;
+    } catch {
+      this.logger.error(`WeChat API invalid JSON: ${text.slice(0, 200)}`);
+      throw new InternalServerErrorException('微信接口响应异常');
+    }
+  }
+
+  /** 解密小程序敏感数据（备用） */
+  decryptData(sessionKey: string, encryptedData: string, iv: string): Record<string, unknown> {
+    const key = Buffer.from(sessionKey, 'base64');
+    const decipher = createDecipheriv('aes-128-cbc', key, Buffer.from(iv, 'base64'));
+    decipher.setAutoPadding(true);
+    const decoded = Buffer.concat([
+      decipher.update(Buffer.from(encryptedData, 'base64')),
+      decipher.final(),
+    ]);
+    return JSON.parse(decoded.toString('utf8')) as Record<string, unknown>;
+  }
+}

server/dukang-api/src/integrations/wechat/wechat.disabled.provider.ts

@@ -0,0 +1,37 @@
+import { Injectable, NotImplementedException } from '@nestjs/common';
+import type { IWechatProvider } from './wechat.interface';
+
+@Injectable()
+export class WechatDisabledProvider implements IWechatProvider {
+  isEnabled() {
+    return false;
+  }
+
+  private disabled(): never {
+    throw new NotImplementedException('FEATURE_DISABLED');
+  }
+
+  code2Session() {
+    return this.disabled();
+  }
+
+  oauth2AccessToken() {
+    return this.disabled();
+  }
+
+  createJssdkConfig() {
+    return this.disabled();
+  }
+
+  buildOAuthUrl() {
+    return this.disabled();
+  }
+
+  getPhoneNumberByCode() {
+    return this.disabled();
+  }
+
+  createJsapiPrepay() {
+    return this.disabled();
+  }
+}

server/dukang-api/src/integrations/wechat/wechat.interface.ts

@@ -0,0 +1,43 @@
+import type { WechatJssdkConfig, WechatJsapiPrepayParams } from '@dukang/shared-types';
+
+export type WechatCodeSession = {
+  openId: string;
+  unionId?: string;
+  sessionKey?: string;
+  accessToken?: string;
+};
+
+export type WechatOAuthSession = {
+  openId: string;
+  unionId?: string;
+  accessToken?: string;
+  refreshToken?: string;
+};
+
+export interface IWechatProvider {
+  isEnabled(): boolean;
+
+  /** 小程序 code2session */
+  code2Session(code: string): Promise<WechatCodeSession>;
+
+  /** 公众号 H5 OAuth code 换 openId */
+  oauth2AccessToken(code: string): Promise<WechatOAuthSession>;
+
+  /** JSSDK 签名配置 */
+  createJssdkConfig(url: string): Promise<WechatJssdkConfig>;
+
+  /** 构建公众号 OAuth 授权 URL */
+  buildOAuthUrl(redirectUri: string, state: string, scope?: string): string;
+
+  /** 小程序手机号 code 解密（或调用微信 getPhoneNumber 接口） */
+  getPhoneNumberByCode(code: string, platform: 'mini' | 'h5'): Promise<string>;
+
+  /** 创建 JSAPI 预支付参数 */
+  createJsapiPrepay(params: {
+    orderNo: string;
+    description: string;
+    amountFen: number;
+    openId: string;
+    notifyUrl: string;
+  }): Promise<WechatJsapiPrepayParams>;
+}