微信小程序支付遇到问题，因为没有 WX_MCH_PRIVATE_KEY

server/dukang-api/src/integrations/wechat/wechat-pay.util.ts

@@ -67,3 +67,22 @@ export function safeEqual(a: string, b: string): boolean {
   if (ba.length !== bb.length) return false;
   return timingSafeEqual(ba, bb);
 }
+
+/**
+ * 规范化 .env / system_config 中的 PEM：
+ * - 去掉外层引号（DB/表单常把整段含引号写入）
+ * - 把字面量 \\n 转成真实换行
+ * OpenSSL 报 1E08010C DECODER unsupported 时多半是这两类污染。
+ */
+export function normalizePemEnv(raw: string | undefined | null): string {
+  if (!raw) return '';
+  let value = String(raw).trim();
+  if (
+    (value.startsWith('"') && value.endsWith('"')) ||
+    (value.startsWith("'") && value.endsWith("'"))
+  ) {
+    value = value.slice(1, -1).trim();
+  }
+  value = value.replace(/\\r\\n/g, '\n').replace(/\\n/g, '\n').replace(/\r\n/g, '\n');
+  return value.trim();
+}

server/dukang-api/src/integrations/wechat/wechat.api.provider.ts

@@ -7,6 +7,7 @@ import type { IWechatProvider, WechatCodeSession, WechatOAuthSession } from './w
 import { logWechatAuth, type WechatActorRef } from './wechat-log.util';
 import {
   decryptPayResource,
+  normalizePemEnv,
   verifyPaySignature,
   type WechatPayNotifyEnvelope,
 } from './wechat-pay.util';
@@ -27,10 +28,10 @@ export class WechatApiProvider implements IWechatProvider {
   private readonly miniAppSecret = (process.env.WX_MINI_APP_SECRET ?? this.appSecret).trim();
   private readonly mchId = process.env.WX_MCH_ID ?? '';
   private readonly mchSerialNo = process.env.WX_MCH_SERIAL_NO ?? '';
-  private readonly mchPrivateKey = (process.env.WX_MCH_PRIVATE_KEY ?? '').replace(/\\n/g, '\n');
+  private readonly mchPrivateKey = normalizePemEnv(process.env.WX_MCH_PRIVATE_KEY);
   private readonly apiV3Key = process.env.WX_API_V3_KEY ?? '';
   private readonly notifyUrl = process.env.WX_PAY_NOTIFY_URL ?? '';
-  private readonly platformCert = (process.env.WX_PLATFORM_CERT ?? '').replace(/\\n/g, '\n');
+  private readonly platformCert = normalizePemEnv(process.env.WX_PLATFORM_CERT);
 
   constructor(
     private readonly redis: RedisService,