481 lines
18 KiB
TypeScript
481 lines
18 KiB
TypeScript
import { createDecipheriv, createHash, createSign, randomBytes, randomUUID } from 'crypto';
|
|
import { BadRequestException, Injectable, InternalServerErrorException, Logger } from '@nestjs/common';
|
|
import { loadAppConfig } from '@dukang/shared-types';
|
|
import { RedisService } from '../../common/redis/redis.service';
|
|
import { PrismaService } from '../../common/prisma/prisma.module';
|
|
import type { IWechatProvider, WechatCodeSession, WechatOAuthSession } from './wechat.interface';
|
|
import { logWechatAuth, type WechatActorRef } from './wechat-log.util';
|
|
import {
|
|
decryptPayResource,
|
|
verifyPaySignature,
|
|
type WechatPayNotifyEnvelope,
|
|
} from './wechat-pay.util';
|
|
|
|
type TokenCache = { accessToken: string; expiresAt: number };
|
|
type TicketCache = { ticket: string; expiresAt: number };
|
|
|
|
const ACCESS_TOKEN_KEY = 'wechat:access_token';
|
|
const JSAPI_TICKET_KEY = 'wechat:jsapi_ticket';
|
|
|
|
@Injectable()
|
|
export class WechatApiProvider implements IWechatProvider {
|
|
private readonly logger = new Logger(WechatApiProvider.name);
|
|
private readonly config = loadAppConfig();
|
|
private readonly appId = process.env.WX_APP_ID ?? '';
|
|
private readonly appSecret = process.env.WX_APP_SECRET ?? '';
|
|
private readonly mchId = process.env.WX_MCH_ID ?? '';
|
|
private readonly mchSerialNo = process.env.WX_MCH_SERIAL_NO ?? '';
|
|
private readonly mchPrivateKey = (process.env.WX_MCH_PRIVATE_KEY ?? '').replace(/\\n/g, '\n');
|
|
private readonly apiV3Key = process.env.WX_API_V3_KEY ?? '';
|
|
private readonly notifyUrl = process.env.WX_PAY_NOTIFY_URL ?? '';
|
|
private readonly platformCert = (process.env.WX_PLATFORM_CERT ?? '').replace(/\\n/g, '\n');
|
|
|
|
constructor(
|
|
private readonly redis: RedisService,
|
|
private readonly prisma: PrismaService,
|
|
) {}
|
|
|
|
isEnabled() {
|
|
return this.config.wechatAuthEnabled && !!this.appId && !!this.appSecret;
|
|
}
|
|
|
|
isPayEnabled() {
|
|
return (
|
|
this.config.wechatPayEnabled &&
|
|
!!this.appId &&
|
|
!!this.mchId &&
|
|
!!this.mchSerialNo &&
|
|
!!this.mchPrivateKey &&
|
|
!!this.apiV3Key
|
|
);
|
|
}
|
|
|
|
getMchId() {
|
|
return this.mchId;
|
|
}
|
|
|
|
buildOAuthUrl(redirectUri: string, state: string, scope = 'snsapi_userinfo') {
|
|
const qs = new URLSearchParams({
|
|
appid: this.appId,
|
|
redirect_uri: redirectUri,
|
|
response_type: 'code',
|
|
scope,
|
|
state,
|
|
});
|
|
return `https://open.weixin.qq.com/connect/oauth2/authorize?${qs.toString()}#wechat_redirect`;
|
|
}
|
|
|
|
async code2Session(code: string, actorRef?: WechatActorRef): Promise<WechatCodeSession> {
|
|
const url = new URL('https://api.weixin.qq.com/sns/jscode2session');
|
|
url.searchParams.set('appid', this.appId);
|
|
url.searchParams.set('secret', '***');
|
|
url.searchParams.set('js_code', code);
|
|
url.searchParams.set('grant_type', 'authorization_code');
|
|
const apiUrl = new URL('https://api.weixin.qq.com/sns/jscode2session');
|
|
apiUrl.searchParams.set('appid', this.appId);
|
|
apiUrl.searchParams.set('secret', this.appSecret);
|
|
apiUrl.searchParams.set('js_code', code);
|
|
apiUrl.searchParams.set('grant_type', 'authorization_code');
|
|
const data = await this.fetchJson<{
|
|
openid?: string;
|
|
unionid?: string;
|
|
session_key?: string;
|
|
errcode?: number;
|
|
errmsg?: string;
|
|
}>(apiUrl.toString());
|
|
const ok = !!data.openid;
|
|
await logWechatAuth(this.prisma, {
|
|
scene: 'LOGIN',
|
|
requestUrl: url.toString(),
|
|
requestBody: { grant_type: 'authorization_code', platform: 'mini' },
|
|
responseBody: ok
|
|
? { openid: data.openid, unionid: data.unionid }
|
|
: { errcode: data.errcode, errmsg: data.errmsg },
|
|
externalNo: data.openid,
|
|
status: ok ? 'SUCCESS' : 'FAILED',
|
|
errorMessage: ok ? undefined : data.errmsg || '微信 code2session 失败',
|
|
actorRef,
|
|
});
|
|
if (!data.openid) {
|
|
throw new InternalServerErrorException(data.errmsg || '微信 code2session 失败');
|
|
}
|
|
return {
|
|
openId: data.openid,
|
|
unionId: data.unionid,
|
|
sessionKey: data.session_key,
|
|
};
|
|
}
|
|
|
|
async oauth2AccessToken(code: string, actorRef?: WechatActorRef): Promise<WechatOAuthSession> {
|
|
const maskedUrl = new URL('https://api.weixin.qq.com/sns/oauth2/access_token');
|
|
maskedUrl.searchParams.set('appid', this.appId);
|
|
maskedUrl.searchParams.set('secret', '***');
|
|
maskedUrl.searchParams.set('code', code);
|
|
maskedUrl.searchParams.set('grant_type', 'authorization_code');
|
|
const apiUrl = new URL('https://api.weixin.qq.com/sns/oauth2/access_token');
|
|
apiUrl.searchParams.set('appid', this.appId);
|
|
apiUrl.searchParams.set('secret', this.appSecret);
|
|
apiUrl.searchParams.set('code', code);
|
|
apiUrl.searchParams.set('grant_type', 'authorization_code');
|
|
const data = await this.fetchJson<{
|
|
openid?: string;
|
|
unionid?: string;
|
|
access_token?: string;
|
|
refresh_token?: string;
|
|
errcode?: number;
|
|
errmsg?: string;
|
|
}>(apiUrl.toString());
|
|
const ok = !!data.openid;
|
|
await logWechatAuth(this.prisma, {
|
|
scene: 'LOGIN',
|
|
requestUrl: maskedUrl.toString(),
|
|
requestBody: { grant_type: 'authorization_code', platform: 'h5' },
|
|
responseBody: ok
|
|
? { openid: data.openid, unionid: data.unionid }
|
|
: { errcode: data.errcode, errmsg: data.errmsg },
|
|
externalNo: data.openid,
|
|
status: ok ? 'SUCCESS' : 'FAILED',
|
|
errorMessage: ok ? undefined : data.errmsg || '微信 OAuth 失败',
|
|
actorRef,
|
|
});
|
|
if (!data.openid) {
|
|
throw new InternalServerErrorException(data.errmsg || '微信 OAuth 失败');
|
|
}
|
|
return {
|
|
openId: data.openid,
|
|
unionId: data.unionid,
|
|
accessToken: data.access_token,
|
|
refreshToken: data.refresh_token,
|
|
};
|
|
}
|
|
|
|
async fetchOAuthUserInfo(
|
|
accessToken: string,
|
|
openId: string,
|
|
actorRef?: WechatActorRef,
|
|
): Promise<import('./wechat.interface').WechatOAuthUserInfo> {
|
|
const maskedUrl = new URL('https://api.weixin.qq.com/sns/userinfo');
|
|
maskedUrl.searchParams.set('access_token', '***');
|
|
maskedUrl.searchParams.set('openid', openId);
|
|
maskedUrl.searchParams.set('lang', 'zh_CN');
|
|
const apiUrl = new URL('https://api.weixin.qq.com/sns/userinfo');
|
|
apiUrl.searchParams.set('access_token', accessToken);
|
|
apiUrl.searchParams.set('openid', openId);
|
|
apiUrl.searchParams.set('lang', 'zh_CN');
|
|
const data = await this.fetchJson<{
|
|
openid?: string;
|
|
nickname?: string;
|
|
headimgurl?: string;
|
|
unionid?: string;
|
|
errcode?: number;
|
|
errmsg?: string;
|
|
}>(apiUrl.toString());
|
|
const ok = !!data.openid;
|
|
await logWechatAuth(this.prisma, {
|
|
scene: 'USERINFO',
|
|
requestUrl: maskedUrl.toString(),
|
|
requestBody: { lang: 'zh_CN' },
|
|
responseBody: ok
|
|
? { openid: data.openid, nickname: data.nickname, unionid: data.unionid }
|
|
: { errcode: data.errcode, errmsg: data.errmsg },
|
|
externalNo: data.openid ?? openId,
|
|
status: ok ? 'SUCCESS' : 'FAILED',
|
|
errorMessage: ok ? undefined : data.errmsg || '微信用户信息获取失败',
|
|
actorRef,
|
|
});
|
|
if (!data.openid) {
|
|
throw new InternalServerErrorException(data.errmsg || '微信用户信息获取失败');
|
|
}
|
|
return {
|
|
openId: data.openid,
|
|
nickname: data.nickname,
|
|
headImgUrl: data.headimgurl,
|
|
unionId: data.unionid,
|
|
};
|
|
}
|
|
|
|
async createJssdkConfig(url: string, actorRef?: WechatActorRef) {
|
|
try {
|
|
const ticket = await this.getJsapiTicket();
|
|
const nonceStr = randomBytes(8).toString('hex');
|
|
const timestamp = Math.floor(Date.now() / 1000);
|
|
const raw = `jsapi_ticket=${ticket}&noncestr=${nonceStr}×tamp=${timestamp}&url=${url}`;
|
|
const signature = createHash('sha1').update(raw).digest('hex');
|
|
const config = {
|
|
appId: this.appId,
|
|
timestamp,
|
|
nonceStr,
|
|
signature,
|
|
jsApiList: ['getLocation', 'scanQRCode', 'chooseWXPay', 'chooseImage', 'getLocalImgData'],
|
|
};
|
|
await logWechatAuth(this.prisma, {
|
|
scene: 'JSSDK_CONFIG',
|
|
requestUrl: url.split('#')[0],
|
|
requestBody: { appId: this.appId },
|
|
responseBody: { appId: this.appId, timestamp, nonceStr },
|
|
status: 'SUCCESS',
|
|
actorRef,
|
|
});
|
|
return config;
|
|
} catch (err) {
|
|
const message = err instanceof Error ? err.message : String(err);
|
|
await logWechatAuth(this.prisma, {
|
|
scene: 'JSSDK_CONFIG',
|
|
requestUrl: url.split('#')[0],
|
|
requestBody: { appId: this.appId },
|
|
status: 'FAILED',
|
|
errorMessage: message,
|
|
actorRef,
|
|
});
|
|
throw err;
|
|
}
|
|
}
|
|
|
|
async getPhoneNumberByCode(code: string, platform: 'mini' | 'h5', actorRef?: WechatActorRef): Promise<string> {
|
|
if (platform === 'h5') {
|
|
throw new InternalServerErrorException('H5 请使用短信绑定手机号');
|
|
}
|
|
const accessToken = await this.getAccessToken();
|
|
const apiUrl = `https://api.weixin.qq.com/wxa/business/getuserphonenumber?access_token=${accessToken}`;
|
|
const data = await this.fetchJson<{
|
|
errcode?: number;
|
|
errmsg?: string;
|
|
phone_info?: { phoneNumber?: string; purePhoneNumber?: string };
|
|
}>(apiUrl, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ code }),
|
|
});
|
|
const phone = data.phone_info?.purePhoneNumber || data.phone_info?.phoneNumber;
|
|
const ok = !!phone;
|
|
await logWechatAuth(this.prisma, {
|
|
scene: 'BIND_PHONE',
|
|
requestUrl: 'https://api.weixin.qq.com/wxa/business/getuserphonenumber',
|
|
requestBody: { platform },
|
|
responseBody: ok ? { phone: `${phone!.slice(0, 3)}****${phone!.slice(-4)}` } : { errcode: data.errcode, errmsg: data.errmsg },
|
|
status: ok ? 'SUCCESS' : 'FAILED',
|
|
errorMessage: ok ? undefined : data.errmsg || '获取手机号失败',
|
|
actorRef,
|
|
});
|
|
if (!phone) {
|
|
throw new InternalServerErrorException(data.errmsg || '获取手机号失败');
|
|
}
|
|
return phone;
|
|
}
|
|
|
|
async createJsapiPrepay(params: {
|
|
orderNo: string;
|
|
description: string;
|
|
amountFen: number;
|
|
openId: string;
|
|
notifyUrl: string;
|
|
}) {
|
|
if (!this.isPayEnabled()) {
|
|
throw new InternalServerErrorException(
|
|
'微信支付未配置：请设置 WECHAT_PAY_ENABLED=true、WX_MCH_ID、WX_MCH_SERIAL_NO、WX_MCH_PRIVATE_KEY、WX_API_V3_KEY',
|
|
);
|
|
}
|
|
const notifyUrl = params.notifyUrl || this.notifyUrl;
|
|
if (!notifyUrl) {
|
|
throw new InternalServerErrorException('请配置 WX_PAY_NOTIFY_URL');
|
|
}
|
|
const body = {
|
|
appid: this.appId,
|
|
mchid: this.mchId,
|
|
description: params.description,
|
|
out_trade_no: params.orderNo,
|
|
notify_url: notifyUrl,
|
|
amount: { total: params.amountFen, currency: 'CNY' },
|
|
payer: { openid: params.openId },
|
|
};
|
|
const path = '/v3/pay/transactions/jsapi';
|
|
const payload = JSON.stringify(body);
|
|
const auth = this.signPayRequest('POST', path, payload);
|
|
const res = await this.fetchPayJson<{ prepay_id?: string }>(
|
|
`https://api.mch.weixin.qq.com${path}`,
|
|
{
|
|
method: 'POST',
|
|
headers: {
|
|
'Content-Type': 'application/json',
|
|
Accept: 'application/json',
|
|
Authorization: auth,
|
|
},
|
|
body: payload,
|
|
},
|
|
);
|
|
if (!res.prepay_id) {
|
|
throw new InternalServerErrorException('微信预支付下单失败');
|
|
}
|
|
this.logger.log(`JSAPI prepay ok mchid=${this.mchId} orderNo=${params.orderNo}`);
|
|
const timeStamp = String(Math.floor(Date.now() / 1000));
|
|
const nonceStr = randomUUID().replace(/-/g, '');
|
|
const packageStr = `prepay_id=${res.prepay_id}`;
|
|
const message = `${this.appId}\n${timeStamp}\n${nonceStr}\n${packageStr}\n`;
|
|
const sign = createSign('RSA-SHA256');
|
|
sign.update(message);
|
|
sign.end();
|
|
const paySign = sign.sign(this.mchPrivateKey, 'base64');
|
|
return {
|
|
appId: this.appId,
|
|
timeStamp,
|
|
nonceStr,
|
|
package: packageStr,
|
|
signType: 'RSA' as const,
|
|
paySign,
|
|
};
|
|
}
|
|
|
|
async parsePayNotification(
|
|
headers: Record<string, string | string[] | undefined>,
|
|
rawBody: string,
|
|
) {
|
|
if (!this.isPayEnabled()) {
|
|
throw new BadRequestException('微信支付未启用');
|
|
}
|
|
const signature = this.headerValue(headers, 'wechatpay-signature');
|
|
const timestamp = this.headerValue(headers, 'wechatpay-timestamp');
|
|
const nonce = this.headerValue(headers, 'wechatpay-nonce');
|
|
if (!signature || !timestamp || !nonce) {
|
|
throw new BadRequestException('微信回调签名头缺失');
|
|
}
|
|
if (this.platformCert) {
|
|
const valid = verifyPaySignature({
|
|
platformPublicKeyPem: this.platformCert,
|
|
timestamp,
|
|
nonce,
|
|
body: rawBody,
|
|
signature,
|
|
});
|
|
if (!valid) {
|
|
throw new BadRequestException('微信回调验签失败');
|
|
}
|
|
} else {
|
|
this.logger.warn('WX_PLATFORM_CERT 未配置，跳过回调 RSA 验签（仅建议开发环境）');
|
|
}
|
|
|
|
const envelope = JSON.parse(rawBody) as WechatPayNotifyEnvelope;
|
|
if (envelope.event_type !== 'TRANSACTION.SUCCESS') {
|
|
throw new BadRequestException(`忽略的事件类型: ${envelope.event_type}`);
|
|
}
|
|
const resource = decryptPayResource(
|
|
this.apiV3Key,
|
|
envelope.resource.associated_data ?? '',
|
|
envelope.resource.nonce,
|
|
envelope.resource.ciphertext,
|
|
);
|
|
if (resource.trade_state !== 'SUCCESS') {
|
|
throw new BadRequestException(`交易未成功: ${resource.trade_state}`);
|
|
}
|
|
return {
|
|
transactionId: resource.transaction_id,
|
|
outTradeNo: resource.out_trade_no,
|
|
tradeState: resource.trade_state,
|
|
amountFen: resource.amount?.total ?? resource.amount?.payer_total ?? 0,
|
|
};
|
|
}
|
|
|
|
private headerValue(headers: Record<string, string | string[] | undefined>, key: string) {
|
|
const raw = headers[key] ?? headers[key.toLowerCase()];
|
|
if (Array.isArray(raw)) return raw[0];
|
|
return raw;
|
|
}
|
|
|
|
private async getAccessToken(): Promise<string> {
|
|
const cached = await this.redis.getJson<TokenCache>(ACCESS_TOKEN_KEY);
|
|
if (cached && cached.expiresAt > Date.now()) return cached.accessToken;
|
|
|
|
const url = new URL('https://api.weixin.qq.com/cgi-bin/token');
|
|
url.searchParams.set('grant_type', 'client_credential');
|
|
url.searchParams.set('appid', this.appId);
|
|
url.searchParams.set('secret', this.appSecret);
|
|
const data = await this.fetchJson<{ access_token?: string; expires_in?: number; errcode?: number; errmsg?: string }>(
|
|
url.toString(),
|
|
);
|
|
if (!data.access_token) {
|
|
throw new InternalServerErrorException(data.errmsg || '获取 access_token 失败');
|
|
}
|
|
const ttl = Math.max((data.expires_in ?? 7200) - 300, 60);
|
|
await this.redis.setJson(
|
|
ACCESS_TOKEN_KEY,
|
|
{ accessToken: data.access_token, expiresAt: Date.now() + ttl * 1000 },
|
|
ttl,
|
|
);
|
|
return data.access_token;
|
|
}
|
|
|
|
private async getJsapiTicket(): Promise<string> {
|
|
const cached = await this.redis.getJson<TicketCache>(JSAPI_TICKET_KEY);
|
|
if (cached && cached.expiresAt > Date.now()) return cached.ticket;
|
|
|
|
const accessToken = await this.getAccessToken();
|
|
const url = new URL('https://api.weixin.qq.com/cgi-bin/ticket/getticket');
|
|
url.searchParams.set('access_token', accessToken);
|
|
url.searchParams.set('type', 'jsapi');
|
|
const data = await this.fetchJson<{ ticket?: string; expires_in?: number; errcode?: number; errmsg?: string }>(
|
|
url.toString(),
|
|
);
|
|
if (!data.ticket) {
|
|
throw new InternalServerErrorException(data.errmsg || '获取 jsapi_ticket 失败');
|
|
}
|
|
const ttl = Math.max((data.expires_in ?? 7200) - 300, 60);
|
|
await this.redis.setJson(
|
|
JSAPI_TICKET_KEY,
|
|
{ ticket: data.ticket, expiresAt: Date.now() + ttl * 1000 },
|
|
ttl,
|
|
);
|
|
return data.ticket;
|
|
}
|
|
|
|
private signPayRequest(method: string, path: string, body: string) {
|
|
const timestamp = Math.floor(Date.now() / 1000);
|
|
const nonce = randomUUID();
|
|
const message = `${method}\n${path}\n${timestamp}\n${nonce}\n${body}\n`;
|
|
const sign = createSign('RSA-SHA256');
|
|
sign.update(message);
|
|
sign.end();
|
|
const signature = sign.sign(this.mchPrivateKey, 'base64');
|
|
return `WECHATPAY2-SHA256-RSA2048 mchid="${this.mchId}",nonce_str="${nonce}",signature="${signature}",timestamp="${timestamp}",serial_no="${this.mchSerialNo}"`;
|
|
}
|
|
|
|
private async fetchPayJson<T>(url: string, init?: RequestInit): Promise<T> {
|
|
const res = await fetch(url, init);
|
|
const text = await res.text();
|
|
let data: T & { code?: string; message?: string };
|
|
try {
|
|
data = JSON.parse(text) as T & { code?: string; message?: string };
|
|
} catch {
|
|
this.logger.error(`WeChat Pay invalid JSON (${res.status}): ${text.slice(0, 300)}`);
|
|
throw new InternalServerErrorException('微信支付接口响应异常');
|
|
}
|
|
if (!res.ok) {
|
|
const detail = data.message || data.code || text.slice(0, 200);
|
|
this.logger.error(`WeChat Pay API ${res.status}: ${detail}`);
|
|
throw new InternalServerErrorException(`微信支付下单失败: ${detail}`);
|
|
}
|
|
return data;
|
|
}
|
|
|
|
private async fetchJson<T>(url: string, init?: RequestInit): Promise<T> {
|
|
const res = await fetch(url, init);
|
|
const text = await res.text();
|
|
try {
|
|
return JSON.parse(text) as T;
|
|
} catch {
|
|
this.logger.error(`WeChat API invalid JSON: ${text.slice(0, 200)}`);
|
|
throw new InternalServerErrorException('微信接口响应异常');
|
|
}
|
|
}
|
|
|
|
/** 解密小程序敏感数据（备用） */
|
|
decryptData(sessionKey: string, encryptedData: string, iv: string): Record<string, unknown> {
|
|
const key = Buffer.from(sessionKey, 'base64');
|
|
const decipher = createDecipheriv('aes-128-cbc', key, Buffer.from(iv, 'base64'));
|
|
decipher.setAutoPadding(true);
|
|
const decoded = Buffer.concat([
|
|
decipher.update(Buffer.from(encryptedData, 'base64')),
|
|
decipher.final(),
|
|
]);
|
|
return JSON.parse(decoded.toString('utf8')) as Record<string, unknown>;
|
|
}
|
|
}
|