225 lines
6.8 KiB
Go
225 lines
6.8 KiB
Go
package payment
|
||
|
||
import (
|
||
"bytes"
|
||
"crypto"
|
||
"crypto/rand"
|
||
"crypto/rsa"
|
||
"crypto/sha256"
|
||
"crypto/x509"
|
||
"encoding/base64"
|
||
"encoding/json"
|
||
"encoding/pem"
|
||
"fmt"
|
||
"io"
|
||
"net/http"
|
||
"strings"
|
||
"time"
|
||
)
|
||
|
||
const waffoAPIBase = "https://api.waffo.ai"
|
||
|
||
// CreateSessionRequest API Key / Store Slug checkout session (official create-session). // Logan.Li
|
||
type CreateSessionRequest struct {
|
||
ProductID string `json:"productId"`
|
||
ProductType string `json:"productType"`
|
||
Currency string `json:"currency"`
|
||
BuyerEmail string `json:"buyerEmail,omitempty"`
|
||
SuccessURL string `json:"successUrl,omitempty"`
|
||
OrderMerchantExternalID string `json:"orderMerchantExternalId,omitempty"`
|
||
Metadata map[string]string `json:"metadata,omitempty"`
|
||
ExpiresInSeconds int `json:"expiresInSeconds,omitempty"`
|
||
// Auth overrides (optional). // Logan.Li
|
||
StoreSlug string `json:"-"`
|
||
Environment string `json:"-"`
|
||
}
|
||
|
||
// CreateSessionResult checkout session response. // Logan.Li
|
||
type CreateSessionResult struct {
|
||
SessionID string `json:"sessionId"`
|
||
CheckoutURL string `json:"checkoutUrl"`
|
||
ExpiresAt string `json:"expiresAt"`
|
||
}
|
||
|
||
// CreateCheckoutSession creates a Waffo checkout session with orderMerchantExternalId.
|
||
// Prefers API Key (Merchant ID + RSA); falls back to Store Slug + X-Environment. // Logan.Li
|
||
func CreateCheckoutSession(cfg WaffoConfig, req CreateSessionRequest) (*CreateSessionResult, error) {
|
||
if strings.TrimSpace(req.ProductID) == "" || strings.TrimSpace(req.Currency) == "" {
|
||
return nil, fmt.Errorf("productId 与 currency 必填")
|
||
}
|
||
if req.ProductType == "" {
|
||
req.ProductType = "onetime"
|
||
}
|
||
if req.ExpiresInSeconds <= 0 {
|
||
req.ExpiresInSeconds = 2700
|
||
}
|
||
|
||
bodyBytes, err := json.Marshal(req)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
path := "/v1/actions/checkout/create-session"
|
||
httpReq, err := http.NewRequest(http.MethodPost, waffoAPIBase+path, bytes.NewReader(bodyBytes))
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
httpReq.Header.Set("Content-Type", "application/json")
|
||
|
||
if cfg.HasAPIKeyAuth() {
|
||
timestamp := fmt.Sprintf("%d", time.Now().Unix())
|
||
sig, err := signAPIRequest(cfg.PrivateKey, "POST", path, timestamp, bodyBytes)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
httpReq.Header.Set("X-Merchant-Id", strings.TrimSpace(cfg.MerchantID))
|
||
httpReq.Header.Set("X-Timestamp", timestamp)
|
||
httpReq.Header.Set("X-Signature", sig)
|
||
} else {
|
||
slug := strings.TrimSpace(req.StoreSlug)
|
||
if slug == "" {
|
||
slug = strings.TrimSpace(cfg.StoreSlug)
|
||
}
|
||
if slug == "" {
|
||
return nil, fmt.Errorf("未配置商户 ID/私钥，且缺少 Store Slug，无法创建收银台会话")
|
||
}
|
||
env := strings.TrimSpace(req.Environment)
|
||
if env == "" {
|
||
env = strings.TrimSpace(cfg.Environment)
|
||
}
|
||
// Waffo Store Slug 鉴权要求 X-Environment 为 test|prod（不是 live） // Logan.Li
|
||
switch strings.ToLower(env) {
|
||
case "live", "prod", "production":
|
||
env = "prod"
|
||
default:
|
||
env = "test"
|
||
}
|
||
httpReq.Header.Set("X-Store-Slug", slug)
|
||
httpReq.Header.Set("X-Environment", env)
|
||
}
|
||
|
||
client := &http.Client{Timeout: 20 * time.Second}
|
||
resp, err := client.Do(httpReq)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("Waffo create-session 请求失败: %w", err)
|
||
}
|
||
defer resp.Body.Close()
|
||
respBody, _ := io.ReadAll(resp.Body)
|
||
|
||
var envelope struct {
|
||
Data *CreateSessionResult `json:"data"`
|
||
Errors []struct {
|
||
Message string `json:"message"`
|
||
} `json:"errors"`
|
||
}
|
||
if err := json.Unmarshal(respBody, &envelope); err != nil {
|
||
return nil, fmt.Errorf("Waffo 响应无法解析 (%d): %s", resp.StatusCode, truncate(string(respBody), 200))
|
||
}
|
||
if resp.StatusCode >= 300 || envelope.Data == nil || envelope.Data.CheckoutURL == "" {
|
||
msg := strings.TrimSpace(string(respBody))
|
||
if len(envelope.Errors) > 0 && envelope.Errors[0].Message != "" {
|
||
msg = envelope.Errors[0].Message
|
||
}
|
||
return nil, fmt.Errorf("Waffo create-session 失败 (%d): %s", resp.StatusCode, truncate(msg, 300))
|
||
}
|
||
return envelope.Data, nil
|
||
}
|
||
|
||
func signAPIRequest(privateKeyMaterial, method, path, timestamp string, body []byte) (string, error) {
|
||
priv, err := ParseMerchantPrivateKey(privateKeyMaterial)
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
sum := sha256.Sum256(body)
|
||
bodyHash := base64.StdEncoding.EncodeToString(sum[:])
|
||
canonical := method + "\n" + path + "\n" + timestamp + "\n" + bodyHash
|
||
hashed := sha256.Sum256([]byte(canonical))
|
||
sig, err := rsa.SignPKCS1v15(rand.Reader, priv, crypto.SHA256, hashed[:])
|
||
if err != nil {
|
||
return "", fmt.Errorf("RSA 签名失败: %w", err)
|
||
}
|
||
return base64.StdEncoding.EncodeToString(sig), nil
|
||
}
|
||
|
||
// ParseMerchantPrivateKey 解析 RSA 私钥：PEM、无头 Base64（PKCS8/PKCS1 DER）均支持 // Logan.Li
|
||
func ParseMerchantPrivateKey(raw string) (*rsa.PrivateKey, error) {
|
||
raw = strings.TrimSpace(raw)
|
||
if raw == "" {
|
||
return nil, fmt.Errorf("私钥为空")
|
||
}
|
||
raw = strings.ReplaceAll(raw, `\n`, "\n")
|
||
|
||
if key, err := parseRSAFromPEMOrDER([]byte(raw)); err == nil {
|
||
return key, nil
|
||
}
|
||
|
||
// 纯 Base64 体（Dashboard「复制密钥」常见形态） // Logan.Li
|
||
compact := strings.Map(func(r rune) rune {
|
||
if r == '\n' || r == '\r' || r == ' ' || r == '\t' {
|
||
return -1
|
||
}
|
||
return r
|
||
}, raw)
|
||
if decoded, err := base64.StdEncoding.DecodeString(compact); err == nil {
|
||
if key, err2 := parseRSAFromPEMOrDER(decoded); err2 == nil {
|
||
return key, nil
|
||
}
|
||
// 包一层 PKCS8 PEM 再试 // Logan.Li
|
||
pemBytes := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: decoded})
|
||
if key, err2 := parseRSAFromPEMOrDER(pemBytes); err2 == nil {
|
||
return key, nil
|
||
}
|
||
}
|
||
|
||
// 无头 Base64 拼成 PEM // Logan.Li
|
||
wrapped := "-----BEGIN PRIVATE KEY-----\n" + chunkBase64(compact, 64) + "\n-----END PRIVATE KEY-----\n"
|
||
if key, err := parseRSAFromPEMOrDER([]byte(wrapped)); err == nil {
|
||
return key, nil
|
||
}
|
||
return nil, fmt.Errorf("无法解析 RSA 私钥（请粘贴 PEM 或 Dashboard Base64 密钥）")
|
||
}
|
||
|
||
func parseRSAFromPEMOrDER(raw []byte) (*rsa.PrivateKey, error) {
|
||
if block, _ := pem.Decode(raw); block != nil {
|
||
return parseRSAKeyBytes(block.Bytes)
|
||
}
|
||
return parseRSAKeyBytes(raw)
|
||
}
|
||
|
||
func parseRSAKeyBytes(der []byte) (*rsa.PrivateKey, error) {
|
||
if key, err := x509.ParsePKCS8PrivateKey(der); err == nil {
|
||
if rsaKey, ok := key.(*rsa.PrivateKey); ok {
|
||
return rsaKey, nil
|
||
}
|
||
return nil, fmt.Errorf("私钥不是 RSA")
|
||
}
|
||
if key, err := x509.ParsePKCS1PrivateKey(der); err == nil {
|
||
return key, nil
|
||
}
|
||
return nil, fmt.Errorf("不支持的私钥格式")
|
||
}
|
||
|
||
func chunkBase64(s string, size int) string {
|
||
if size <= 0 {
|
||
return s
|
||
}
|
||
var b strings.Builder
|
||
for i := 0; i < len(s); i += size {
|
||
end := i + size
|
||
if end > len(s) {
|
||
end = len(s)
|
||
}
|
||
if i > 0 {
|
||
b.WriteByte('\n')
|
||
}
|
||
b.WriteString(s[i:end])
|
||
}
|
||
return b.String()
|
||
}
|
||
|
||
func truncate(s string, n int) string {
|
||
if len(s) <= n {
|
||
return s
|
||
}
|
||
return s[:n]
|
||
}
|