+ * 场景 + *
+ * 1. 老商户号，只有平台证书，未开通公钥 （已验证） + * 2. 新商户号，被强制开通公钥，没有平台证书 （已验证） + * 3. 老商户号，有平台证书，主动开通公钥 （未验证，具备条件的朋友，可以帮忙验证下） + * ... + *+ * + * @param certSerialNo c + * @param mchId m + * @param apiV3Key a + * @param merchantPrivateKey m + * @param wxPayHttpProxy w + * @param certAutoUpdateTime c + * @param payBaseUrl p + * @param publicKeyId p + * @param publicKey p + * @return v + * @throws WxPayException e + */ + @SuppressWarnings("java:S107") + static Verifier build( + // 平台证书 - 依赖参数 + String certSerialNo, + String mchId, + String apiV3Key, + PrivateKey merchantPrivateKey, + WxPayHttpProxy wxPayHttpProxy, + int certAutoUpdateTime, + String payBaseUrl, + // 公钥 - 依赖参数 + String publicKeyId, + PublicKey publicKey + ) throws WxPayException { + Verifier certificatesVerifier = null; + Exception ex = null; + + // 构建平台证书验证器 + // （沿用旧逻辑）优先构建平台证书验证器，因为公钥验证器需要平台证书验证器 (见以下 .setOtherVerifier ) + // 新商户号默认无平台证书，已确认无法构建平台证书验证器，会抛出异常；老商户号，有平台证书主动开通公钥的情况，待具备条件的朋友验证 + // 建议公钥模式稳定后，优先构建公钥验证器，以免每次都尝试构建平台证书验证器，且失败 {@link com.github.binarywang.wxpay.v3.auth.PublicCertificateVerifier.verify} + if (merchantPrivateKey != null && StringUtils.isNoneBlank(certSerialNo, apiV3Key)) { + try { + certificatesVerifier = getCertificatesVerifier( + certSerialNo, mchId, apiV3Key, merchantPrivateKey, wxPayHttpProxy, certAutoUpdateTime, payBaseUrl + ); + } catch (Exception e) { + ex = e; + } + } + + // 构建公钥验证器 + if (publicKey != null && StringUtils.isNotBlank(publicKeyId)) { + try { + certificatesVerifier = getPublicCertVerifier(publicKeyId, publicKey, certificatesVerifier); + } catch (Exception e) { + ex = e; + } + } + if (certificatesVerifier != null) { + return certificatesVerifier; + } + + // 有异常时抛出 + if (ex != null) { + throw new WxPayException(ex.getMessage(), ex); + } + + // 没有证书验证器时。不确定是否抛出异常，沿用之前逻辑，返回 null + return null; + } + + /** + * 获取证书验证器. + * + * @param certSerialNo certSerialNo + * @param mchId mchId + * @param apiV3Key apiV3Key + * @param merchantPrivateKey merchantPrivateKey + * @param wxPayHttpProxy wxPayHttpProxy + * @param certAutoUpdateTime certAutoUpdateTime + * @param payBaseUrl payBaseUrl + * @return verifier + */ + private static AutoUpdateCertificatesVerifier getCertificatesVerifier( + String certSerialNo, String mchId, String apiV3Key, PrivateKey merchantPrivateKey, + WxPayHttpProxy wxPayHttpProxy, int certAutoUpdateTime, String payBaseUrl + ) { + return new AutoUpdateCertificatesVerifier( + new WxPayCredentials(mchId, new PrivateKeySigner(certSerialNo, merchantPrivateKey)), + apiV3Key.getBytes(StandardCharsets.UTF_8), certAutoUpdateTime, + payBaseUrl, wxPayHttpProxy); + } + + /** + * 获取公钥验证器. + * + * @param publicKeyId id + * @param publicKey key + * @param certificatesVerifier verifier + * @return verifier + */ + private static Verifier getPublicCertVerifier(String publicKeyId, PublicKey publicKey, Verifier certificatesVerifier) { + Verifier publicCertificatesVerifier = new PublicCertificateVerifier(publicKey, publicKeyId); + publicCertificatesVerifier.setOtherVerifier(certificatesVerifier); + certificatesVerifier = publicCertificatesVerifier; + return certificatesVerifier; + } +} diff --git a/weixin-java-pay/src/main/java/com/github/binarywang/wxpay/config/WxPayConfig.java b/weixin-java-pay/src/main/java/com/github/binarywang/wxpay/config/WxPayConfig.java index 35558d563..2cfec2bc1 100644 --- a/weixin-java-pay/src/main/java/com/github/binarywang/wxpay/config/WxPayConfig.java +++ b/weixin-java-pay/src/main/java/com/github/binarywang/wxpay/config/WxPayConfig.java @@ -4,7 +4,8 @@ import com.github.binarywang.wxpay.util.HttpProxyUtils; import com.github.binarywang.wxpay.util.ResourcesUtils; import com.github.binarywang.wxpay.v3.WxPayV3HttpClientBuilder; -import com.github.binarywang.wxpay.v3.auth.*; +import com.github.binarywang.wxpay.v3.auth.Verifier; +import com.github.binarywang.wxpay.v3.auth.WxPayValidator; import com.github.binarywang.wxpay.v3.util.PemUtils; import lombok.Data; import lombok.EqualsAndHashCode; @@ -19,7 +20,6 @@ import javax.net.ssl.SSLContext; import java.io.*; import java.net.URL; -import java.nio.charset.StandardCharsets; import java.security.KeyStore; import java.security.PrivateKey; import java.security.PublicKey; @@ -227,6 +227,11 @@ public class WxPayConfig { */ private Verifier verifier; + /** + * 是否将全部v3接口的请求都添加Wechatpay-Serial请求头，默认不添加 + */ + private boolean strictlyNeedWechatPaySerial = false; + /** * 返回所设置的微信支付接口请求地址域名. * @@ -320,16 +325,12 @@ public CloseableHttpClient initApiV3HttpClient() throws WxPayException { //构造Http Proxy正向代理 WxPayHttpProxy wxPayHttpProxy = getWxPayHttpProxy(); - Verifier certificatesVerifier; - if (publicKey == null) { - certificatesVerifier = - new AutoUpdateCertificatesVerifier( - new WxPayCredentials(mchId, new PrivateKeySigner(certSerialNo, merchantPrivateKey)), - this.getApiV3Key().getBytes(StandardCharsets.UTF_8), this.getCertAutoUpdateTime(), - this.getPayBaseUrl(), wxPayHttpProxy); - } else { - certificatesVerifier = new PublicCertificateVerifier(publicKey, publicKeyId); - } + // 构造证书验签器 + Verifier certificatesVerifier = VerifierBuilder.build( + this.getCertSerialNo(), this.getMchId(), this.getApiV3Key(), merchantPrivateKey, wxPayHttpProxy, + this.getCertAutoUpdateTime(), this.getPayBaseUrl(), + this.getPublicKeyId(), publicKey + ); WxPayV3HttpClientBuilder wxPayV3HttpClientBuilder = WxPayV3HttpClientBuilder.create() .withMerchant(mchId, certSerialNo, merchantPrivateKey) @@ -382,7 +383,7 @@ private InputStream loadConfigInputStream(String configString, String configPath if (configContent != null) { return new ByteArrayInputStream(configContent); } - + if (StringUtils.isNotEmpty(configString)) { configContent = Base64.getDecoder().decode(configString); return new ByteArrayInputStream(configContent); diff --git a/weixin-java-pay/src/main/java/com/github/binarywang/wxpay/service/impl/BaseWxPayServiceImpl.java b/weixin-java-pay/src/main/java/com/github/binarywang/wxpay/service/impl/BaseWxPayServiceImpl.java index 1fa2f8dc8..530609a7d 100644 --- a/weixin-java-pay/src/main/java/com/github/binarywang/wxpay/service/impl/BaseWxPayServiceImpl.java +++ b/weixin-java-pay/src/main/java/com/github/binarywang/wxpay/service/impl/BaseWxPayServiceImpl.java @@ -251,7 +251,7 @@ public WxPayRefundResult refundV2(WxPayRefundRequest request) throws WxPayExcept @Override public WxPayRefundV3Result refundV3(WxPayRefundV3Request request) throws WxPayException { String url = String.format("%s/v3/refund/domestic/refunds", this.getPayBaseUrl()); - String response = this.postV3(url, GSON.toJson(request)); + String response = this.postV3WithWechatpaySerial(url, GSON.toJson(request)); return GSON.fromJson(response, WxPayRefundV3Result.class); } @@ -294,21 +294,21 @@ public WxPayRefundQueryResult refundQueryV2(WxPayRefundQueryRequest request) thr @Override public WxPayRefundQueryV3Result refundQueryV3(String outRefundNo) throws WxPayException { String url = String.format("%s/v3/refund/domestic/refunds/%s", this.getPayBaseUrl(), outRefundNo); - String response = this.getV3(url); + String response = this.getV3WithWechatPaySerial(url); return GSON.fromJson(response, WxPayRefundQueryV3Result.class); } @Override public WxPayRefundQueryV3Result refundQueryV3(WxPayRefundQueryV3Request request) throws WxPayException { String url = String.format("%s/v3/refund/domestic/refunds/%s", this.getPayBaseUrl(), request.getOutRefundNo()); - String response = this.getV3(url); + String response = this.getV3WithWechatPaySerial(url); return GSON.fromJson(response, WxPayRefundQueryV3Result.class); } @Override public WxPayRefundQueryV3Result refundPartnerQueryV3(WxPayRefundQueryV3Request request) throws WxPayException { String url = String.format("%s/v3/refund/domestic/refunds/%s?sub_mchid=%s", this.getPayBaseUrl(), request.getOutRefundNo(), request.getSubMchid()); - String response = this.getV3(url); + String response = this.getV3WithWechatPaySerial(url); return GSON.fromJson(response, WxPayRefundQueryV3Result.class); } @@ -323,13 +323,13 @@ public WxPayOrderNotifyResult parseOrderNotifyResult(String xmlData, String sign log.debug("微信支付异步通知请求参数：{}", xmlData); WxPayOrderNotifyResult result = WxPayOrderNotifyResult.fromXML(xmlData); if (signType == null) { + this.switchover(result.getMchId(), result.getAppid()); if (result.getSignType() != null) { // 如果解析的通知对象中signType有值，则使用它进行验签 signType = result.getSignType(); - } else if (configMap.get(result.getMchId()).getSignType() != null) { + } else if (this.getConfig().getSignType() != null) { // 如果配置中signType有值，则使用它进行验签 - signType = configMap.get(result.getMchId()).getSignType(); - this.switchover(result.getMchId(), result.getAppid()); + signType = this.getConfig().getSignType(); } } @@ -523,7 +523,7 @@ public WxPayOrderQueryV3Result queryOrderV3(WxPayOrderQueryV3Request request) th url = String.format("%s/v3/pay/transactions/id/%s", this.getPayBaseUrl(), request.getTransactionId()); } String query = String.format("?mchid=%s", request.getMchid()); - String response = this.getV3(url + query); + String response = this.getV3WithWechatPaySerial(url + query); return GSON.fromJson(response, WxPayOrderQueryV3Result.class); } @@ -548,14 +548,14 @@ public WxPayPartnerOrderQueryV3Result queryPartnerOrderV3(WxPayPartnerOrderQuery url = String.format("%s/v3/pay/partner/transactions/id/%s", this.getPayBaseUrl(), request.getTransactionId()); } String query = String.format("?sp_mchid=%s&sub_mchid=%s", request.getSpMchId(), request.getSubMchId()); - String response = this.getV3(url + query); + String response = this.getV3WithWechatPaySerial(url + query); return GSON.fromJson(response, WxPayPartnerOrderQueryV3Result.class); } @Override public CombineQueryResult queryCombine(String combineOutTradeNo) throws WxPayException { String url = String.format("%s/v3/combine-transactions/out-trade-no/%s", this.getPayBaseUrl(), combineOutTradeNo); - String response = this.getV3(url); + String response = this.getV3WithWechatPaySerial(url); return GSON.fromJson(response, CombineQueryResult.class); } @@ -609,7 +609,7 @@ public void closeOrderV3(WxPayOrderCloseV3Request request) throws WxPayException request.setMchid(this.getConfig().getMchId()); } String url = String.format("%s/v3/pay/transactions/out-trade-no/%s/close", this.getPayBaseUrl(), request.getOutTradeNo()); - this.postV3(url, GSON.toJson(request)); + this.postV3WithWechatpaySerial(url, GSON.toJson(request)); } @Override @@ -621,13 +621,13 @@ public void closePartnerOrderV3(WxPayPartnerOrderCloseV3Request request) throws request.setSubMchId(this.getConfig().getSubMchId()); } String url = String.format("%s/v3/pay/partner/transactions/out-trade-no/%s/close", this.getPayBaseUrl(), request.getOutTradeNo()); - this.postV3(url, GSON.toJson(request)); + this.postV3WithWechatpaySerial(url, GSON.toJson(request)); } @Override public void closeCombine(CombineCloseRequest request) throws WxPayException { String url = String.format("%s/v3/combine-transactions/out-trade-no/%s/close", this.getPayBaseUrl(), request.getCombineOutTradeNo()); - this.postV3(url, GSON.toJson(request)); + this.postV3WithWechatpaySerial(url, GSON.toJson(request)); } @Override @@ -771,7 +771,7 @@ public WxPayUnifiedOrderV3Result unifiedPartnerOrderV3(TradeTypeEnum tradeType, } String url = this.getPayBaseUrl() + tradeType.getBasePartnerUrl(); - String response = this.postV3(url, GSON.toJson(request)); + String response = this.postV3WithWechatpaySerial(url, GSON.toJson(request)); return GSON.fromJson(response, WxPayUnifiedOrderV3Result.class); } @@ -788,7 +788,7 @@ public WxPayUnifiedOrderV3Result unifiedOrderV3(TradeTypeEnum tradeType, WxPayUn } String url = this.getPayBaseUrl() + tradeType.getPartnerUrl(); - String response = this.postV3(url, GSON.toJson(request)); + String response = this.postV3WithWechatpaySerial(url, GSON.toJson(request)); return GSON.fromJson(response, WxPayUnifiedOrderV3Result.class); } @@ -801,14 +801,14 @@ public CombineTransactionsResult combine(TradeTypeEnum tradeType, CombineTransac request.setCombineMchid(this.getConfig().getMchId()); } String url = this.getPayBaseUrl() + tradeType.getCombineUrl(); - String response = this.postV3(url, GSON.toJson(request)); + String response = this.postV3WithWechatpaySerial(url, GSON.toJson(request)); return GSON.fromJson(response, CombineTransactionsResult.class); } @Override public