ipaynow-nodejs-sdk 1.0.0

package/src/responses.js

@@ -0,0 +1,128 @@
+/**
+ * 通用响应基类：字段访问 + isSuccess 判定（正向交易 responseCode==A001，见规范 §6）。
+ */
+export class IpaynowResponse {
+  constructor() {
+    /** @type {Record<string, string>} */
+    this._fields = {};
+    /** @type {string|undefined} */
+    this._rawBody = undefined;
+  }
+
+  /**
+   * @param {Record<string, string>} fields
+   * @param {string} [rawBody]
+   */
+  load(fields, rawBody) {
+    this._fields = { ...fields };
+    this._rawBody = rawBody;
+  }
+
+  /** @param {string} name */
+  get(name) {
+    return this._fields[name];
+  }
+
+  /** @returns {Record<string, string>} 字段表副本 */
+  fields() {
+    return { ...this._fields };
+  }
+
+  /** @returns {string|undefined} 原始报文串 */
+  rawBody() {
+    return this._rawBody;
+  }
+
+  /** @returns {string|undefined} responseCode */
+  code() {
+    return this.get("responseCode");
+  }
+
+  /** @returns {string|undefined} responseMsg */
+  message() {
+    return this.get("responseMsg");
+  }
+
+  /** @returns {boolean} */
+  isSuccess() {
+    return this.get("responseCode") === "A001";
+  }
+}
+
+/** WP001 统一下单响应公共便捷访问器 */
+export class UnifiedOrderResponse extends IpaynowResponse {
+  /** @returns {string|undefined} 支付要素（兼容大写 TN） */
+  tn() {
+    const tn = this.get("tn");
+    return tn !== undefined ? tn : this.get("TN");
+  }
+
+  /** @returns {string|undefined} 现在支付流水号 */
+  nowPayOrderNo() {
+    return this.get("nowPayOrderNo");
+  }
+}
+
+export class JsapiUnifiedOrderResponse extends UnifiedOrderResponse {}
+export class AggregateCodeUnifiedOrderResponse extends UnifiedOrderResponse {}
+export class MiniProgramUnifiedOrderResponse extends UnifiedOrderResponse {}
+export class H5UnifiedOrderResponse extends UnifiedOrderResponse {}
+export class AppUnifiedOrderResponse extends UnifiedOrderResponse {}
+
+/** MQ002 订单查询响应 */
+export class OrderQueryResponse extends IpaynowResponse {
+  transStatus() {
+    return this.get("transStatus");
+  }
+
+  nowPayOrderNo() {
+    return this.get("nowPayOrderNo");
+  }
+
+  payTime() {
+    return this.get("payTime");
+  }
+
+  channelOrderNo() {
+    return this.get("channelOrderNo");
+  }
+}
+
+/** 退款族响应：responseCode==R000 才算成功 */
+export class RefundResponse extends IpaynowResponse {
+  isSuccess() {
+    return this.get("responseCode") === "R000";
+  }
+}
+
+export class RefundQueryResponse extends IpaynowResponse {
+  isSuccess() {
+    return this.get("responseCode") === "R000";
+  }
+}
+
+export class ReverseResponse extends IpaynowResponse {
+  isSuccess() {
+    return this.get("responseCode") === "R000";
+  }
+}
+
+export class ReverseQueryResponse extends IpaynowResponse {
+  isSuccess() {
+    return this.get("responseCode") === "R000";
+  }
+}
+
+/** N001 支付回调：transStatus==A001 才算成功 */
+export class PaymentNotifyResponse extends IpaynowResponse {
+  isSuccess() {
+    return this.get("transStatus") === "A001";
+  }
+}
+
+/** RN001 退款回调：tradeStatus==A001 才算成功 */
+export class RefundNotifyResponse extends IpaynowResponse {
+  isSuccess() {
+    return this.get("tradeStatus") === "A001";
+  }
+}

package/src/signer.js

@@ -0,0 +1,110 @@
+import crypto from "node:crypto";
+import { SignType } from "./config.js";
+
+/**
+ * @param {string} value
+ * @returns {string} 小写 hex md5
+ */
+export function md5Hex(value) {
+  return crypto.createHash("md5").update(value, "utf8").digest("hex");
+}
+
+/**
+ * 剔除 null / undefined / 空串值，其余值转为字符串。
+ * @param {Record<string, unknown>} fields
+ * @returns {Record<string, string>}
+ */
+export function clean(fields) {
+  const out = {};
+  for (const [key, value] of Object.entries(fields)) {
+    if (value === undefined || value === null || value === "") continue;
+    out[key] = String(value);
+  }
+  return out;
+}
+
+function canonical(fields, excludeSignType = false, ...excludeFields) {
+  const cleaned = clean(fields);
+  if (excludeSignType) delete cleaned.signType;
+  delete cleaned.mhtSignature;
+  delete cleaned.signature;
+  for (const field of excludeFields) delete cleaned[field];
+  return Object.keys(cleaned)
+    .sort()
+    .map((key) => `${key}=${cleaned[key]}`)
+    .join("&");
+}
+
+function md5Sign(canonicalValue, config) {
+  return md5Hex(`${canonicalValue}&${md5Hex(config.appKey)}`);
+}
+
+function rsaSign(canonicalValue, config) {
+  return crypto.sign("RSA-SHA256", Buffer.from(canonicalValue, "utf8"), config.mchPrivateKeyObject).toString("base64");
+}
+
+function strategy(config) {
+  return config.signType === SignType.RSA
+    ? { sign: rsaSign, verify: rsaVerify }
+    : { sign: md5Sign, verify: md5Verify };
+}
+
+function md5Verify(canonicalValue, actual, config) {
+  const expectedBuf = Buffer.from(md5Sign(canonicalValue, config), "utf8");
+  const actualBuf = Buffer.from(String(actual).toLowerCase(), "utf8");
+  return expectedBuf.length === actualBuf.length && crypto.timingSafeEqual(expectedBuf, actualBuf);
+}
+
+function rsaVerify(canonicalValue, actual, config) {
+  try {
+    return crypto.verify(
+      "RSA-SHA256",
+      Buffer.from(canonicalValue, "utf8"),
+      config.ipaynowPublicKeyObject,
+      Buffer.from(String(actual).replace(/\s+/g, ""), "base64")
+    );
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * 现在支付签名算法：
+ * 1. 剔除 null/空串值
+ * 2. 剔除 mhtSignature / signature（以及调用方额外指定的字段）
+ * 3. excludeSignType=true 时再剔除 signType（mhtSignType 是不同字段名，永远参与签名）
+ * 4. 按 key 字典序排序拼接 k=v&k2=v2...
+ * 5. 追加 &md5(appKey)，整体再取 md5
+ *
+ * @param {Record<string, unknown>} fields
+ * @param {import("./config.js").IpaynowConfig} config
+ * @param {boolean} [excludeSignType]
+ * @param {...string} excludeFields 额外需要剔除的字段（如当前签名字段本身）
+ * @returns {string}
+ */
+export function sign(fields, config, excludeSignType = false, ...excludeFields) {
+  return strategy(config).sign(canonical(fields, excludeSignType, ...excludeFields), config);
+}
+
+/**
+ * 验签（安全红线）：签名缺失即失败，常量时间比较。
+ * @param {Record<string, unknown>} fields
+ * @param {import("./config.js").IpaynowConfig} config
+ * @param {string} signatureField
+ * @param {boolean} [excludeSignType]
+ * @returns {boolean}
+ */
+export function verify(fields, config, signatureField, excludeSignType = false) {
+  const actual = fields[signatureField];
+  if (actual === undefined || actual === null || actual === "") {
+    return false;
+  }
+  if (fields.signType && String(fields.signType).toUpperCase() !== config.signType) {
+    return false;
+  }
+  return strategy(config).verify(
+    canonical(fields, excludeSignType, signatureField, "mhtSignature"),
+    actual,
+    config
+  );
+}