node-easywechat 3.5.13 → 3.5.14

package/CHANGELOG.md

@@ -1,6 +1,11 @@
 # CHANGELOG
 
 
+## v3.5.14 (2023-12-20)
+
+- Fix: 修复个别情况下微信支付的敏感信息加密功能可能使用旧证书的问题 (#57)
+- Fix: 获取微信支付平台证书时，忽略有效期少于1天的证书 (#57)
+
 ## v3.5.13 (2023-12-20)
 
 - Feat: 开放平台新增快速注册企业小程序审核事件的支持 (#62)

package/dist/Pay/Contracts/MerchantInterface.d.ts

@@ -49,7 +49,7 @@ declare abstract class MerchantInterface {
      * 从缓存或者接口获取平台证书
      * @param force 是否强制刷新缓存，默认：false
      */
-    loadPlatformCerts(force?: boolean): Promise<void>;
+    loadPlatformCerts(force?: boolean): Promise<Record<string, string>>;
     /**
      * 设置平台证书
      * @param certs 键名：序列号，键值：PublicKey实例或者文件内容字符串

package/dist/Pay/Contracts/MerchantInterface.js

@@ -48,7 +48,7 @@ class MerchantInterface {
      * 从缓存或者接口获取平台证书
      * @param force 是否强制刷新缓存，默认：false
      */
-    loadPlatformCerts(force = false) { return; }
+    loadPlatformCerts(force = false) { return null; }
     /**
      * 设置平台证书
      * @param certs 键名：序列号，键值：PublicKey实例或者文件内容字符串

package/dist/Pay/Merchant.d.ts

@@ -7,6 +7,7 @@ declare class Merchant implements MerchantInterface {
     protected secretKey: string;
     protected v2SecretKey: string;
     protected app: Application;
+    protected isConfigPlatformCerts: boolean;
     protected platformCerts: Record<string, PublicKey>;
     protected privateKey: PrivateKey;
     protected certificate: PublicKey;
@@ -28,6 +29,6 @@ declare class Merchant implements MerchantInterface {
     setPlatformCerts(certs: Record<string, PublicKey | string>): void;
     getPlatformCertKey(): string;
     setPlatformCertKey(key: string): this;
-    loadPlatformCerts(force?: boolean): Promise<void>;
+    loadPlatformCerts(force?: boolean): Promise<Record<string, string>>;
 }
 export = Merchant;

package/dist/Pay/Merchant.js

@@ -17,6 +17,7 @@ class Merchant {
         this.secretKey = secretKey;
         this.v2SecretKey = v2SecretKey;
         this.app = app;
+        this.isConfigPlatformCerts = false;
         this.platformCerts = {};
         if (!(privateKey instanceof PrivateKey_1.PrivateKey)) {
             this.privateKey = new PrivateKey_1.PrivateKey(privateKey);
@@ -50,6 +51,9 @@ class Merchant {
             }
             certs[isArray ? publicKey.getSerialNo() : key] = publicKey;
         }
+        if (Object.keys(certs).length > 0) {
+            this.isConfigPlatformCerts = true;
+        }
         return certs;
     }
     getMerchantId() {
@@ -70,16 +74,20 @@ class Merchant {
     getPlatformCert(serial) {
         var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            if (!this.platformCerts || Object.keys(this.platformCerts).length === 0) {
-                yield this.loadPlatformCerts();
+            if (!this.isConfigPlatformCerts) {
+                // 如果不是通过配置文件设置的平台证书，则每次都从缓存或者接口获取证书
+                let certs = yield this.loadPlatformCerts();
+                this.setPlatformCerts(certs);
             }
             return (_a = this.platformCerts[serial]) !== null && _a !== void 0 ? _a : null;
         });
     }
     getPlatformCerts() {
         return __awaiter(this, void 0, void 0, function* () {
-            if (!this.platformCerts || Object.keys(this.platformCerts).length === 0) {
-                yield this.loadPlatformCerts();
+            if (!this.isConfigPlatformCerts) {
+                // 如果不是通过配置文件设置的平台证书，则每次都从缓存或者接口获取证书
+                let certs = yield this.loadPlatformCerts();
+                this.setPlatformCerts(certs);
             }
             return this.platformCerts;
         });
@@ -89,6 +97,7 @@ class Merchant {
         for (let key of Object.keys(certs)) {
             let cert = certs[key];
             if (typeof cert === 'string') {
+                // 将证书内容封装为 PublicKey
                 newCerts[key] = PublicKey_1.PublicKey.createByCertificateContent(cert, key);
             }
             else {
@@ -117,14 +126,21 @@ class Merchant {
                 let response = yield this.app.getClient().get('/v3/certificates');
                 let data = response.toObject();
                 if (data && data.data && data.data.length > 0) {
+                    let nowTime = Math.round((new Date()).getTime() / 1000);
                     data.data.forEach((item) => {
+                        // 跳过有效期少于1天的证书
+                        let expireTime = Math.round((new Date(item.expire_time)).getTime() / 1000) - 86400;
+                        if (expireTime < nowTime)
+                            return;
                         let content = AES_1.AES_GCM.decrypt(item.encrypt_certificate.ciphertext, this.app.getConfig().get('secret_key'), item.encrypt_certificate.nonce, item.encrypt_certificate.associated_data).toString();
                         certs[item.serial_no] = content;
                     });
-                    yield cache.set(cacheKey, certs, 36000); // 缓存10小时
+                    if (Object.keys(certs).length > 0) {
+                        yield cache.set(cacheKey, certs, 36000); // 缓存10小时
+                    }
                 }
             }
-            this.setPlatformCerts(certs);
+            return certs;
         });
     }
 }

package/dist/Pay/Utils.d.ts

@@ -1,35 +1,21 @@
-/// <reference types="node" />
 import { PublicKey } from '../Core/Support/PublicKey';
+import RSA from '../Core/Support/RSA';
 import { PayAppConfig, PayBridgeConfig, PaySdkConfig } from '../Types/global';
 import MerchantInterface from './Contracts/MerchantInterface';
 declare class Utils {
     protected merchant: MerchantInterface;
-    protected platformCert: PublicKey;
     constructor(merchant: MerchantInterface);
-    /**
-     * 设置加密所用的平台证书
-     * @param platformCert
-     */
-    setPlatformCert(platformCert: PublicKey): this;
     /**
      * 获取加密所用的平台证书
      * @returns
      */
     getPlatformCert(): Promise<PublicKey>;
     /**
-     * 加密字符串
-     * @param plaintext 原文
-     * @param encoding 密文的编码格式，默认：base64
-     * @param hashType 哈希算法，默认：sha256
-     */
-    encrypt(plaintext: string, encoding?: BufferEncoding, hashType?: string): Promise<string>;
-    /**
-     * 解密字符串
-     * @param ciphertext 密文
-     * @param encoding 密文的编码格式，默认：base64
-     * @param hashType 哈希算法，默认：sha256
+     * 获取敏感信息加密机
+     * @param platformCert PublicKey封装过的平台证书
+     * @returns
      */
-    decrypt(ciphertext: string, encoding?: BufferEncoding, hashType?: string): string;
+    getEncryptor(platformCert?: PublicKey): Promise<RSA>;
     /**
      * 创建签名（V3），并返回签名字符串
      * @param params 参数集合

package/dist/Pay/Utils.js

@@ -11,61 +11,42 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
+const PublicKey_1 = require("../Core/Support/PublicKey");
 const RSA_1 = __importDefault(require("../Core/Support/RSA"));
 const Utils_1 = require("../Core/Support/Utils");
 class Utils {
     constructor(merchant) {
         this.merchant = merchant;
     }
-    /**
-     * 设置加密所用的平台证书
-     * @param platformCert
-     */
-    setPlatformCert(platformCert) {
-        this.platformCert = platformCert;
-        return this;
-    }
     /**
      * 获取加密所用的平台证书
      * @returns
      */
     getPlatformCert() {
         return __awaiter(this, void 0, void 0, function* () {
-            if (!this.platformCert) {
-                let certs = yield this.merchant.getPlatformCerts();
-                if (!certs || Object.keys(certs).length === 0) {
-                    throw new Error('Fail to get platform certs');
-                }
-                this.platformCert = certs[Object.keys(certs)[0]];
+            let certs = yield this.merchant.getPlatformCerts();
+            if (!certs || Object.keys(certs).length === 0) {
+                throw new Error('Fail to get platform certs');
             }
-            return this.platformCert;
+            return certs[Object.keys(certs)[0]];
         });
     }
     /**
-     * 加密字符串
-     * @param plaintext 原文
-     * @param encoding 密文的编码格式，默认：base64
-     * @param hashType 哈希算法，默认：sha256
+     * 获取敏感信息加密机
+     * @param platformCert PublicKey封装过的平台证书
+     * @returns
      */
-    encrypt(plaintext, encoding = 'base64', hashType = 'sha256') {
+    getEncryptor(platformCert = null) {
         return __awaiter(this, void 0, void 0, function* () {
             let rsa = new RSA_1.default;
-            let cert = yield this.getPlatformCert();
-            rsa.setPublicKey(cert.toString());
-            return rsa.encrypt(plaintext, encoding, hashType);
+            if (!platformCert || !(platformCert instanceof PublicKey_1.PublicKey)) {
+                platformCert = yield this.getPlatformCert();
+            }
+            rsa.setPublicKey(platformCert.toString());
+            rsa.setPrivateKey(this.merchant.getPrivateKey().toString());
+            return rsa;
         });
     }
-    /**
-     * 解密字符串
-     * @param ciphertext 密文
-     * @param encoding 密文的编码格式，默认：base64
-     * @param hashType 哈希算法，默认：sha256
-     */
-    decrypt(ciphertext, encoding = 'base64', hashType = 'sha256') {
-        let rsa = new RSA_1.default;
-        rsa.setPrivateKey(this.merchant.getPrivateKey().toString());
-        return rsa.decrypt(ciphertext, encoding, hashType);
-    }
     /**
      * 创建签名（V3），并返回签名字符串
      * @param params 参数集合

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-easywechat",
-  "version": "3.5.13",
+  "version": "3.5.14",
   "description": "EasyWechat SDK for Node.js (NOT OFFICIAL)",
   "main": "dist/index.js",
   "scripts": {