q-koa 13.8.32 → 13.8.34

package/core/app.js

@@ -231,7 +231,6 @@ class APP {
        *  挂在jwt解密方法
        */
       if (this.app[appName]) {
-        console.time('ss')
         this.app[appName].sign = async (user) => {
           const result = await jwt.sign(user, secret, {
             expiresIn,
@@ -239,7 +238,6 @@ class APP {
           })
           return result
         }
-        console.timeEnd('ss')
       }
       // eslint-disable-next-line no-nested-ternary
       ctx.request.clientType = ctx.header['client-type']

package/core/file/plugins/weixin/controller.js

@@ -82,6 +82,56 @@ const sendWxFail = (ctx, msg = 'FAIL') => {
   )
 }
 
+/**
+ * 通联(AllinPay)融合回调签名验证（RSA / MD5）
+ * @param {Object} options
+ * @param {Object} options.notifyData  回调 body（必须包含 sign 字段）
+ * @param {string} options.signType   'RSA' | 'MD5'（已大写）
+ * @param {string} options.publicKey  通联平台公钥（PEM body，无 header/footer）
+ * @param {string} options.md5Key     MD5 签名密钥（signType=MD5 时使用）
+ * @returns {boolean}
+ */
+const validateUnionNotifySign = ({ notifyData, signType, publicKey, md5Key }) => {
+  if (!notifyData || !notifyData.sign) return false
+  const params = { ...notifyData }
+  const sign = String(params.sign)
+  delete params.sign
+  // 通联回调报文字段是全小写 signtype；同时删除大小写两种做防御
+  delete params.signType
+  delete params.signtype
+
+  // 通联 buildSignStr：按 ASCII 字典序拼接，跳过空/undefined/null
+  const sortedKeys = Object.keys(params).sort()
+  let signStr = ''
+  for (const k of sortedKeys) {
+    const v = params[k]
+    if (v === undefined || v === null || v === '') continue
+    if (signStr) signStr += '&'
+    signStr += `${k}=${v}`
+  }
+
+  if (signType === 'MD5') {
+    if (!md5Key) return false
+    const expected = crypto
+      .createHash('md5')
+      .update(signStr + `&key=${md5Key}`, 'utf8')
+      .digest('hex')
+      .toUpperCase()
+    return expected === sign.toUpperCase()
+  }
+
+  // 默认 RSA-SHA1（与 allinpay.js verifySign 保持一致）
+  if (!publicKey) return false
+  try {
+    const pem = `-----BEGIN PUBLIC KEY-----\n${publicKey}\n-----END PUBLIC KEY-----`
+    const verify = crypto.createVerify('RSA-SHA1')
+    verify.update(signStr, 'utf8')
+    return verify.verify(pem, sign, 'base64')
+  } catch (e) {
+    return false
+  }
+}
+
 const check = ({ timestamp, nonce, signature, token }) => {
   const tmp = [token, timestamp, nonce].sort().join('')
   const currSign = crypto.createHash('sha1').update(tmp).digest('hex')
@@ -1453,11 +1503,74 @@ exports.union_notify = async (ctx) => {
   try {
     const notifyData = ctx.request.body
 
+    // TODO: 临时观察日志，上线后删除
+    app.service.log.push({
+      app,
+      message: `通联融合回调union_notify报文: ${JSON.stringify(notifyData || {})}`,
+    })
+
+    if (!notifyData || typeof notifyData !== 'object') {
+      ctx.status = 400
+      ctx.body = 'FAIL'
+      return
+    }
+
+    // ===== 通联(AllinPay)回调验签 + 商户号绑定 =====
+    const pay_config = 'weixin_pay'
+    const appConfig = getConfig(app)
+    const {
+      union_mchId,
+      union_appid,
+      union_publicKey,
+      union_md5Key,
+      union_signType,
+    } = await appConfig.getObject(pay_config)
+    const cusid = notifyData.cusid
+
+    if (cusid && union_mchId && cusid !== union_mchId) {
+      app.service.log.push({
+        app,
+        message: `通联回调商户号不匹配: cfg=${union_mchId} got=${cusid}`,
+      })
+      ctx.body = 'FAIL'
+      return
+    }
+
+    // 通联回调报文字段为全小写 signtype；兼容大小写两种 + 配置 union_signType；末位回退 RSA
+    const rawSignType = (notifyData.signtype || notifyData.signType || union_signType || 'RSA').toUpperCase()
+    const hasSign = notifyData.sign !== undefined && notifyData.sign !== ''
+    const trxstatus = notifyData.trxstatus
+
+    // 仅当成功状态(trxstatus==='0000')强制要求签名；失败状态没有 sign 时仍打日志但直接返回 success(不重放)
+    if (trxstatus === '0000' && !hasSign) {
+      app.service.log.push({
+        app,
+        message: `通联回调签名缺失: ${JSON.stringify(notifyData)}`,
+      })
+      ctx.body = 'FAIL'
+      return
+    }
+
+    if (hasSign) {
+      const signOk = validateUnionNotifySign({
+        notifyData,
+        signType: rawSignType,
+        publicKey: union_publicKey,
+        md5Key: union_md5Key,
+      })
+      if (!signOk) {
+        app.service.log.push({
+          app,
+          message: `通联回调验签失败(type=${rawSignType}): ${JSON.stringify(notifyData)}`,
+        })
+        ctx.body = 'FAIL'
+        return
+      }
+    }
+
     const {
       trxcode,
-      trxstatus,
       cusorderid,
-      cusid,
       acct,
       trxid,
       trxamt,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "q-koa",
-  "version": "13.8.32",
+  "version": "13.8.34",
   "description": "",
   "main": "index.js",
   "scripts": {