q-koa 13.8.43 → 13.8.45

package/core/file/plugins/system/service.js

@@ -269,9 +269,7 @@ exports.initData = async ({ includes, excludes, app, ctx }) => {
   if (obj.setting && apiVersion && cacheVersion) {
     let target = null
     if (config) {
-      const application_key = `${app.appConfig.appName}-application`
-
-      const application = app.cache.get(application_key)
+      const application = app.cache.get('application')
       if (application) {
         target = application.find((a) => a.config === config)
       }

package/core/file/plugins/weixin/controller.js

@@ -2361,6 +2361,39 @@ exports.union_checkPay = async (ctx) => {
   ctx.SUCCESS({ prefix, ...payResult })
 }
 
+exports.union_check_balance = async (ctx) => {
+  const { app } = getAppByCtx(ctx)
+
+  const {
+    pay_config = 'weixin_pay',
+    accttype = '01', // 01:余额户 02:冻结户
+    mch_id = '',
+  } = ctx.request.body
+
+  const appConfig = getConfig(app)
+  const {
+    union_mchId,
+    union_appid,
+    union_privateKey,
+    union_publicKey,
+  } = await appConfig.getObject(pay_config)
+
+  const allinpay = new AllinPay({
+    cusid: mch_id || union_mchId,
+    appid: union_appid,
+    isTest: false,
+    privateKey: union_privateKey,
+    publicKey: union_publicKey,
+  })
+
+  const result = await allinpay.checkBalance(accttype)
+
+  // amount 单位为分，转换为元便于前端展示
+  const balance = result.amount ? Number(result.amount) / 100 : 0
+
+  ctx.SUCCESS({ ...result, balance })
+}
+
 exports.b2b_checkPay = async (ctx) => {
   const { app, appName, controller } = getAppByCtx(ctx)
 

package/core/file/services/allinpay.js

@@ -39,9 +39,12 @@ class AllinPay {
       options.isTest !== undefined ? options.isTest : config.allinpay.isTest
     this.signType = options.signType || config.allinpay.signType
     this.privateKey = options.privateKey || config.allinpay.privateKey
-    this.publicKey = this.isTest
-      ? config.allinpay.publicKey.test
-      : config.allinpay.publicKey.production
+    // 优先使用外部传入的公钥（如商户配置的 union_publicKey），未传则用内置平台公钥
+    this.publicKey =
+      options.publicKey ||
+      (this.isTest
+        ? config.allinpay.publicKey.test
+        : config.allinpay.publicKey.production)
     this.baseUrl = this.isTest
       ? config.allinpay.apiUrl.test
       : config.allinpay.apiUrl.production
@@ -105,25 +108,52 @@ class AllinPay {
     const signStr = this.buildSignStr(paramsCopy)
 
     // PEM 标准化：无头尾则包 SPKI 头尾 + 内容单换行；已有头尾若一行无换行补换行
-    let pem = String(this.publicKey)
-    if (!pem.includes('-----BEGIN')) {
-      pem = `-----BEGIN PUBLIC KEY-----\n${pem}\n-----END PUBLIC KEY-----`
-    } else if (!pem.includes('\n')) {
-      pem = pem
-        .replace('-----BEGIN PUBLIC KEY-----', '-----BEGIN PUBLIC KEY-----\n')
-        .replace('-----END PUBLIC KEY-----', '\n-----END PUBLIC KEY-----')
+    const normalizePem = (key) => {
+      let pem = String(key)
+      if (!pem.includes('-----BEGIN')) {
+        pem = `-----BEGIN PUBLIC KEY-----\n${pem}\n-----END PUBLIC KEY-----`
+      } else if (!pem.includes('\n')) {
+        pem = pem
+          .replace('-----BEGIN PUBLIC KEY-----', '-----BEGIN PUBLIC KEY-----\n')
+          .replace('-----END PUBLIC KEY-----', '\n-----END PUBLIC KEY-----')
+      }
+      return pem
     }
-    // RSA 双算法兜底：先 SHA256（新 2048-bit 证书），失败再 SHA1（老 1024-bit 证书）
-    for (const alg of ['RSA-SHA256', 'RSA-SHA1']) {
-      try {
-        const verify = crypto.createVerify(alg)
-        verify.update(signStr, 'utf8')
-        if (verify.verify(pem, sign, 'base64')) return true
-      } catch (e) {}
+
+    // 候选公钥：先用实例公钥（可能是商户配置的 union_publicKey），失败再用内置平台公钥兜底。
+    // 通联平台响应用平台私钥签名，商户配置的应用公钥验不过时用平台公钥补一轮。
+    const candidates = [this.publicKey]
+    const platformKey = this.isTest
+      ? config.allinpay.publicKey.test
+      : config.allinpay.publicKey.production
+    if (platformKey !== this.publicKey) candidates.push(platformKey)
+
+    for (const pem of candidates) {
+      // RSA 双算法兜底：先 SHA256（新 2048-bit 证书），失败再 SHA1（老 1024-bit 证书）
+      for (const alg of ['RSA-SHA256', 'RSA-SHA1']) {
+        try {
+          const verify = crypto.createVerify(alg)
+          verify.update(signStr, 'utf8')
+          if (verify.verify(normalizePem(pem), sign, 'base64')) return true
+        } catch (e) {}
+      }
     }
     return false
   }
 
+  // 统一响应处理：retcode=SUCCESS 时验签（失败仅告警），否则抛出业务错误
+  _handleResult(result) {
+    if (result && result.retcode === 'SUCCESS') {
+      if (result.sign && !this.verifySign(result)) {
+        console.warn(
+          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
+        )
+      }
+      return result
+    }
+    throw new Error(result.retmsg || 'Unknown error')
+  }
+
   async request(url, params) {
     const _params = new URLSearchParams()
     Object.keys(params).forEach((key) => {
@@ -156,7 +186,8 @@ class AllinPay {
         console.error('Response status:', error.response.status)
         console.error('Response data:', JSON.stringify(error.response.data))
       }
-      throw new Error(error.message)
+      // 直接抛出原始错误，保留错误栈便于排查
+      throw error
     }
   }
 
@@ -216,17 +247,7 @@ class AllinPay {
     const url = `${this.baseUrl}/pay`
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async queryOrder(reqsn) {
@@ -243,17 +264,7 @@ class AllinPay {
     const url = `${this.baseUrl}/query`
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async checkOrder(reqsn) {
@@ -273,17 +284,28 @@ class AllinPay {
       : 'https://vsp.allinpay.com/apiweb/tranx/query'
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
+    return this._handleResult(result)
+  }
+
+  async checkBalance(accttype = '01') {
+    const params = {
+      cusid: this.cusid,
+      appid: this.appid,
+      version: '12',
+      randomstr: this.generateRandomStr(),
+      accttype, // 01:余额户查询 02:冻结户查询
+      signtype: this.signType,
     }
-    throw new Error(result.retmsg || 'Unknown error')
+    if (this.orgid) params.orgid = this.orgid
+
+    params.sign = this.sign(params)
+
+    const url = this.isTest
+      ? 'https://syb-test.allinpay.com/vsppcusapi/cusacct/querybalance'
+      : 'https://cus.allinpay.com/cusapi/cusacct/querybalance'
+    const result = await this.request(url, params)
+
+    return this._handleResult(result)
   }
 
   async refundOrder(orderData) {
@@ -300,7 +322,6 @@ class AllinPay {
     }
     if (remark) params.remark = remark
     if (acct) params.acct = acct
-    params.signtype = this.signType
     if (this.notifyUrl) params.notify_url = this.notifyUrl
 
     params.sign = this.sign(params)
@@ -310,17 +331,7 @@ class AllinPay {
       : 'https://vsp.allinpay.com/apiweb/tranx/refund'
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async cancelOrder(reqsn) {
@@ -337,17 +348,7 @@ class AllinPay {
     const url = `${this.baseUrl}/cancel`
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async downloadBill({ date }) {
@@ -359,7 +360,6 @@ class AllinPay {
       filetype: '1',
       signtype: this.signType,
     }
-    params.signtype = this.signType
 
     params.sign = this.sign(params)
 
@@ -368,17 +368,7 @@ class AllinPay {
       : 'https://cus.allinpay.com/cusapi/trxfile/get'
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   generateRandomStr(length = 32) {

package/core/file/utils/index.js

@@ -60,8 +60,7 @@ exports.getObject = (config, app) => async (type) => {
   }
 
   if (app) {
-    const application_key = `${app.appConfig.appName}-application`
-    const applicationList = app.cache.get(application_key)
+    const applicationList = app.cache.get('application')
     const target = applicationList && applicationList.find(findConfig(type))
     if (target) {
       flag = true
@@ -77,7 +76,7 @@ exports.getObject = (config, app) => async (type) => {
 
         if (result.length > 0) {
           const formatData = JSON.parse(JSON.stringify(result))
-          app.cache.set(application_key, formatData)
+          app.cache.set('application', formatData)
 
           const target = formatData.find(findConfig(type))
           if (target) {
@@ -189,11 +188,8 @@ exports.getImageType = (fileBuffer) => {
 
 exports.getAppConfig = async ({ app, config, key, app_id, id }) => {
   if (!(app && (config || key || app_id || id))) return null
-
-  const application_key = `${app.appConfig.appName}-application`
-
   const application =
-    app.cache.get(application_key) || (await app.model.application.findAll())
+    app.cache.get('application') || (await app.model.application.findAll())
   const target = application.find(findConfig(config || key || app_id || id))
 
   return target || null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "q-koa",
-  "version": "13.8.43",
+  "version": "13.8.45",
   "description": "",
   "main": "index.js",
   "scripts": {