q-koa 13.8.44 → 13.8.45

package/core/file/plugins/weixin/controller.js

@@ -2362,7 +2362,7 @@ exports.union_checkPay = async (ctx) => {
 }
 
 exports.union_check_balance = async (ctx) => {
-  const { app, appName } = getAppByCtx(ctx)
+  const { app } = getAppByCtx(ctx)
 
   const {
     pay_config = 'weixin_pay',

package/core/file/services/allinpay.js

@@ -39,9 +39,12 @@ class AllinPay {
       options.isTest !== undefined ? options.isTest : config.allinpay.isTest
     this.signType = options.signType || config.allinpay.signType
     this.privateKey = options.privateKey || config.allinpay.privateKey
-    this.publicKey = this.isTest
-      ? config.allinpay.publicKey.test
-      : config.allinpay.publicKey.production
+    // 优先使用外部传入的公钥（如商户配置的 union_publicKey），未传则用内置平台公钥
+    this.publicKey =
+      options.publicKey ||
+      (this.isTest
+        ? config.allinpay.publicKey.test
+        : config.allinpay.publicKey.production)
     this.baseUrl = this.isTest
       ? config.allinpay.apiUrl.test
       : config.allinpay.apiUrl.production
@@ -105,25 +108,52 @@ class AllinPay {
     const signStr = this.buildSignStr(paramsCopy)
 
     // PEM 标准化：无头尾则包 SPKI 头尾 + 内容单换行；已有头尾若一行无换行补换行
-    let pem = String(this.publicKey)
-    if (!pem.includes('-----BEGIN')) {
-      pem = `-----BEGIN PUBLIC KEY-----\n${pem}\n-----END PUBLIC KEY-----`
-    } else if (!pem.includes('\n')) {
-      pem = pem
-        .replace('-----BEGIN PUBLIC KEY-----', '-----BEGIN PUBLIC KEY-----\n')
-        .replace('-----END PUBLIC KEY-----', '\n-----END PUBLIC KEY-----')
+    const normalizePem = (key) => {
+      let pem = String(key)
+      if (!pem.includes('-----BEGIN')) {
+        pem = `-----BEGIN PUBLIC KEY-----\n${pem}\n-----END PUBLIC KEY-----`
+      } else if (!pem.includes('\n')) {
+        pem = pem
+          .replace('-----BEGIN PUBLIC KEY-----', '-----BEGIN PUBLIC KEY-----\n')
+          .replace('-----END PUBLIC KEY-----', '\n-----END PUBLIC KEY-----')
+      }
+      return pem
     }
-    // RSA 双算法兜底：先 SHA256（新 2048-bit 证书），失败再 SHA1（老 1024-bit 证书）
-    for (const alg of ['RSA-SHA256', 'RSA-SHA1']) {
-      try {
-        const verify = crypto.createVerify(alg)
-        verify.update(signStr, 'utf8')
-        if (verify.verify(pem, sign, 'base64')) return true
-      } catch (e) {}
+
+    // 候选公钥：先用实例公钥（可能是商户配置的 union_publicKey），失败再用内置平台公钥兜底。
+    // 通联平台响应用平台私钥签名，商户配置的应用公钥验不过时用平台公钥补一轮。
+    const candidates = [this.publicKey]
+    const platformKey = this.isTest
+      ? config.allinpay.publicKey.test
+      : config.allinpay.publicKey.production
+    if (platformKey !== this.publicKey) candidates.push(platformKey)
+
+    for (const pem of candidates) {
+      // RSA 双算法兜底：先 SHA256（新 2048-bit 证书），失败再 SHA1（老 1024-bit 证书）
+      for (const alg of ['RSA-SHA256', 'RSA-SHA1']) {
+        try {
+          const verify = crypto.createVerify(alg)
+          verify.update(signStr, 'utf8')
+          if (verify.verify(normalizePem(pem), sign, 'base64')) return true
+        } catch (e) {}
+      }
     }
     return false
   }
 
+  // 统一响应处理：retcode=SUCCESS 时验签（失败仅告警），否则抛出业务错误
+  _handleResult(result) {
+    if (result && result.retcode === 'SUCCESS') {
+      if (result.sign && !this.verifySign(result)) {
+        console.warn(
+          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
+        )
+      }
+      return result
+    }
+    throw new Error(result.retmsg || 'Unknown error')
+  }
+
   async request(url, params) {
     const _params = new URLSearchParams()
     Object.keys(params).forEach((key) => {
@@ -156,7 +186,8 @@ class AllinPay {
         console.error('Response status:', error.response.status)
         console.error('Response data:', JSON.stringify(error.response.data))
       }
-      throw new Error(error.message)
+      // 直接抛出原始错误，保留错误栈便于排查
+      throw error
     }
   }
 
@@ -216,17 +247,7 @@ class AllinPay {
     const url = `${this.baseUrl}/pay`
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async queryOrder(reqsn) {
@@ -243,17 +264,7 @@ class AllinPay {
     const url = `${this.baseUrl}/query`
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async checkOrder(reqsn) {
@@ -273,17 +284,7 @@ class AllinPay {
       : 'https://vsp.allinpay.com/apiweb/tranx/query'
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async checkBalance(accttype = '01') {
@@ -304,17 +305,7 @@ class AllinPay {
       : 'https://cus.allinpay.com/cusapi/cusacct/querybalance'
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async refundOrder(orderData) {
@@ -331,7 +322,6 @@ class AllinPay {
     }
     if (remark) params.remark = remark
     if (acct) params.acct = acct
-    params.signtype = this.signType
     if (this.notifyUrl) params.notify_url = this.notifyUrl
 
     params.sign = this.sign(params)
@@ -341,17 +331,7 @@ class AllinPay {
       : 'https://vsp.allinpay.com/apiweb/tranx/refund'
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async cancelOrder(reqsn) {
@@ -368,17 +348,7 @@ class AllinPay {
     const url = `${this.baseUrl}/cancel`
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async downloadBill({ date }) {
@@ -390,7 +360,6 @@ class AllinPay {
       filetype: '1',
       signtype: this.signType,
     }
-    params.signtype = this.signType
 
     params.sign = this.sign(params)
 
@@ -399,17 +368,7 @@ class AllinPay {
       : 'https://cus.allinpay.com/cusapi/trxfile/get'
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   generateRandomStr(length = 32) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "q-koa",
-  "version": "13.8.44",
+  "version": "13.8.45",
   "description": "",
   "main": "index.js",
   "scripts": {