q-koa 13.8.44 → 13.8.46

package/core/file/plugins/system/controller.js

@@ -543,22 +543,21 @@ exports.initDataWithCache = exports.initData = async (ctx) => {
   const { app } = getAppByCtx(ctx)
   const appConfig = getConfig(app)
 
-  const { is_cache } = await appConfig.getObject('base')
+  const { is_cache, version: cacheVersion } = await appConfig.getObject('base')
   const { includes, excludes = [] } = ctx.request.body
   if (!includes) {
     return ctx.SUCCESS(null)
   }
-  const cacheTarget = JSON.stringify(ctx.request.body)
+  const cacheTarget = is_cache ? JSON.stringify(ctx.request.body) : ''
 
-  let result = null
-  if (is_cache && cache.get(cacheTarget)) {
-    result = cache.get(cacheTarget)
-  } else {
+  let result = is_cache ? cache.get(cacheTarget) : null
+  if (!result) {
     result = await app.service.system.initData({
       app,
       includes,
       excludes,
       ctx,
+      cacheVersion,
     })
     if (is_cache && cacheTarget.includes('setting/findAll')) {
       cache.set(cacheTarget, result)

package/core/file/plugins/system/service.js

@@ -1,5 +1,5 @@
 const lodash = require('lodash')
-const { getConfig, Sequelize } = require('q-koa')
+const { Sequelize } = require('q-koa')
 const { formatLiteralObj, filterFunction } = require('../../utils')
 const formatPostFunction = (str) => `eval(${str})`
 const nodeVm = require('vm')
@@ -17,19 +17,17 @@ const getLiteral = (str) => {
   }
   return ''
 }
-exports.initData = async ({ includes, excludes, app, ctx }) => {
-  const appConfig = getConfig(app)
-  const { version: cacheVersion } = await appConfig.getObject('base')
-
+exports.initData = async ({ includes, excludes, app, ctx, cacheVersion }) => {
   const apiVersion = ctx.request.header.version
   const config = ctx.request.header.config
 
   if (!(excludes instanceof Array)) {
     excludes = [excludes]
   }
+  const excludeSet = new Set(excludes)
   const result = await Promise.all(
     Object.keys(includes)
-      .filter((item) => excludes.includes(item) || excludes.length === 0)
+      .filter((item) => excludeSet.has(item) || excludes.length === 0)
       .map((item) => {
         const route = includes[item]
         if (lodash.isObject(route)) {
@@ -125,14 +123,17 @@ exports.initData = async ({ includes, excludes, app, ctx }) => {
             Array.isArray(excludeInclude) &&
             excludeInclude.length > 0
           ) {
+            const excludeNameSet = new Set(excludeInclude)
+            const excludeModelSet = new Set(
+              excludeInclude
+                .map((m) => app.model[m])
+                .filter((m) => m !== undefined)
+            )
             myInclude = myInclude.filter((i) => {
-              if (excludeInclude.includes(model)) return false
-              if (excludeInclude.includes(i.as)) return false
+              if (excludeNameSet.has(model)) return false
+              if (excludeNameSet.has(i.as)) return false
               return (
-                (excludeInclude.every((m) => {
-                  return app.model[m] !== i.model
-                }) ||
-                  i.as) &&
+                (!excludeModelSet.has(i.model) || i.as) &&
                 !(
                   i.as &&
                   data.attributes &&
@@ -254,7 +255,9 @@ exports.initData = async ({ includes, excludes, app, ctx }) => {
         }).then((res) => {
           app.cache && app.cache.set(`${model}`, res)
           const cacheModel = lodash.get(app, 'appConfig.cacheModel', [])
-          app.appConfig.cacheModel = Array.from(new Set([...cacheModel, model]))
+          if (!cacheModel.includes(model)) {
+            app.appConfig.cacheModel = [...cacheModel, model]
+          }
           return {
             [item]: res,
           }
@@ -275,14 +278,24 @@ exports.initData = async ({ includes, excludes, app, ctx }) => {
       }
     }
 
+    const settingById = new Map()
+    const codeCount = new Map()
+    for (const s of obj.setting) {
+      settingById.set(s.id, s)
+      codeCount.set(s.code, (codeCount.get(s.code) || 0) + 1)
+    }
+
     return {
       ...obj,
       setting: obj.setting.map((i) => {
         let reset = true
         if (i.parent_id) {
-          const parent = obj.setting.find((s) => s.id === i.parent_id)
-          const same = obj.setting.filter((s) => s.code === i.code)
-          if (parent && parent.code !== config && same.length > 1) {
+          const parent = settingById.get(i.parent_id)
+          if (
+            parent &&
+            parent.code !== config &&
+            (codeCount.get(i.code) || 0) > 1
+          ) {
             reset = false
           }
         }

package/core/file/plugins/weixin/controller.js

@@ -2362,7 +2362,7 @@ exports.union_checkPay = async (ctx) => {
 }
 
 exports.union_check_balance = async (ctx) => {
-  const { app, appName } = getAppByCtx(ctx)
+  const { app } = getAppByCtx(ctx)
 
   const {
     pay_config = 'weixin_pay',

package/core/file/services/allinpay.js

@@ -39,9 +39,12 @@ class AllinPay {
       options.isTest !== undefined ? options.isTest : config.allinpay.isTest
     this.signType = options.signType || config.allinpay.signType
     this.privateKey = options.privateKey || config.allinpay.privateKey
-    this.publicKey = this.isTest
-      ? config.allinpay.publicKey.test
-      : config.allinpay.publicKey.production
+    // 优先使用外部传入的公钥（如商户配置的 union_publicKey），未传则用内置平台公钥
+    this.publicKey =
+      options.publicKey ||
+      (this.isTest
+        ? config.allinpay.publicKey.test
+        : config.allinpay.publicKey.production)
     this.baseUrl = this.isTest
       ? config.allinpay.apiUrl.test
       : config.allinpay.apiUrl.production
@@ -105,25 +108,52 @@ class AllinPay {
     const signStr = this.buildSignStr(paramsCopy)
 
     // PEM 标准化：无头尾则包 SPKI 头尾 + 内容单换行；已有头尾若一行无换行补换行
-    let pem = String(this.publicKey)
-    if (!pem.includes('-----BEGIN')) {
-      pem = `-----BEGIN PUBLIC KEY-----\n${pem}\n-----END PUBLIC KEY-----`
-    } else if (!pem.includes('\n')) {
-      pem = pem
-        .replace('-----BEGIN PUBLIC KEY-----', '-----BEGIN PUBLIC KEY-----\n')
-        .replace('-----END PUBLIC KEY-----', '\n-----END PUBLIC KEY-----')
+    const normalizePem = (key) => {
+      let pem = String(key)
+      if (!pem.includes('-----BEGIN')) {
+        pem = `-----BEGIN PUBLIC KEY-----\n${pem}\n-----END PUBLIC KEY-----`
+      } else if (!pem.includes('\n')) {
+        pem = pem
+          .replace('-----BEGIN PUBLIC KEY-----', '-----BEGIN PUBLIC KEY-----\n')
+          .replace('-----END PUBLIC KEY-----', '\n-----END PUBLIC KEY-----')
+      }
+      return pem
     }
-    // RSA 双算法兜底：先 SHA256（新 2048-bit 证书），失败再 SHA1（老 1024-bit 证书）
-    for (const alg of ['RSA-SHA256', 'RSA-SHA1']) {
-      try {
-        const verify = crypto.createVerify(alg)
-        verify.update(signStr, 'utf8')
-        if (verify.verify(pem, sign, 'base64')) return true
-      } catch (e) {}
+
+    // 候选公钥：先用实例公钥（可能是商户配置的 union_publicKey），失败再用内置平台公钥兜底。
+    // 通联平台响应用平台私钥签名，商户配置的应用公钥验不过时用平台公钥补一轮。
+    const candidates = [this.publicKey]
+    const platformKey = this.isTest
+      ? config.allinpay.publicKey.test
+      : config.allinpay.publicKey.production
+    if (platformKey !== this.publicKey) candidates.push(platformKey)
+
+    for (const pem of candidates) {
+      // RSA 双算法兜底：先 SHA256（新 2048-bit 证书），失败再 SHA1（老 1024-bit 证书）
+      for (const alg of ['RSA-SHA256', 'RSA-SHA1']) {
+        try {
+          const verify = crypto.createVerify(alg)
+          verify.update(signStr, 'utf8')
+          if (verify.verify(normalizePem(pem), sign, 'base64')) return true
+        } catch (e) {}
+      }
     }
     return false
   }
 
+  // 统一响应处理：retcode=SUCCESS 时验签（失败仅告警），否则抛出业务错误
+  _handleResult(result) {
+    if (result && result.retcode === 'SUCCESS') {
+      if (result.sign && !this.verifySign(result)) {
+        console.warn(
+          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
+        )
+      }
+      return result
+    }
+    throw new Error(result.retmsg || 'Unknown error')
+  }
+
   async request(url, params) {
     const _params = new URLSearchParams()
     Object.keys(params).forEach((key) => {
@@ -156,7 +186,8 @@ class AllinPay {
         console.error('Response status:', error.response.status)
         console.error('Response data:', JSON.stringify(error.response.data))
       }
-      throw new Error(error.message)
+      // 直接抛出原始错误，保留错误栈便于排查
+      throw error
     }
   }
 
@@ -216,17 +247,7 @@ class AllinPay {
     const url = `${this.baseUrl}/pay`
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async queryOrder(reqsn) {
@@ -243,17 +264,7 @@ class AllinPay {
     const url = `${this.baseUrl}/query`
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async checkOrder(reqsn) {
@@ -273,17 +284,7 @@ class AllinPay {
       : 'https://vsp.allinpay.com/apiweb/tranx/query'
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async checkBalance(accttype = '01') {
@@ -304,17 +305,7 @@ class AllinPay {
       : 'https://cus.allinpay.com/cusapi/cusacct/querybalance'
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async refundOrder(orderData) {
@@ -331,7 +322,6 @@ class AllinPay {
     }
     if (remark) params.remark = remark
     if (acct) params.acct = acct
-    params.signtype = this.signType
     if (this.notifyUrl) params.notify_url = this.notifyUrl
 
     params.sign = this.sign(params)
@@ -341,17 +331,7 @@ class AllinPay {
       : 'https://vsp.allinpay.com/apiweb/tranx/refund'
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async cancelOrder(reqsn) {
@@ -368,17 +348,7 @@ class AllinPay {
     const url = `${this.baseUrl}/cancel`
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   async downloadBill({ date }) {
@@ -390,7 +360,6 @@ class AllinPay {
       filetype: '1',
       signtype: this.signType,
     }
-    params.signtype = this.signType
 
     params.sign = this.sign(params)
 
@@ -399,17 +368,7 @@ class AllinPay {
       : 'https://cus.allinpay.com/cusapi/trxfile/get'
     const result = await this.request(url, params)
 
-    if (result && result.retcode === 'SUCCESS') {
-      if (result.sign && this.verifySign(result)) {
-        return result
-      } else {
-        console.warn(
-          'Sign verification failed, but retcode is SUCCESS. Returning result anyway.'
-        )
-        return result
-      }
-    }
-    throw new Error(result.retmsg || 'Unknown error')
+    return this._handleResult(result)
   }
 
   generateRandomStr(length = 32) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "q-koa",
-  "version": "13.8.44",
+  "version": "13.8.46",
   "description": "",
   "main": "index.js",
   "scripts": {