wxpay-nodejs-sdk 0.2.2 → 0.2.3

package/dist/index.mjs

@@ -181,13 +181,8 @@ var CertificateManager = class {
     }
   }
 };
-var SDK_VERSION = "0.2.1";
-function getUserAgent() {
-  const platform = os.platform();
-  const arch = os.arch();
-  const nodeVersion = process.version;
-  return `wxpay-nodejs-sdk/${SDK_VERSION} (${platform} ${arch}) Node.js/${nodeVersion}`;
-}
+
+// src/utils/exceptions.ts
 var WxPayError = class extends Error {
   /** HTTP 状态码 */
   status;
@@ -210,7 +205,64 @@ var WxPayError = class extends Error {
   get isServerError() {
     return this.status >= 500 && this.status < 600;
   }
+  /**
+   * 判断是否为特定错误码
+   *
+   * @param code - 错误码
+   * @returns 是否匹配
+   */
+  isApiError(code) {
+    return this.detail.code === code;
+  }
+};
+var ServiceException = class extends WxPayError {
+  /** 微信支付业务错误码 */
+  errorCode;
+  /** 微信支付业务错误信息 */
+  errorMessage;
+  constructor(status, headers, detail) {
+    super(status, headers, detail);
+    this.name = "ServiceException";
+    this.errorCode = detail.code;
+    this.errorMessage = detail.message;
+  }
 };
+var HttpException = class extends WxPayError {
+  constructor(message, cause) {
+    super(0, {}, { code: "NETWORK_ERROR", message });
+    this.name = "HttpException";
+    if (cause) {
+      this.cause = cause;
+    }
+  }
+};
+var ValidationException = class extends WxPayError {
+  constructor(message) {
+    super(0, {}, { code: "SIGN_ERROR", message });
+    this.name = "ValidationException";
+  }
+};
+var DecryptionException = class extends WxPayError {
+  constructor(message) {
+    super(0, {}, { code: "DECRYPT_ERROR", message });
+    this.name = "DecryptionException";
+  }
+};
+var MalformedMessageException = class extends WxPayError {
+  constructor(message) {
+    super(0, {}, { code: "PARSE_ERROR", message });
+    this.name = "MalformedMessageException";
+  }
+};
+
+// src/utils/http.ts
+var SDK_VERSION = "0.2.1";
+function getUserAgent() {
+  const platform = os.platform();
+  const arch = os.arch();
+  const nodeVersion = process.version;
+  return `wxpay-nodejs-sdk/${SDK_VERSION} (${platform} ${arch}) Node.js/${nodeVersion}`;
+}
 function buildUrl(base, path, params) {
   const url = new URL(path, base);
   if (params) {
@@ -272,7 +324,7 @@ async function parseResponse(response, verify) {
         message: `HTTP ${response.status}: ${response.statusText}`
       };
     }
-    throw new WxPayError(response.status, headers, errorDetail);
+    throw new ServiceException(response.status, headers, errorDetail);
   }
   if (verify) {
     const signature = headers["wechatpay-signature"];
@@ -282,10 +334,7 @@ async function parseResponse(response, verify) {
     if (signature && timestamp && nonce && serial) {
       const valid = verify(rawBody, signature, timestamp, nonce, serial);
       if (!valid) {
-        throw new WxPayError(response.status, headers, {
-          code: "SIGN_ERROR",
-          message: "\u5E94\u7B54\u7B7E\u540D\u9A8C\u8BC1\u5931\u8D25"
-        });
+        throw new ValidationException("\u5E94\u7B54\u7B7E\u540D\u9A8C\u8BC1\u5931\u8D25");
       }
     }
   }
@@ -297,10 +346,9 @@ async function parseResponse(response, verify) {
     }
     data = parsed;
   } catch (error) {
-    throw new WxPayError(response.status, headers, {
-      code: "PARSE_ERROR",
-      message: error instanceof Error ? error.message : "\u54CD\u5E94\u6570\u636E\u89E3\u6790\u5931\u8D25"
-    });
+    throw new MalformedMessageException(
+      error instanceof Error ? error.message : "\u54CD\u5E94\u6570\u636E\u89E3\u6790\u5931\u8D25"
+    );
   }
   return {
     status: response.status,
@@ -318,6 +366,12 @@ ${body}
 `;
 }
 function sign(signString, privateKey) {
+  if (!signString) {
+    throw new Error("\u7B7E\u540D\u4E32\u4E0D\u80FD\u4E3A\u7A7A");
+  }
+  if (!privateKey) {
+    throw new Error("\u5546\u6237\u79C1\u94A5\u4E0D\u80FD\u4E3A\u7A7A");
+  }
   const signer = crypto2.createSign("RSA-SHA256");
   signer.update(signString);
   signer.end();
@@ -337,6 +391,18 @@ function isTimestampValid(timestamp) {
   return Math.abs(now - responseTime) < RESPONSE_EXPIRED_SECONDS;
 }
 function verifySignature(body, signature, timestamp, nonce, publicKey) {
+  if (!signature) {
+    throw new Error("\u7B7E\u540D\u503C(signature)\u4E0D\u80FD\u4E3A\u7A7A");
+  }
+  if (!timestamp) {
+    throw new Error("\u65F6\u95F4\u6233(timestamp)\u4E0D\u80FD\u4E3A\u7A7A");
+  }
+  if (!nonce) {
+    throw new Error("\u968F\u673A\u4E32(nonce)\u4E0D\u80FD\u4E3A\u7A7A");
+  }
+  if (!publicKey) {
+    throw new Error("\u516C\u94A5(publicKey)\u4E0D\u80FD\u4E3A\u7A7A");
+  }
   if (!isTimestampValid(timestamp)) {
     return false;
   }
@@ -350,6 +416,12 @@ ${body}
   return verifier.verify(publicKey, signature, "base64");
 }
 function oaepEncrypt(plaintext, publicKey) {
+  if (!publicKey) {
+    throw new Error("\u52A0\u5BC6\u516C\u94A5\u4E0D\u80FD\u4E3A\u7A7A");
+  }
+  if (!plaintext) {
+    return "";
+  }
   const encrypted = crypto2.publicEncrypt(
     {
       key: publicKey,
@@ -361,6 +433,12 @@ function oaepEncrypt(plaintext, publicKey) {
   return encrypted.toString("base64");
 }
 function oaepDecrypt(ciphertext, privateKey) {
+  if (!privateKey) {
+    throw new Error("\u89E3\u5BC6\u79C1\u94A5\u4E0D\u80FD\u4E3A\u7A7A");
+  }
+  if (!ciphertext) {
+    return "";
+  }
   const decrypted = crypto2.privateDecrypt(
     {
       key: privateKey,
@@ -775,6 +853,48 @@ var WxPayClient = class _WxPayClient {
     };
   }
 };
+
+// src/utils/sensitive.ts
+var sensitiveFields = /* @__PURE__ */ new Map();
+function registerSensitiveFields(typeName, fields) {
+  sensitiveFields.set(typeName, new Set(fields));
+}
+function getSensitiveFields(typeName) {
+  return sensitiveFields.get(typeName) ?? /* @__PURE__ */ new Set();
+}
+function encryptSensitiveFields(obj, typeName, publicKey) {
+  const fields = getSensitiveFields(typeName);
+  if (fields.size === 0) return obj;
+  const result = { ...obj };
+  for (const field of fields) {
+    const value = result[field];
+    if (typeof value === "string" && value.length > 0) {
+      result[field] = oaepEncrypt(value, publicKey);
+    }
+  }
+  return result;
+}
+function decryptSensitiveFields(obj, typeName, privateKey) {
+  const fields = getSensitiveFields(typeName);
+  if (fields.size === 0) return obj;
+  const result = { ...obj };
+  for (const field of fields) {
+    const value = result[field];
+    if (typeof value === "string" && value.length > 0) {
+      try {
+        result[field] = oaepDecrypt(value, privateKey);
+      } catch {
+      }
+    }
+  }
+  return result;
+}
+function encryptSensitiveFieldsInArray(arr, typeName, publicKey) {
+  return arr.map((item) => encryptSensitiveFields(item, typeName, publicKey));
+}
+function decryptSensitiveFieldsInArray(arr, typeName, privateKey) {
+  return arr.map((item) => decryptSensitiveFields(item, typeName, privateKey));
+}
 var CertificateService = class {
   client;
   apiV3Key;
@@ -2636,6 +2756,8 @@ var BillService = class {
   }
 };
 var SUPPORTED_SIGNATURE_TYPES = /* @__PURE__ */ new Set(["WECHATPAY2-SHA256-RSA2048"]);
+var DEFAULT_SIGNATURE_TYPE = "WECHATPAY2-SHA256-RSA2048";
+var SUPPORTED_ALGORITHMS = /* @__PURE__ */ new Set(["AEAD_AES_256_GCM"]);
 var CallbackHandler = class {
   apiV3Key;
   certificates;
@@ -2652,14 +2774,26 @@ var CallbackHandler = class {
    * @param headers - 回调请求头
    * @param body - 回调请求体（原始 JSON 字符串）
    * @returns 签名验证是否通过
-   * @throws 如果签名类型不支持或找不到对应的证书
+   * @throws 如果必填参数缺失、签名类型不支持或找不到对应的证书
    */
   verifySignature(headers, body) {
-    const signatureType = headers["wechatpay-signature-type"];
-    const serialNo = headers["wechatpay-serial"];
-    if (signatureType && !SUPPORTED_SIGNATURE_TYPES.has(signatureType)) {
+    if (!headers["wechatpay-serial"]) {
+      throw new Error("\u56DE\u8C03\u5934 wechatpay-serial \u4E0D\u80FD\u4E3A\u7A7A");
+    }
+    if (!headers["wechatpay-signature"]) {
+      throw new Error("\u56DE\u8C03\u5934 wechatpay-signature \u4E0D\u80FD\u4E3A\u7A7A");
+    }
+    if (!headers["wechatpay-timestamp"]) {
+      throw new Error("\u56DE\u8C03\u5934 wechatpay-timestamp \u4E0D\u80FD\u4E3A\u7A7A");
+    }
+    if (!headers["wechatpay-nonce"]) {
+      throw new Error("\u56DE\u8C03\u5934 wechatpay-nonce \u4E0D\u80FD\u4E3A\u7A7A");
+    }
+    const signatureType = headers["wechatpay-signature-type"] ?? DEFAULT_SIGNATURE_TYPE;
+    if (!SUPPORTED_SIGNATURE_TYPES.has(signatureType)) {
       throw new Error(`\u4E0D\u652F\u6301\u7684\u7B7E\u540D\u7C7B\u578B: ${signatureType}`);
     }
+    const serialNo = headers["wechatpay-serial"];
     const publicKey = this.certificates.getPublicKey(serialNo);
     if (!publicKey) {
       throw new Error(`\u672A\u627E\u5230\u5E8F\u5217\u53F7\u4E3A ${serialNo} \u7684\u5E73\u53F0\u8BC1\u4E66\uFF0C\u8BF7\u786E\u4FDD\u5DF2\u914D\u7F6E\u5E73\u53F0\u8BC1\u4E66`);
@@ -2679,10 +2813,22 @@ var CallbackHandler = class {
    *
    * @param notification - 回调通知 JSON 对象
    * @returns 解密后的业务数据
-   * @throws 如果解密后的数据为空或格式无效
+   * @throws 如果通知结构无效、算法不匹配或解密失败
    */
   decryptNotification(notification) {
     const { resource } = notification;
+    if (!resource.algorithm) {
+      throw new Error("\u56DE\u8C03\u901A\u77E5 resource \u7F3A\u5C11 algorithm \u5B57\u6BB5");
+    }
+    if (!resource.ciphertext) {
+      throw new Error("\u56DE\u8C03\u901A\u77E5 resource \u7F3A\u5C11 ciphertext \u5B57\u6BB5");
+    }
+    if (!resource.nonce) {
+      throw new Error("\u56DE\u8C03\u901A\u77E5 resource \u7F3A\u5C11 nonce \u5B57\u6BB5");
+    }
+    if (!SUPPORTED_ALGORITHMS.has(resource.algorithm)) {
+      throw new Error(`\u4E0D\u652F\u6301\u7684\u52A0\u5BC6\u7B97\u6CD5: ${resource.algorithm}`);
+    }
     const plaintext = this.aesGcmDecrypt(
       resource.ciphertext,
       resource.associated_data,
@@ -2930,10 +3076,23 @@ var CallbackHandler = class {
    * @param associatedData - 附加数据（用于 AEAD 认证）
    * @param nonce - 随机串
    * @returns 解密后的明文字符串
+   * @throws 如果密文格式无效或解密失败
    */
   aesGcmDecrypt(ciphertext, associatedData, nonce) {
+    if (!ciphertext) {
+      throw new Error("\u5BC6\u6587(ciphertext)\u4E0D\u80FD\u4E3A\u7A7A");
+    }
+    if (!nonce) {
+      throw new Error("\u968F\u673A\u4E32(nonce)\u4E0D\u80FD\u4E3A\u7A7A");
+    }
+    if (this.apiV3Key.length !== 32) {
+      throw new Error("APIv3 \u5BC6\u94A5\u65E0\u6548\uFF0C\u957F\u5EA6\u5FC5\u987B\u4E3A 32 \u4E2A\u5B57\u8282");
+    }
     const key = Buffer.from(this.apiV3Key, "utf-8");
     const ciphertextBuffer = Buffer.from(ciphertext, "base64");
+    if (ciphertextBuffer.length <= 16) {
+      throw new Error("\u5BC6\u6587\u957F\u5EA6\u65E0\u6548\uFF0C\u5FC5\u987B\u5927\u4E8E 16 \u5B57\u8282\uFF08\u542B AuthTag\uFF09");
+    }
     const authTag = ciphertextBuffer.subarray(-16);
     const encryptedData = ciphertextBuffer.subarray(0, -16);
     const decipher = crypto2.createDecipheriv("aes-256-gcm", key, Buffer.from(nonce, "utf-8"));
@@ -4716,6 +4875,6 @@ ${packageStr}
   };
 }
 
-export { AppService, BillService, BusinessCircleService, CallbackHandler, CertificateManager, CertificateService, CombineAppService, CombineH5Service, CombineMiniProgramService, CombineNativeService, CombineService, ComplaintService, CouponService, GoldPlanService, H5Service, JsapiService, LoveFeastService, MedInsService, MediaService, MerchantExclusiveCouponService, MerchantTransferService, NativeService, ParkingService, PartnershipService, PayGiftActivityService, PayScoreService, PayrollCardService, ProfitSharingService, RetailStoreService, ScanAndRideService, SecurityService, SmartGuideService, WxPayClient, WxPayError, buildAppBridgeConfig, buildAuthorization, buildH5CouponUrl, buildJsapiBridgeConfig, buildMedInsJsapiBridgeConfig, buildMedInsMiniProgramBridgeConfig, buildMerchantTransferAuthorizationJsapiBridgeConfig, buildMerchantTransferJsapiBridgeConfig, buildMerchantTransferMiniProgramBridgeConfig, buildMiniProgramBridgeConfig, buildParkingAppBridgePath, buildParkingH5BridgeUrl, buildParkingMiniProgramBridgeConfig, buildParkingRepayBridgeConfig, buildPayScoreAppBridgeConfig, buildPayScoreDetailAppBridgeConfig, buildPayScoreDetailJsapiBridgeConfig, buildPayScoreDetailMiniProgramBridgeConfig, buildPayScoreJsapiBridgeConfig, buildPayScoreMiniProgramBridgeConfig, buildSignString, generateAppPaySign, generateNonce, generateNonceStr, generatePayScorePaySign, generatePaySign, isTimestampValid, oaepDecrypt, oaepEncrypt, sign, verifySignature };
+export { AppService, BillService, BusinessCircleService, CallbackHandler, CertificateManager, CertificateService, CombineAppService, CombineH5Service, CombineMiniProgramService, CombineNativeService, CombineService, ComplaintService, CouponService, DecryptionException, GoldPlanService, H5Service, HttpException, JsapiService, LoveFeastService, MalformedMessageException, MedInsService, MediaService, MerchantExclusiveCouponService, MerchantTransferService, NativeService, ParkingService, PartnershipService, PayGiftActivityService, PayScoreService, PayrollCardService, ProfitSharingService, RetailStoreService, ScanAndRideService, SecurityService, ServiceException, SmartGuideService, ValidationException, WxPayClient, WxPayError, buildAppBridgeConfig, buildAuthorization, buildH5CouponUrl, buildJsapiBridgeConfig, buildMedInsJsapiBridgeConfig, buildMedInsMiniProgramBridgeConfig, buildMerchantTransferAuthorizationJsapiBridgeConfig, buildMerchantTransferJsapiBridgeConfig, buildMerchantTransferMiniProgramBridgeConfig, buildMiniProgramBridgeConfig, buildParkingAppBridgePath, buildParkingH5BridgeUrl, buildParkingMiniProgramBridgeConfig, buildParkingRepayBridgeConfig, buildPayScoreAppBridgeConfig, buildPayScoreDetailAppBridgeConfig, buildPayScoreDetailJsapiBridgeConfig, buildPayScoreDetailMiniProgramBridgeConfig, buildPayScoreJsapiBridgeConfig, buildPayScoreMiniProgramBridgeConfig, buildSignString, decryptSensitiveFields, decryptSensitiveFieldsInArray, encryptSensitiveFields, encryptSensitiveFieldsInArray, generateAppPaySign, generateNonce, generateNonceStr, generatePayScorePaySign, generatePaySign, isTimestampValid, oaepDecrypt, oaepEncrypt, registerSensitiveFields, sign, verifySignature };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map